joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042870
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x214]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0
push eax
xor edi, edi
push esi
push edi
call fcn.10056f20
add esp, 0x1c
test eax, eax
je 0x10042964
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x210]
call fcn.10057800
add esp, 0xc
test eax, eax
je 0x10042944
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10042906
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push 0x1f
call fcn.10003680
add esp, 4
test eax, eax
je 0x10042920
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x1004292d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
test esi, esi
je 0x1004293a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
pop ebx
je 0x10042944
mov edi, 1
mov eax, dword [ebp - 0x210]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x10042957
push eax
call esi
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x10042964
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10044fc0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1025ab6c], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jne 0x10045030
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [ebp - 0xaa0]
push eax
call fcn.10174a60
add esp, 4
call fcn.1014f520
cmp dword [0x1025ab6c], 0
jne 0x10045030
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push 0xa90
lea eax, [ebp - 0xa98]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa9c]
push edi
call fcn.10002490
mov eax, dword [ebp - 0xa9c]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea eax, [ebp - 0x288]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test esi, esi
jne 0x10045076
xor ecx, ecx
jmp 0x1004508f
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x10045080
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10045080
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0xa9c]
call fcn.10003740
mov eax, dword [ebp - 0xa9c]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea eax, [ebp - 0xa98]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test ebx, ebx
jne 0x100450c0
xor ecx, ecx
jmp 0x100450d4
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100450c5
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0xa9c]
call fcn.10003740
mov eax, dword [ebp - 0xa9c]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea eax, [ebp - 0x88]
push ebx
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov dword [ebp - 8], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, dword [ebp + 0x14]
lea esi, [ebp - 0xa98]
add eax, 0x10
mov ecx, 0x2a5
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0xaa0]
push eax
sub esp, 0xa94
xor eax, eax
test ebx, ebx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
setne al
inc eax
push eax
call fcn.10036970
mov esi, dword [ebp - 0xaa0]
add esp, 0xa9c
cmp eax, 1
jne 0x1004518b
xor edi, edi
test ebx, ebx
je 0x1004516a
push 1
mov ecx, 0x1025b450
call fcn.10008cd0
mov edi, eax
push 1
push esi
call fcn.100d9c10
add esp, 8
test ebx, ebx
je 0x10045184
push edi
mov ecx, 0x1025b450
call fcn.10008cd0
mov ebx, 1
jmp 0x1004518d
xor ebx, ebx
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100451a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa9c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x100451c2
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1004de60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1004de91
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1004de80
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1004e7a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x208
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
movzx edi, byte [ebp + 0xc]
add esp, 0xc
xor edi, 1
xor ebx, ebx
shl edi, 8
mov dword [ebp - 0x210], ebx
add edi, 0x20119
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1004e803
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x31
call fcn.10003680
add esp, 4
test eax, eax
je 0x1004e829
lea ecx, [ebp - 0x210]
push ecx
push edi
push 0
push str.CLSID
push SysReAllocString
call eax
jmp 0x1004e843
lea eax, [ebp - 0x210]
push eax
push edi
push 0
push str.CLSID
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test esi, esi
je 0x1004e850
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x1004e870
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x210]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1004e88c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3b
call fcn.10003680
add esp, 4
push 0x104
test eax, eax
je 0x1004e8ac
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push edi
call eax
jmp 0x1004e8bb
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test esi, esi
je 0x1004e8c8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x1004e932
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll__wcslwr
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
add esp, 4
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x218], edi
push eax
call fcn.1002df80
mov ecx, dword [ebp - 0x214]
push eax
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x224]
push eax
call fcn.1002f710
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
inc ebx
jmp 0x1004e870
mov edi, dword [ebp - 0x210]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1004e94e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x44
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x1004e961
call eax
jmp 0x1004e967
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1004e972
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10056d30
Capabilities:
Delete file
Delete registry value
Move file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.360safe
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
push 0
push 0x104
lea eax, [ebp - 0x414]
mov dword [ebp - 0x428], str.WinSockLSPIFSL.reg
push eax
push dword [0x10257d10]
mov dword [ebp - 0x424], str.WinSockLSP.reg
mov dword [ebp - 0x420], str.360.log
mov dword [ebp - 0x41c], str.360ss.dat
mov dword [ebp - 0x418], str.360ss2.dat
call fcn.100da6a0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x28
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
lea ecx, [ecx]
push dword [ebp + esi*4 - 0x428]
lea eax, [ebp - 0x414]
push eax
push 0x10205358
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1000aa70
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x10056e20
push 4
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
inc esi
cmp esi, 5
jb 0x10056de0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x10056ed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10056eeb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1f
call fcn.10003680
add esp, 4
push dword [ebp + 8]
test eax, eax
je 0x10056f00
call eax
jmp 0x10056f06
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test esi, esi
je 0x10056f13
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x10057610
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x8c]
push eax
push ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x9c], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xa0], eax
test eax, eax
je 0x100577e6
push eax
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x100577e6
push esi
push dword [ebp - 0xa0]
push 0
push dword [ebp - 0xa4]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100577c6
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x98]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100577c6
cmp dword [ebp - 0x90], 0
je 0x1005773b
mov ecx, dword [ebp - 0x98]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xFileDescription
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.1000aa70
add esp, 0x14
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1005773b
push dword [ebp - 0x88]
push 0x102029dc
push dword [ebp - 0x94]
push dword [ebp - 0x90]
call fcn.1000aa70
mov eax, dword [ebp - 0x90]
add esp, 0x10
mov ecx, dword [ebp - 0x94]
xor edx, edx
mov word [eax + ecx*2 - 2], dx
test edi, edi
je 0x100577bc
mov ecx, dword [ebp - 0x98]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xCompanyName
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.1000aa70
add esp, 0x14
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x100577a0
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
push str.StringFileInfo040904E4CompanyName
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100577bc
push dword [ebp - 0x88]
push 0x102029dc
push ebx
push edi
call fcn.1000aa70
add esp, 0x10
xor eax, eax
mov word [edi + ebx*2 - 2], ax
mov dword [ebp - 0x9c], 1
push esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x9c]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10057d90
Capabilities:
Create thread

Disassembly:
cmp dword [0x102578b4], 0
jne 0x10057db5
push 0
push 0
push 0
push 0x10058050
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [0x102578b4], eax
ret
Function at 0x10058260
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1005827b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.10003180
push 0x46
mov edi, dword [eax + 0x138]
call fcn.10003680
add esp, 4
test edi, edi
je 0x100582a8
test eax, eax
je 0x100582bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x1005833a
test eax, eax
je 0x100582bc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x1005833a
mov eax, dword [0x10257afc]
test al, 1
jne 0x100582e7
or eax, 1
push str.Advapi32.dll
mov dword [0x10257afc], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov eax, dword [0x10257afc]
mov dword [0x10257af8], ecx
jmp 0x100582ed
mov ecx, dword [0x10257af8]
test ecx, ecx
je 0x1005832e
test al, 2
jne 0x10058310
push str.RegDeleteKeyExW
or eax, 2
push ecx
mov dword [0x10257afc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10257b00], eax
jmp 0x10058315
mov eax, dword [0x10257b00]
test eax, eax
je 0x1005832e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
cmp edi, 1
jne 0x1005833c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test esi, esi
je 0x10058347
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x10058350
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1005836b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x37
call fcn.10003680
add esp, 4
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x10058383
call eax
jmp 0x10058389
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test esi, esi
je 0x10058396
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x10058450
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
push edi
push esi
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
push ebx
push edi
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xffffffff
call fcn.10058810
mov ebx, dword [ebp - 0x10]
mov dword [ebp + 0x14], 0
test ebx, ebx
je 0x1005850a
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100584b8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x39
call fcn.10003680
mov edi, dword [ebp + 0x10]
add esp, 4
push edi
push ebx
test eax, eax
je 0x100584cf
call eax
jmp 0x100584d5
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test esi, esi
je 0x100584e2
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test ebx, ebx
sete al
mov dword [ebp + 0x14], eax
test ebx, ebx
jne 0x1005850d
push dword [ebp - 4]
push edi
push 0x10202940
push dword [ebp - 0x10]
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
jmp 0x1005850d
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1005857e
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1005852a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x39
call fcn.10003680
add esp, 4
push edi
push ebx
test eax, eax
je 0x1005853e
call eax
jmp 0x10058544
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 0x10], eax
test esi, esi
je 0x10058552
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0x10]
xor eax, eax
test ecx, ecx
sete al
mov dword [ebp + 0x10], eax
test ecx, ecx
jne 0x10058580
push dword [ebp - 4]
push edi
push 0x10202940
push ebx
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b450
mov eax, dword [ebp + 0x10]
jmp 0x10058580
xor eax, eax
cmp dword [ebp + 0x14], 0
jne 0x100585a0
test eax, eax
jne 0x100585a0
lea ecx, [ebp - 0x10]
or esi, 0xffffffff
call fcn.10008220
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.10008220
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100585c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 0x20]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov dword [ebp - 8], 0xffffffff
call fcn.10058810
mov ebx, dword [ebp + 0x1c]
or edi, 0xffffffff
mov dword [ebp + 0x20], 0
test ebx, ebx
je 0x10058604
mov eax, dword [ebx]
mov dword [ebp + 0x20], eax
cmp dword [ebp - 0xc], 0
je 0x10058672
push esi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10058621
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
mov ecx, dword [ebp + 0x18]
add esp, 4
push ebx
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push 0
push ecx
mov ecx, dword [ebp - 0xc]
push ecx
test eax, eax
je 0x10058646
call eax
jmp 0x1005864c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x10058659
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
test edi, edi
jne 0x10058672
lea ecx, [ebp - 0x10]
xor edi, edi
call fcn.10008220
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10058696
test ebx, ebx
je 0x10058682
mov ecx, dword [ebp + 0x20]
mov dword [ebx], ecx
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push eax
call fcn.10023dd0
mov edi, eax
lea ecx, [ebp - 0x10]
call fcn.10008220
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10058720
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0
push dword [esi + 0xc]
push edi
push ebx
call fcn.10058260
test eax, eax
je 0x100587ec
cmp eax, 5
jne 0x10058773
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x10058773
push edi
push ebx
call fcn.100dc890
add esp, 8
test eax, eax
je 0x10058773
push 0
push dword [esi + 0xc]
push edi
push ebx
call fcn.10058260
test eax, eax
je 0x100587ec
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10058789
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x37
call fcn.10003680
add esp, 4
push edi
push ebx
test eax, eax
je 0x1005879d
call eax
jmp 0x100587a3
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp + 0xc], eax
test esi, esi
je 0x100587b1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 0xc]
cmp esi, 5
jne 0x100587e3
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x100587e3
push edi
push ebx
call fcn.100dc890
add esp, 8
test eax, eax
je 0x100587e3
push edi
push ebx
call fcn.10058350
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
push edi
push ebx
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b380
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x10058930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push edi
mov dword [ebp - 4], eax
mov edi, dword [eax]
test edi, edi
je 0x10058aa3
push esi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1005895b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push 0x43
call fcn.10003680
mov ebx, dword [ebp + 0x10]
add esp, 4
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push edi
test eax, eax
je 0x10058983
call eax
mov edi, eax
mov dword [ebp + 0x14], edi
jmp 0x1005898e
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov dword [ebp + 0x14], eax
test esi, esi
je 0x10058999
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x10058a98
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], esi
cmp eax, 1
je 0x100589c4
cmp eax, 2
jne 0x10058a57
test ebx, ebx
je 0x10058a17
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x10058a17
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x100589fd
push edi
lea ecx, [ebp + 0x10]
call fcn.10003310
mov esi, dword [ebp + 0x10]
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x10058a57
cmp dword [esi - 0xc], 0
lea edx, [esi - 0x10]
mov edi, dword [edx]
je 0x10058a57
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x10058a39
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x10058a57
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10058a4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push esi
push dword [ebp + 8]
push 0x10202940
push dword [eax]
call fcn.1010aeb0
mov ecx, eax
call fcn.1010b760
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10058a8c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 0x14]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10