joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb7614
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0xb7627
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0xb7636
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0xb8144
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0001415c
mov eax, dword [ebp - 8]
call fcn.0001415c
xor eax, eax
push ebp
push 0xb82b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00013fa8
cmp eax, 0x40
jle 0xb81b0
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 8]
call fcn.000b8108
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 8]
call fcn.00013db0
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.00014340
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.00014340
mov eax, dword [ebp - 8]
call fcn.00013fa8
mov esi, eax
test esi, esi
jle 0xb8219
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00014178
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.00014178
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0xb81e1
lea eax, [ebp - 0xac]
call fcn.000b7614
mov ebx, 0xb7748
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0xc]
call fcn.000b7e64
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.000b7e64
lea ecx, [ebp - 0x14]
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.000b7f8c
lea eax, [ebp - 0xac]
call fcn.000b7614
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x10]
call fcn.000b7e64
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x14]
call fcn.000b7e64
mov ecx, edi
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.000b7f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb82c0
lea eax, [ebp - 0xb0]
call fcn.00013d18
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00013d3c
ret
Function at 0xbeda4
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0xbedb3
add esp, 0xfffffff0
call fcn.000132f0
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.000be3b4
mov dl, 1
mov eax, dword [0x46658]
call fcn.000468cc
mov dword [edi + 0x24], eax
mov dl, 1
mov eax, dword [0x46658]
call fcn.000468cc
mov dword [edi + 0x30], eax
mov dl, 1
mov eax, dword [0x35c08]
call fcn.00012fc0
mov dword [edi + 0x5c], eax
mov dl, 1
mov eax, dword [0x35c08]
call fcn.00012fc0
mov dword [edi + 0x6c], eax
mov dl, 1
mov eax, dword [0xb8e0c]
call fcn.000bd8e4
mov esi, eax
mov dword [edi + 0x1c], esi
mov dword [esi + 0x1c0], edi
mov byte [esi + 6], 1
mov edx, 0x10000
mov eax, esi
call fcn.000bba1c
mov edx, 0x10000
mov eax, dword [edi + 0x1c]
call fcn.000bba44
mov dword [edi + 0x18], 0x15f90
lea eax, [edi + 4]
mov edx, 0xbeedc
call fcn.00013d6c
lea eax, [edi + 0x28]
call fcn.00013d18
lea eax, [edi + 0x7c]
mov edx, 0xbeee8
call fcn.00013d6c
lea eax, [edi + 0x60]
call fcn.00013d18
lea eax, [edi + 0x3c]
call fcn.00013d18
lea eax, [edi + 0x50]
call fcn.00013d18
lea eax, [edi + 0x54]
call fcn.00013d18
lea eax, [edi + 0x38]
mov edx, 0xbeef4
call fcn.00013d6c
mov byte [edi + 0x2c], 1
mov byte [edi + 0x78], 0
lea eax, [edi + 0x70]
mov edx, 0xbef00
call fcn.00013d6c
xor eax, eax
mov dword [edi + 0x44], eax
xor eax, eax
mov dword [edi + 0x68], eax
mov byte [edi + 0x48], 1
mov dword [edi + 0x20], 0x12c
mov eax, edi
call fcn.000bef7c
mov eax, edi
test bl, bl
je 0xbeecc
call fcn.00013348
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0xc8f14
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xc8fb6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00026f34
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0xc8f8c
mov dword [ebp - 4], ebx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xc8fc4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 8], 0
je 0xc8f9b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc8fbd
lea eax, [ebp - 0x10]
call fcn.00013d18
ret

Function at 0xc8fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xc9080
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xc9056
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xc9090
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xc9056
mov ebx, dword [ebp - 4]
cmp dword [ebp - 8], 0
je 0xc9065
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc9087
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0xc90a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0xc9183
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0xc919c
call fcn.00013ff4
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00013db0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0xc9145
mov eax, dword [ebp - 0x10]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
jmp 0xc914c
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp dword [ebp - 4], 0
je 0xc915b
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc918a
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 8]
call fcn.00013d18
ret

Function at 0xc91b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0xc92b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, esi
call fcn.00013d18
mov dword [ebx], 0xffffffff
lea eax, [ebp - 4]
mov ecx, edi
mov edx, 0xc92c8
call fcn.00013ff4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0xc927f
mov dword [ebp - 0xc], 0x5000
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.000271f0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0001416c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0xc9274
cmp dword [ebp - 0x10], 1
jne 0xc9274
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00027218
cmp dword [ebp - 8], 0
je 0xc928e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc92b8
lea eax, [ebp - 0x18]
call fcn.00013d18
lea eax, [ebp - 4]
call fcn.00013d18
ret
Function at 0xc94e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xc95d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.000c9488
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xc95aa
lea eax, [ebp - 8]
mov edx, 0x10e
call fcn.000271f0
mov dword [ebp - 0x10], 0x10e
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xc95e4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xc9599
cmp dword [ebp - 4], 1
jne 0xc9592
cmp dword [ebp - 0x10], 0x104
jne 0xc9592
mov eax, 0x2c27e4
mov edx, dword [ebp - 8]
call fcn.00013ee0
xor ebx, ebx
jmp 0xc959b
mov ebx, 0xd
jmp 0xc959b
mov ebx, eax
lea eax, [ebp - 8]
mov edx, 0x10e
call fcn.00027218
jmp 0xc95ac
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0xc95bb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc95dd
lea eax, [ebp - 0x14]
call fcn.00013d18
ret

Function at 0xc97dc
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xc9892
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
call fcn.00026f34
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0xc9868
push 0xc98a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov ebx, 0x104
push ebx
mov eax, dword [0x2c27e4]
call fcn.0001416c
push eax
push 1
push 0
push 0xc98ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 4], 0
je 0xc9877
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc9899
lea eax, [ebp - 0xc]
call fcn.00013d18
ret
Function at 0xc9cc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xc9d75
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xc9d4b
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xc9d84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xc9d4b
cmp dword [ebp - 8], 4
jne 0xc9d4b
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0xc9d5a
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc9d7c
lea eax, [ebp - 0x14]
call fcn.00013d18
ret

Function at 0xc9d98
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0xc9e3f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 1
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00026f34
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0xc9e15
mov dword [ebp - 0xc], esi
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0xc9e50
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
cmp dword [ebp - 8], 0
je 0xc9e24
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc9e46
lea eax, [ebp - 0x10]
call fcn.00013d18
ret

Function at 0xde080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, 0x1388
mov dword [esp], 0x1388
mov dword [esp + 4], 4
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0xde114
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [esp + 8], 0
je 0xde10b
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xde15c
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xde101
cmp dword [esp], 0x3e8
jb 0xde101
cmp dword [esp], 0x7530
ja 0xde101
mov ebx, dword [esp]
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop ebx
ret
Function at 0xdfe70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0xdfe78
push ecx
push ebx
xor eax, eax
push ebp
push 0xdff9c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x2519c8]
cmp byte [eax], 0
je 0xdff7a
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xdff66
lea eax, [ebp - 4]
mov edx, 0x10
call fcn.000271f0
mov dword [ebp - 0xc], 0xf
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xdffac
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xdff59
cmp dword [ebp - 8], 1
jne 0xdff59
cmp dword [ebp - 0xc], 0
jbe 0xdff59
cmp dword [ebp - 0xc], 0xf
ja 0xdff59
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00013ee0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000272e8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000273cc
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x24]
mov eax, 0xdffc8
call fcn.000273cc
mov edx, dword [ebp - 0x24]
pop eax
call fcn.000140b8
sete bl
lea eax, [ebp - 4]
mov edx, 0x10
call fcn.00027218
cmp dword [ebp - 0x10], 0
je 0xdff75
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x2518e0]
mov byte [eax], bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xdffa3
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00013d3c
ret
Function at 0xdffcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe00d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 2], 0xd3d
xor eax, eax
push ebp
push 0xe00b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x14], 0xd3d
mov dword [ebp - 8], 4
xor eax, eax
push ebp
push 0xe0098
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe00e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe008e
cmp dword [ebp - 0x14], 0x3e8
jb 0xe0088
cmp dword [ebp - 0x14], 0xffff
jae 0xe0088
cmp dword [ebp - 0x10], 4
jne 0xe0088
mov ax, word [ebp - 0x14]
mov word [ebp - 2], ax
jmp 0xe008e
mov word [ebp - 2], 0xd3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xe00a2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xe00bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe00dc
lea eax, [ebp - 0x18]
call fcn.00013d18
ret

Function at 0xe0100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov word [ebp - 2], 0xd3d
xor eax, eax
push ebp
push 0xe01da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0
push 0
push 0xe01f0
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 8], 0xd3d
mov dword [ebp - 0xc], 4
xor eax, eax
push ebp
push 0xe01bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe0238
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe01b3
cmp dword [ebp - 8], 0
jbe 0xe0194
cmp dword [ebp - 8], 0x3e8
jb 0xe01a3
cmp dword [ebp - 8], 0xffff
jae 0xe01a3
cmp dword [ebp - 0x14], 4
je 0xe01ab
mov word [ebp - 2], 0xd3d
jmp 0xe01b3
mov ax, word [ebp - 8]
mov word [ebp - 2], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xe01c7
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xe01e4
mov ax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe77b0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xe78be
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov esi, eax
mov bl, 8
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 4]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0xe7813
cmp dword [ebp - 0x10], 0
je 0xe7845
mov eax, dword [ebp - 0x10]
mov bl, byte [eax]
jmp 0xe7845
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00027478
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0xe78d8
call fcn.00013ff4
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov edx, 0xe78f0
call fcn.000df2cc
cmp dword [ebp - 0x10], 0
je 0xe7854
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
xor eax, eax
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetTickCount
mov edx, esi
call fcn.000292ac
cmp eax, 0xbb8
jb 0xe78a3
call sub.kernel32.dll_GetTickCount
mov edx, esi
call fcn.000292ac
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00027444
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0xe78fc
call fcn.00013ff4
mov eax, dword [ebp - 0x1c]
mov ecx, edi
mov edx, 0xe78f0
call fcn.000df1e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe78c5
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00013d3c
ret

Function at 0xed32c
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xfffffec0
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x40
call fcn.00012c70
mov dword [esp], 0x40
push esp
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0xed372
push dword [esp + 0xc]
push dword [esp + 0xc]
lea eax, [esp + 0x48]
call fcn.0001555c
lea edx, [esp + 0x40]
mov eax, ebx
call fcn.00013f4c
jmp 0xed37e
mov eax, ebx
mov edx, 0xed390
call fcn.00013d6c
add esp, 0x140
pop ebx
ret