joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012835
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c0
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebx], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x80070057
test esi, esi
je 0x10128d1
cmp word [esi], 0
je 0x10128d1
push 2
push 2
lea ecx, [ebp - 0x19c]
call fcn.010126c5
mov edi, dword [ebp - 8]
test edi, edi
jl 0x10128c6
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1bc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x1c0]
push eax
xor edi, edi
push edi
push esi
mov dword [ebp - 0x1c0], 4
mov dword [ebp - 0x1bc], edi
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, edi
je 0x1020329
cmp eax, 0x2af9
jne 0x102038c
xor edi, edi
inc edi
lea ecx, [ebp - 0x19c]
call fcn.010128e9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret 8
push esi
call fcn.0104143b
test eax, eax
jl 0x102037b
push 0x804
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
pop ecx
js 0x102037b
mov eax, dword [ebp - 0x1a0]
push 2
push edi
push edi
push 0x401
push esi
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
test eax, eax
jne 0x1020374
mov dword [ebx], esi
jmp 0x102037b
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x1a0]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
jmp 0x10128c6
call fcn.01041421
mov edi, eax
jmp 0x10128c6
Function at 0x1012b4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1049180], ebx
jne 0x1012c7f
push 0x1012d54
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x1012ce5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xfe
push edi
call esi
cmp eax, ebx
je 0x1012ce5
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call eax
push 0x1012d44
push edi
call esi
push 0x1012d34
push edi
mov dword [0x1049240], eax
call esi
push 0x1012d20
push edi
mov dword [0x1049244], eax
call esi
push 0x1012d08
push edi
mov dword [0x1049250], eax
call esi
push 0x1012cf4
push edi
mov dword [0x1049248], eax
call esi
push 0xd4
push edi
mov dword [0x104924c], eax
call esi
push 0xd5
push edi
mov dword [0x1049254], eax
call esi
push 0xd6
push edi
mov dword [0x1049258], eax
call esi
push 0xd7
push edi
mov dword [0x104925c], eax
call esi
push 0xfb
push edi
mov dword [0x1049260], eax
call esi
mov dword [0x1049264], eax
cmp dword [0x1049240], ebx
je 0x1012ce9
cmp dword [0x1049244], ebx
je 0x1012ce9
cmp dword [0x1049250], ebx
je 0x1012ce9
cmp dword [0x104924c], ebx
je 0x1012ce9
cmp dword [0x1049248], ebx
je 0x1012ce9
cmp dword [0x1049254], ebx
je 0x1012ce9
cmp dword [0x1049258], ebx
je 0x1012ce9
cmp dword [0x104925c], ebx
je 0x1012ce9
cmp eax, ebx
je 0x1012ce9
mov dword [0x1049180], 1
mov eax, dword [ebp + 8]
mov ecx, dword [0x1049240]
mov dword [eax], ecx
mov ecx, dword [0x1049244]
mov dword [eax + 4], ecx
mov ecx, dword [0x1049250]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x1049248]
mov dword [eax + 8], ecx
mov ecx, dword [0x104924c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x1049254]
mov dword [eax + 0x14], ecx
mov ecx, dword [0x1049258]
mov dword [eax + 0x18], ecx
mov ecx, dword [0x104925c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [0x1049260]
mov dword [eax + 0x20], ecx
mov ecx, dword [0x1049264]
mov dword [eax + 0x24], ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
jmp 0x1012cde
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1012ce5

Function at 0x10133e1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp + 0x10], esi
push dword [ecx + 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1013421
cmp dword [ebp + 0x10], esi
jne 0x10203df
mov ecx, dword [ebp - 4]
mov dword [edi], ecx
pop edi
pop esi
test eax, eax
jg 0x10203e7
leave
ret 0xc
push 0x57
pop eax
jmp 0x101341c
and eax, 0xffff
or eax, 0x80070000
jmp 0x101342b
Function at 0x1014981
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0101449c
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x428]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0x430]
push eax

Function at 0x10151f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x120]
push eax
xor esi, esi
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1015232
cmp byte [ebp - 6], 3
je 0x101c784
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01003279
leave
ret
lea eax, [ebp - 0x124]
push eax
push 0x20019
push esi
push 0x101c840
push 0x80000002
mov dword [ebp - 0x124], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c7fc
push esi
push esi
push esi
push esi
push 0x101c828
push dword [ebp - 0x124]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x101c7eb
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101c7e8
test byte [eax + 0x1c], 1
je 0x101c7e8
push 0x101552c
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245a6
xor esi, esi
inc esi
push dword [ebp - 0x124]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1015232
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101c820
test byte [eax + 0x1c], 1
je 0x101c820
push 0x101552c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245a6
xor esi, esi
inc esi
jmp 0x1015232

Function at 0x1015559
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1015140
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10155b8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x10155c0
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x101c504
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
mov esi, dword [ebp - 8]
jmp 0x10155af
Function at 0x1015c73
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x1015cf8
push 0x80000002
mov esi, 0x3200000
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1015cd7
and dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1015cdc
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x101b09e
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
mov esi, dword [ebp - 4]
jmp 0x1015cce

Function at 0x1015d4b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SystemCurrentControlSetControlPrint
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1015daa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x1015db0
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x101b0b0
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop esi
leave
ret
mov eax, dword [ebp - 8]
mov dword [0x1049ec4], eax
jmp 0x1015da1
Function at 0x10161a9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1016230
push 0x80000002
mov dword [ebp - 0xc], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101621f
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1016280
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
je 0x101c2b9
cmp dword [0x1049efc], ebx
jne 0x101c2c6
push dword [ebp - 0xc]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop edi
pop esi
cmp dword [0x1049efc], ebx
pop ebx
jne 0x101c31b
leave
ret
mov eax, dword [ebp - 4]
mov dword [0x1049efc], eax
jmp 0x1016208
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x101c330
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x101c2ec
mov eax, dword [ebp - 4]
mov dword [0x1049f98], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x101c364
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1016214
mov eax, dword [ebp - 4]
mov dword [0x104a114], eax
jmp 0x1016214
push 0x103289a
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
jmp 0x101622c
Function at 0x101767c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1049184], eax
cmp eax, esi
je 0x101777b
push 4
lea ecx, [ebp - 4]
push ecx
push esi
push eax
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push esi
call fcn.01016336
mov edi, eax
cmp edi, esi
je 0x1017782
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [0x1049188], esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0x80000000
push 0x10492e8
call ebx
mov edi, eax
test edi, edi
je 0x1017782
push 0x80000000
push 0x1049300
mov dword [0x104918c], esi
call ebx
mov edi, eax
test edi, edi
je 0x1017782
push 0x1049280
push esi
mov dword [0x1049190], esi
call fcn.0101223a
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
test edi, edi
je 0x1017782
call fcn.01017e41
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
test edi, edi
je 0x1017782
call fcn.010162b5
mov edi, eax
test edi, edi
je 0x1017782
mov dword [0x1049194], esi
call fcn.0101778e
mov edi, eax
test edi, edi
je 0x1017782
mov dword [0x1049198], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1049120], eax
cmp eax, 0xffffffff
je 0x101c8a1
test edi, edi
je 0x1017782
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
xor edi, edi
jmp 0x10176ba
call fcn.010333de
jmp 0x1017772
xor edi, edi
jmp 0x101776e

Function at 0x101778e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 4
pop edi
mov esi, 0x10493a0
push esi
mov dword [ebp - 0xc], edi
call fcn.0101632b
test eax, eax
je 0x101d694
push 0x1049330
push esi
call fcn.010178c1
test eax, eax
je 0x101d69b
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x1015140
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1017842
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push 0
push 0x101784c
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x10493a4
lea eax, [ebp - 0xc]
push eax
push 0
push 0x101786c
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x1049370
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1017898
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
xor eax, eax
jmp 0x1017845
push esi
call fcn.0103e46b
jmp 0x101d694
Function at 0x1017c18
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x1017c94
cmp dword [ebp + 0xc], edi
je 0x1017c94
cmp dword [ebp + 0x10], edi
je 0x1017c94
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push dword [0x1049edc]
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
push eax
call fcn.01003589
mov esi, eax
cmp esi, edi
jl 0x1017c8c
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push eax
call fcn.01003589
mov esi, eax
cmp esi, edi
jge 0x101c47c
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 0x10
mov esi, 0x80004003
jmp 0x1017c8c
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x1017c83
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x1017c83
Function at 0x1019a10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, 0x1019b30
mov eax, edi
mov dword [ebp - 0x218], edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1019a3a
and dword [ebp - 0x210], 0
and dword [ebp - 0x214], 0
sub eax, esi
sar eax, 1
lea esi, [eax + 0x208]
test edx, edx
je 0x1019b1a
mov eax, edx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1019a69
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x207
jae 0x1019b1a
push ebx
lea eax, [esi + esi]
push eax
call sym.spoolsv.exe_PrvDllAllocSplMem
mov ebx, eax
test ebx, ebx
je 0x1019b19
push edi
push esi
push ebx
call fcn.0100bc94
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1019aa4
sub eax, ecx
sar eax, 1
lea ecx, [ebx + eax*2]
push 0x5c
pop eax
mov word [ecx], ax
mov eax, edi
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x1019ac0
sub eax, edx
sar eax, 1
sub esi, eax
dec esi
push esi
add ecx, 2
push ecx
push dword [ebp - 0x218]
call sym.spoolsv.exe_PrvFormatPrinterForRegistryKey
mov esi, 0x20019
push esi
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov edi, eax
test edi, edi
je 0x1019b13
lea eax, [ebp - 0x214]
push eax
push esi
push 0
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1019ba0
push edi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push ebx
call sym.spoolsv.exe_PrvDllFreeSplMem
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.01003279
leave
ret 4
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1019be8
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x208
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x101e49b
push dword [ebp - 0x214]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1019b0c
mov esi, dword [0x10491bc]
mov dword [ebp - 0x210], esi
test esi, esi
jne 0x101e4b6
jmp 0x1019bd5
mov esi, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1019bd5
mov esi, dword [esi]
mov dword [ebp - 0x210], esi
test esi, esi
je 0x1019bd5
jmp 0x101e4b0
Function at 0x101a648
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
neg esi
push edi
mov edi, ecx
push dword [edi + 0x30]
sbb esi, esi
and esi, 0x7ff8ffa9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
add esi, 0x80070057
call fcn.0100bb2c
cmp esi, ebx
jl 0x101a752
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1c]
push eax
call fcn.0100bdf0
mov esi, eax
cmp esi, ebx
jne 0x101a778
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.0101a583
mov esi, eax
cmp esi, ebx
jl 0x101a752
mov ecx, dword [ebp - 8]
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], ebx
call fcn.0101a5c7
mov esi, eax
cmp esi, ebx
jl 0x101a73a
push dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
call fcn.0100ccdd
mov esi, eax
cmp esi, ebx
jl 0x101a73a
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x10], ebx
call fcn.0101a5ef
mov esi, eax
cmp esi, ebx
jl 0x101a73a
push ebx
push dword [ebp - 0xc]
mov eax, 0x101a818
push eax
push 0x101a780
push eax
push dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.0100d167
add esp, 0x1c
push eax
call fcn.01003589
mov esi, eax
cmp esi, ebx
jl 0x101a73a
push ebx
push ebx
push dword [ebp + 0x10]
push 0x80000003
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
push dword [ebp + 0x10]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], ebx
jne 0x101a752
mov edx, dword [ebp + 0xc]
xor eax, eax
inc eax
mov dword [edx], eax
dec dword [edi + 0x18]
mov edx, dword [ecx]
push eax
call dword [edx]
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x101a75f
mov eax, dword [ecx]
push 1
call dword [eax]
cmp esi, ebx
jl 0x101fa21
lea ecx, [ebp - 0x10]
call fcn.0100bb00
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
jl 0x101a752
jmp 0x101fa17
mov esi, 0x80004005
jmp 0x101a6b1
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101a767
test byte [eax + 0x1c], 1
je 0x101a767
push esi
push 0x10242b8
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
jmp 0x101a767

Function at 0x10249f3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 4
pop esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.SystemWPAPrintServer
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024a60
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.Disabled
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1024a57
cmp dword [ebp - 8], esi
jne 0x1024a57
cmp dword [ebp - 0xc], 1
jne 0x1024a57
inc edi
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1024a6b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x20019
push esi
push 0x1024b08
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1024ac4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1024ae8
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 4], esi
je 0x1024ad2
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, esi
je 0x1024ad9
mov dword [ebp - 8], esi
xor eax, eax
cmp dword [ebp - 8], 1
pop edi
setne al
pop esi
leave
ret

Function at 0x10272c2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x102730e
cmp word [eax], 0
je 0x102730e
push esi
push eax
call sym.spoolsv.exe_PrvAllocSplStr
mov esi, eax
test esi, esi
je 0x102730d
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10272a0
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1027307
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x102730d
push esi
call sym.spoolsv.exe_PrvDllFreeSplStr
pop esi
pop ebp
ret 4

Function at 0x102ab70
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0x102abd0
push dword [eax + 0xc]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x102abb8
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x102abb0
test byte [eax + 0x1c], 1
je 0x102abb0
push 0x102abc0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245a6
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop ebp
ret 4
Function at 0x1032745
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
jne 0x103275f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
pop ebx
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x1032820
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
call fcn.0101a9e7
add esp, 0x10
mov eax, dword [0x1049104]
mov esi, 0x1049104
mov edi, 0x10225f0
cmp eax, esi
je 0x10327b9
test byte [eax + 0x1c], bl
je 0x10327b9
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034bea
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1032815
mov eax, dword [0x1049104]
cmp eax, esi
je 0x1032810
test byte [eax + 0x1c], bl
je 0x10327f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1049104]
push edi
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov eax, dword [0x1049104]
cmp eax, esi
je 0x1032810
test byte [eax + 0x1c], bl
je 0x1032810
push edi
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245a6
xor eax, eax
xor edi, edi
stosb byte es:[edi], al
pop edi
pop esi
pop ebx
leave
ret 8