joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a8c28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
and eax, 0xff
cmp eax, 1
je 0x100a8c4c
mov eax, 0xfffffff7
jmp 0x100a8d54
mov dword [ebp - 0x10], 0
jmp 0x100a8c5e
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shl edx, 5
cmp edx, dword [ebp + 8]
jge 0x100a8c78
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + eax*4], 0
jmp 0x100a8c55
mov dword [ebp - 0x10], 0
jmp 0x100a8c8a
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 2
cmp eax, dword [ebp + 8]
jge 0x100a8d52
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [ebp - 8], dl
cmp dword [ebp + 0x14], 0
je 0x100a8cb5
mov eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x10]
mov cl, byte [ebp - 8]
mov byte [eax], cl
movsx edx, byte [ebp - 8]
cmp edx, 0x30
jl 0x100a8cd3
movsx eax, byte [ebp - 8]
cmp eax, 0x39
jg 0x100a8cd3
movsx ecx, byte [ebp - 8]
sub ecx, 0x30
mov dword [ebp - 4], ecx
jmp 0x100a8d16
movsx edx, byte [ebp - 8]
cmp edx, 0x61
jl 0x100a8cf1
movsx eax, byte [ebp - 8]
cmp eax, 0x66
jg 0x100a8cf1
movsx ecx, byte [ebp - 8]
sub ecx, 0x57
mov dword [ebp - 4], ecx
jmp 0x100a8d16
movsx edx, byte [ebp - 8]
cmp edx, 0x41
jl 0x100a8d0f
movsx eax, byte [ebp - 8]
cmp eax, 0x46
jg 0x100a8d0f
movsx ecx, byte [ebp - 8]
sub ecx, 0x37
mov dword [ebp - 4], ecx
jmp 0x100a8d16
mov eax, 0xfffffffe
jmp 0x100a8d54
mov eax, dword [ebp - 0x10]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ecx, dword [ebp - 0x10]
xor ecx, 1
and ecx, 7
shl ecx, 2
mov edx, dword [ebp - 4]
shl edx, cl
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + eax*4]
or ecx, edx
mov eax, dword [ebp - 0x10]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, dword [ebp + 0x10]
mov dword [edx + eax*4], ecx
jmp 0x100a8c81
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100ae170
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov dword [ebp - 0x14], 0
push 0x33c
mov eax, dword [ebp + 0xc]
push eax
call fcn.100bac98
add esp, 8
mov byte [ebp - 0x118], 0
mov cl, byte [ebp - 0x118]
mov byte [ebp - 0x224], cl
lea edx, [ebp - 0x118]
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x228]
mov dword [ebp - 4], eax
mov dword [ebp - 0x11c], 0x104
movsx ecx, byte [ebp + 8]
push ecx
push 0x101509e0
lea edx, [ebp - 0x10]
push edx
call sub.MSVCR70D.dll_sprintf
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x22c], eax
cmp dword [ebp + 0x10], 0
jne 0x100ae201
cmp dword [ebp - 0x22c], 2
je 0x100ae22f
cmp dword [ebp - 0x22c], 4
je 0x100ae22f
push 0x20
mov ecx, dword [ebp + 0xc]
add ecx, 0x30c
push ecx
push 0
push 0
push 0
push 0x104
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], ecx
cmp dword [ebp - 0x230], 1
je 0x100ae24f
cmp dword [ebp - 0x230], 4
je 0x100ae259
jmp 0x100ae2b8
mov eax, 4
jmp 0x100ae379
mov byte [ebp - 0xe], 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x10]
push ecx
call sub.MPR.dll_WNetGetConnectionA
mov dword [ebp - 0x120], eax
push 0x5c
lea edx, [ebp - 0x116]
push edx
call sub.MSVCR70D.dll_strchr
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 0x120], 0
jne 0x100ae2b8
cmp dword [ebp - 8], 0
je 0x100ae2b8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x116]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov byte [edx], 0
cmp dword [ebp - 0x22c], 2
jne 0x100ae30d
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x208], 0
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 0x104], 0
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov al, byte [ebp + 8]
push eax
call fcn.100ae37d
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x334], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x334]
push eax
call fcn.100ae6f8
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x338], eax
jmp 0x100ae35c
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x104
push edx
call sub.MSVCR70D.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x208
push ecx
call sub.MSVCR70D.dll_strcpy
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x334], 0
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 8]
mov byte [eax + 0x32c], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x22c]
mov dword [edx + 0x330], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100aef77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 4
lea eax, [ebp - 0x14]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100aefa7
xor eax, eax
jmp 0x100aeff7
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x100aefda
xor eax, eax
jmp 0x100aeff7
cmp dword [ebp - 0x10], 4
je 0x100aefe4
xor eax, eax
jmp 0x100aeff7
cmp dword [ebp + 0x14], 0
je 0x100aeff2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100aeffb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0x1017e8c8
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100af02f
xor eax, eax
jmp 0x100af05d
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x100af061
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x18]
mov byte [eax], 0
lea ecx, [ebp - 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100af090
xor eax, eax
jmp 0x100af0ea
lea ecx, [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100af0ce
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x100af0c6
cmp dword [ebp - 0x10], 2
jbe 0x100af0c4
jmp 0x100af0c6
jmp 0x100af0cc
mov ecx, dword [ebp + 0x18]
mov byte [ecx], 0
jmp 0x100af0d4
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x18]
movsx eax, byte [ecx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x100af0ee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 2
push 0
push 0x1017e8cc
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100af122
xor eax, eax
jmp 0x100af152
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x100bb4d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100bb4fd
xor eax, eax
jmp 0x100bb571
mov dword [ebp - 4], 0x400
push 0x1017ed58
lea eax, [ebp - 0x40c]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x410]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100bb547
mov dword [ebp - 0xc], 0
jmp 0x100bb54e
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x40c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call sub.MSVCR70D.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100bb575
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0x1017ed5c
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100bb5a9
xor eax, eax
jmp 0x100bb5f0
mov ecx, dword [ebp + 0x14]
push ecx
call sub.MSVCR70D.dll_strlen
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100bb5dc
mov dword [ebp - 0xc], 0
jmp 0x100bb5e3
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x100bb711
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x10183e88], eax
cmp dword [0x10183e88], 0
jne 0x100bb73a
mov dword [ebp - 0x20], 0
jmp 0x100bb7ad
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x10183e88]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x10183e8c], eax
cmp dword [0x10183e8c], 0
jne 0x100bb764
mov dword [ebp - 0x20], 0
jmp 0x100bb7a0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [0x10183e8c]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100bb793
cmp dword [ebp - 0x18], 1
jne 0x100bb78c
mov dword [ebp - 0x20], 0
jmp 0x100bb793
mov dword [ebp - 0x20], 1
mov ecx, dword [0x10183e8c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [0x10183e88]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret

Function at 0x100bbb42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100bbc5e
mov dword [ebp - 0x110], 0x100
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100bbc54
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x220], ecx
cmp dword [ebp - 0x220], 1
je 0x100bbbe3
jmp 0x100bbc2f
cmp dword [ebp - 8], 0
jne 0x100bbbfc
push 0x14
push 4
push 0
call fcn.10092e60
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x10c]
push eax
call fcn.100f744d
add esp, 4
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x21c]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.1009307b
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], 0x100
mov dword [ebp - 0xc], 0x100
jmp 0x100bbb91
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x100bbde0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push 0x10152510
lea eax, [ebp - 0x810]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
push 0x10152520
lea ecx, [ebp - 0x810]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x810]
push eax
call sub.MSVCR70D.dll_strcat
add esp, 8
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100bbe44
xor eax, eax
jmp 0x100bbeb8
mov dword [ebp - 4], 0x400
push 0x1017ed60
lea ecx, [ebp - 0x40c]
push ecx
call sub.MSVCR70D.dll_strcpy
add esp, 8
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100bbe8e
mov dword [ebp - 0xc], 0
jmp 0x100bbe95
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp + 0x14]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x100bbedb
Capabilities:
Delete registry key
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x1017ed48], 0
jne 0x100bc049
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x100bbf21
push str.anonymous
lea edx, [ebp - 0x230]
push edx
call sub.MSVCR70D.dll_strcpy
add esp, 8
lea eax, [ebp - 0x230]
push eax
push 0x10152530
push str._s_s
lea ecx, [ebp - 0x12c]
push ecx
call sub.MSVCR70D.dll_sprintf
add esp, 0x10
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0x1017ed64
push 0
push 0x10152558
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100bbf77
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 1
push 0x1017ed68
push 0
lea ecx, [ebp - 0x12c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100bbfd7
mov dword [0x1017e928], reloc.OLEAUT32.dll_SysReAllocString
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [0x1017ed48], 1
jmp 0x100bc049
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 1
push 0x1017ed6c
push 0
lea eax, [ebp - 0x12c]
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100bc037
mov dword [0x1017e928], reloc.WSOCK32.dll_accept
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x12c]
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [0x1017ed48], 1
jmp 0x100bc049
push str.Can_not_use_registry_for_rpc_mapping._portmapper_must_run_n
call fcn.100bb012
add esp, 4
call fcn.10081094
mov eax, dword [0x1017e928]
mov esp, ebp
pop ebp
ret
Function at 0x100bc07b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x101525a4
lea eax, [ebp - 0x410]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
push 0x101525b4
lea ecx, [ebp - 0x410]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x410]
push eax
call sub.MSVCR70D.dll_strcat
add esp, 8
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0xf003f
push 0
push 0x1017ed70
push 0
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100bc0f0
xor eax, eax
jmp 0x100bc137
mov edx, dword [ebp + 0x14]
push edx
call sub.MSVCR70D.dll_strlen
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0x14]
push eax
push 2
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100bc123
mov dword [ebp - 0xc], 0
jmp 0x100bc12a
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x100bc179
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
cmp dword [ebp + 8], 0
je 0x100bc1be
cmp dword [ebp + 0x10], 0
je 0x100bc1be
cmp dword [ebp + 0x14], 0
je 0x100bc1be
push 0x1017ed74
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR70D.dll_strcmp
add esp, 8
test eax, eax
je 0x100bc1be
push 0x1017ed78
mov ecx, dword [ebp + 0x10]
push ecx
call sub.MSVCR70D.dll_strcmp
add esp, 8
test eax, eax
jne 0x100bc1c5
xor eax, eax
jmp 0x100bc36c
push 0
push 0x400
lea edx, [ebp - 0x414]
push edx
call fcn.10094da5
add esp, 0xc
push 0x101525b8
lea eax, [ebp - 0x414]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
push str._
lea ecx, [ebp - 0x414]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x414]
push eax
call sub.MSVCR70D.dll_strcat
add esp, 8
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0xf003f
push 0
push 0x1017ed7c
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.100bbedb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100bc24c
xor eax, eax
jmp 0x100bc36c
cmp dword [ebp + 0xc], 0
je 0x100bc325
push 0x1017ed80
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR70D.dll_strcmp
add esp, 8
test eax, eax
je 0x100bc325
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x101525cc
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR70D.dll_strtok
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100bc29a
xor eax, eax
jmp 0x100bc36c
cmp dword [ebp - 0xc], 0
je 0x100bc325
push 0x101525d0
lea ecx, [ebp - 0x414]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x414]
push eax
call sub.MSVCR70D.dll_strcat
add esp, 8
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0xf003f
push 0
push 0x1017ed84
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.100bbedb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100bc2fe
xor eax, eax
jmp 0x100bc36c
push 0x101525d4
push 0
call sub.MSVCR70D.dll_strtok
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100bc320
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100bc29a
mov edx, dword [ebp + 0x14]
push edx
call sub.MSVCR70D.dll_strlen
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0x14]
push eax
push 2
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100bc358
mov dword [ebp - 0x10], 0
jmp 0x100bc35f
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x100bc370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
cmp dword [ebp + 8], 0
je 0x100bc3b5
cmp dword [ebp + 0x10], 0
je 0x100bc3b5
cmp dword [ebp + 0x14], 0
je 0x100bc3b5
push 0x1017ed88
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR70D.dll_strcmp
add esp, 8
test eax, eax
je 0x100bc3b5
push 0x1017ed8c
mov ecx, dword [ebp + 0x10]
push ecx
call sub.MSVCR70D.dll_strcmp
add esp, 8
test eax, eax
jne 0x100bc3bc
xor eax, eax
jmp 0x100bc4e5
push 0
push 0x400
lea edx, [ebp - 0x810]
push edx
call fcn.10094da5
add esp, 0xc
push 0x101525d8
lea eax, [ebp - 0x810]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
push 0x101525e8
lea ecx, [ebp - 0x810]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x810]
push eax
call sub.MSVCR70D.dll_strcat
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x100bc44f
push 0x1017ed90
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR70D.dll_strcmp
add esp, 8
test eax, eax
je 0x100bc44f
push 0x101525ec
lea edx, [ebp - 0x810]
push edx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x810]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x810]
push eax
call fcn.100bbedb
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100bc471
xor eax, eax
jmp 0x100bc4e5
mov dword [ebp - 4], 0x400
push 0x1017ed94
lea ecx, [ebp - 0x40c]
push ecx
call sub.MSVCR70D.dll_strcpy
add esp, 8
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100bc4bb
mov dword [ebp - 0xc], 0
jmp 0x100bc4c2
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp + 0x14]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100bc4e9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push 0x101525f0
lea eax, [ebp - 0x810]
push eax
call sub.MSVCR70D.dll_strcpy
add esp, 8
push 0x10152600
lea ecx, [ebp - 0x810]
push ecx
call sub.MSVCR70D.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x810]
push eax
call sub.MSVCR70D.dll_strcat
add esp, 8
lea ecx, [ebp - 0x810]
push ecx
call fcn.100bbedb
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x100bc54b
mov eax, 1
jmp 0x100bc54d
xor eax, eax
mov esp, ebp
pop ebp
ret