joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020410
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10120628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 0xa4]
push 0xffffffffffffffff
push 0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x40]
push eax
push 2
push 0
lea ecx, [esp + 0x1c]
mov dword [eax], esi
mov dword [esi + 0x44], 0x10001cf0
call fcn.1001cd30
push 0
lea edx, [esp + 8]
push 0
push edx
mov ecx, 0x1016f7b8
mov dword [esp + 0x54], 0
call fcn.1001e200
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x60], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x68], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x74], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x80], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x88], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x8c], edx
mov dword [esi + 0x90], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.1001cdb0
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret

Function at 0x10021330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101206c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esi + 0x44]
lea ecx, [esi + 0x3c]
push 0
push eax
mov dword [eax], ecx
push 2
push 1
lea ecx, [esp + 0x1c]
mov dword [esi + 0x48], 0x10001cf0
call fcn.1001cd30
push 0
lea edx, [esp + 8]
push 0
push edx
mov ecx, 0x1016f7b8
mov dword [esp + 0x54], 0
call fcn.1001e200
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x6c], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x74], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x78], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x7c], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x80], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x84], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x8c], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x90], edx
mov dword [esi + 0x94], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.1001cdb0
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x100236d0
Capabilities:
Start service

Disassembly:
push ebx
call fcn.10075aa0
test eax, eax
jne 0x100236dc
pop ebx
ret
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x100236f2
mov dword [0x1016fa80], 0x57
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
xor esi, esi
push 0xf003f
push esi
push esi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x10023731
push 0x10
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10023741
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
jmp 0x10023763
mov eax, dword [0x10171568]
test eax, eax
je 0x10023763
push str.CTSDEncryptDrv:_StartService_fail_to_OpenSCManager
jmp 0x1002374f
mov eax, dword [0x10171568]
test eax, eax
je 0x10023763
push str.CTSDEncryptDrv:_StartService_fail_to_OpenService
push str.TSDEncryptDrv
push 4
push 0x10170cd4
call fcn.10060b60
add esp, 0x10
test ebp, ebp
mov dword [0x1016fa80], 0
jne 0x100237a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10171568]
mov dword [0x1016fa80], eax
test ecx, ecx
je 0x100237a1
push eax
push eax
push str.CTSDEncryptDrv:_StartService_failed__error_ld_0x_08x__n
push str.TSDEncryptDrv
push 4
push 0x10170cd4
call fcn.10060b60
add esp, 0x18
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x100237ae
push esi
call ebx
test edi, edi
je 0x100237b5
push edi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x1002c0f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1002c13e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002c13e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x1002c143
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x1002c129
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x1002c153
test esi, esi
jne 0x1002c171
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1002c16f
mov byte [eax + esi - 1], 0
jne 0x1002c178
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x10031860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100318b0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x100318b0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x100318b5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1003189b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x100318c2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x1003c260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x1003c2a1
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003c2a3
mov esi, edi
test esi, esi
je 0x1003c318
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003c30d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1003c30d
cmp dword [esp + 0x1c], eax
jbe 0x1003c2de
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003c30d
cmp esi, edi
je 0x1003c2ff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x1003c318
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x1003c330
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x1003c395
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003c395
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x1003c395
cmp dword [esp + 0x18], eax
jbe 0x1003c37b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x1003c399
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x1003c470
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x1003c4cf
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003c4cf
cmp dword [esp + 0xc], 3
jne 0x1003c4cf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x1003c4cf
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003c4cf
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x1003c630
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1012127f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x10127994]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x1003c69b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003c69d
mov esi, edi
test esi, esi
je 0x1003c767
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003c75c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x1003c6df
cmp eax, 2
je 0x1003c6df
cmp eax, 6
je 0x1003c6df
cmp eax, 7
jne 0x1003c75c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.100629b7
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x1003c742
lea ecx, [esp + 0x14]
call fcn.1002dca0
cmp esi, dword [esp + 0x14]
je 0x1003c737
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10062976
add esp, 4
jmp 0x1003c779
call fcn.10062976
add esp, 4
lea ecx, [esp + 0x10]
push 0x1016f1ac
call fcn.1002dca0
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x1003c767
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1003c779
push eax
lea ecx, [esp + 0x14]
call fcn.1002dca0
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.1002d020
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.1002da20
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x1003cd10
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
call fcn.100333b0
test esi, esi
je 0x1003cdf2
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003cdf2
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x1003cd69
cmp eax, 2
je 0x1003cd69
cmp eax, 6
je 0x1003cd69
cmp eax, 7
jne 0x1003cdf2
mov edx, dword [esp + 0x14]
push edi
add edx, 2
push edx
call fcn.100629b7
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push ebx
push 0
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop edi
jne 0x1003cde9
cmp word [ebx], ax
mov esi, ebx
je 0x1003cdd4
mov ecx, dword [esp + 0x18]
push esi
mov edx, dword [ecx + 4]
push edx
call fcn.10033860
push esi
call fcn.10062cc2
lea esi, [esi + eax*2 + 2]
add esp, 4
cmp word [esi], 0
jne 0x1003cdb3
push ebx
call fcn.10062976
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebx
call fcn.10062976
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x1003d460
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x1003d499
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.10062cc2
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x1003d499
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x1003d4d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10121348
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x1003d526
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003d529
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003d61c
call fcn.10075aa0
test eax, eax
je 0x1003d579
mov edi, dword [ebp + 0x18]
push edi
call fcn.10062cc2
mov ecx, dword [ebp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1003d610
cmp esi, dword [ebp + 8]
je 0x1003d56f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1003d61e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1003d5b8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10063a20
mov edi, esp
test edi, edi
je 0x1003d5b8
mov edx, dword [ebp + 0x10]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x1003d5ba
xor edi, edi
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push eax
call fcn.10027f40
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1003d601
cmp esi, dword [ebp + 8]
je 0x1003d5eb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.100286a0
mov eax, 1
jmp 0x1003d61e
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.100286a0
cmp esi, dword [ebp + 8]
je 0x1003d61c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d730
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x1003d773
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
not eax
and eax, ecx
mov dword [esp + 8], eax
jmp 0x1003d77b
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
push ebp
push esi
test eax, eax
push edi
je 0x1003d88b
mov esi, dword [esp + 0x20]
xor edi, edi
mov ebp, 2
mov eax, dword [esi + 4]
test eax, eax
jle 0x1003d7bf
lea ecx, [esp + 0x1c]
push edi
push ecx
mov ecx, esi
call fcn.1003d8a0
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
mov eax, dword [edx - 8]
lea ebp, [ebp + eax*2 + 2]
call fcn.1002da20
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jl 0x1003d798
push ebp
call fcn.100629b7
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x1c], edx
je 0x1003d88b
mov ecx, ebp
push ebx
mov ebx, ecx
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
xor ebx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 4]
mov edi, edx
test eax, eax
jle 0x1003d831
lea ecx, [esp + 0x24]
push ebx
push ecx
mov ecx, esi
call fcn.1003d8a0
mov edx, dword [eax]
push edx
push edi
call fcn.10062d49
add esp, 8
lea ecx, [esp + 0x24]
call fcn.1002da20
push edi
call fcn.10062cc2
add esp, 4
lea edi, [edi + eax*2 + 2]
mov eax, dword [esi + 4]
inc ebx
cmp ebx, eax
jl 0x1003d7f6
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push ebp
push edx
push 7
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop ebx
jne 0x1003d86f
cmp esi, dword [esp + 0x10]
je 0x1003d859
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10062976
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.10062976
mov eax, dword [esp + 0x14]
add esp, 4
cmp esi, eax
je 0x1003d88b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x1003e310
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1003e48d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1003e46c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x1003e366
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.100629b7
mov esi, eax
add esp, 4
test esi, esi
je 0x1003e48d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1003e484
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003e484
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1003e484
push ebp
push edi
call fcn.1003e310
add esp, 8
test eax, eax
je 0x1003e479
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10170648]
test eax, eax
je 0x1003e415
test ebp, ebp
je 0x1003e415
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x1003e484
jmp 0x1003e421
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1003e484
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x1003e463
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1003e484
mov eax, dword [esp + 0x14]
jmp 0x1003e3be
push esi
call fcn.10062976
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x1003e484
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10062976
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x1003e4a0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
test esi, esi
je 0x1003e509
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003e4c9
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1003e509
pop edi
mov eax, 1
pop esi
ret 4
push edi
push esi
call fcn.1003e310
add esp, 8
test eax, eax
je 0x1003e509
mov eax, dword [0x10170648]
test eax, eax
je 0x1003e4f6
test edi, edi
je 0x1003e4f6
push 0
push edi
push 0
push esi
call eax
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x1003e680
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push ebx
test edx, edx
push esi
mov ebx, ecx
je 0x1003e6b6
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0xc]
or eax, 0x20019
push esi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003e6b8
mov esi, dword [ebx]
test esi, esi
je 0x1003e743
mov edx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x14]
xor edi, edi
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1003e6e8.2
mov eax, dword [esp + 0x18]
cmp eax, 4
ja case.0x1003e6e8.2
jmp dword [eax*4 + 0x1003e74c]
mov edi, 1
jmp case.0x1003e6e8.2
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 4
sete al
mov edi, eax
jmp case.0x1003e6e8.2
mov eax, dword [esp + 0x10]
cmp eax, 1
je case.0x1003e6e8.0
cmp eax, 2
je case.0x1003e6e8.0
cmp eax, 6
je case.0x1003e6e8.0
cmp eax, 7
je case.0x1003e6e8.0
xor edi, edi
jmp case.0x1003e6e8.2
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 3
sete cl
mov edi, ecx
cmp esi, dword [ebx]
je 0x1003e73b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x1003e930
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003e9c5
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x1003e97f
call fcn.10075b30
test eax, eax
je 0x1003e97f
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1003e96c
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1003e96c
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x1003e978
add edi, ebx
mov ebx, 0x10004
jmp 0x1003e981
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x1003eb80
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x1003e9c5
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x1003e9b4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret