joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x10003474
sub esp, 0x9e8
jmp 0x10003487
mov dword [ebp - 0x74], 0xd99a38f0
pushfd
add dword [ebp - 0x74], 0x2665c712
popfd
push dword [ebp + 8]
pop eax
push eax
jmp 0x100034a1
call fcn.1000da56
jmp 0x100034ad
add esp, 4
jmp 0x100034b7
mov dword [ebp - 4], eax
jmp 0x100034c1
mov dword [ebp - 0x78], 0x1aa939c9
pushfd
add dword [ebp - 0x78], 0xe556c637
popfd
jmp 0x100034f1
push dword [ebp - 0x78]
pop ecx
push edi
mov edi, ecx
add edi, 1
mov ecx, edi
pop edi
mov dword [ebp - 0x78], ecx
jmp 0x100034f1
cmp dword [ebp - 0x78], 0x64
jmp 0x100034fa
jae 0x1000351d
jmp 0x10003501
push dword [ebp - 0x78]
pop edx
mov byte [ebp + edx - 0x70], 0
jmp 0x10003513
jmp 0x100034d7
mov dword [ebp - 8], 0xad25574f
pushfd
add dword [ebp - 8], 0x52daa8b1
mov cl, 0xa8
ficom dword [edx - 0x63]

Function at 0x1000da74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000da7e
repz ret
jmp fcn.1000dcd1
Function at 0x10012ea8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000de49
and dword [ebp - 4], 0
cmp dword [0x10035788], 0
mov ebx, eax
jne 0x10012f59
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001300a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001300a
push eax
call fcn.1000ddd7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10035788], eax
call esi
push eax
call fcn.1000ddd7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003578c], eax
call esi
push eax
call fcn.1000ddd7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10035790], eax
call esi
push eax
call fcn.1000ddd7
pop ecx
mov dword [0x10035798], eax
test eax, eax
je 0x10012f59
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000ddd7
pop ecx
mov dword [0x10035794], eax
mov eax, dword [0x10035794]
cmp eax, ebx
je 0x10012fb1
cmp dword [0x10035798], ebx
je 0x10012fb1
push eax
call fcn.1000de52
push dword [0x10035798]
mov esi, eax
call fcn.1000de52
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10012fb1
test edi, edi
je 0x10012fb1
call esi
test eax, eax
je 0x10012fa8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10012fa8
test byte [ebp - 0xc], 1
jne 0x10012fb1
or dword [ebp + 0x10], 0x200000
jmp 0x10012fea
mov eax, dword [0x1003578c]
cmp eax, ebx
je 0x10012fea
push eax
call fcn.1000de52
pop ecx
test eax, eax
je 0x10012fea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10012fea
mov eax, dword [0x10035790]
cmp eax, ebx
je 0x10012fea
push eax
call fcn.1000de52
pop ecx
test eax, eax
je 0x10012fea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10035788]
call fcn.1000de52
pop ecx
test eax, eax
je 0x1001300a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001300c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4096b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x4093a0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00411e03
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x3cb8a1d1
jmp 0x409710
mov dword [ebp - 0x10], 0x9f0b1b50
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cmp eax, 0x6cb61b15
jg 0x409740
cmp eax, 0x97295e5f
jg 0x409750
cmp eax, 0x82655ecb
jne 0x409710
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0xde3117bf
jmp 0x409710
cmp eax, 0x6cb61b16
jne 0x409710
jmp 0x409704
cmp eax, 0x4d97875d
jg 0x4097ad
cmp eax, 0x3cb8a1d0
jg 0x4097d0
cmp eax, 0x2d7f7cd8
jg 0x4097f3
cmp eax, 0xde3117be
jg 0x40980a
cmp eax, 0x97295e60
je 0x409821
cmp eax, 0xc3b27f92
jne 0x40982d
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x10], 0x4d97875e
jmp 0x409710
cmp eax, 0x4d97875e
jne 0x409710
mov eax, 0x82655ecb
cmp dword [ebp - 0xc], 0
jne 0x4097c8
mov eax, 0xde3117bf
mov dword [ebp - 0x10], eax
jmp 0x409710
cmp eax, 0x3cb8a1d1
jne 0x409710
mov eax, 0x2d7f7cd9
cmp dword [ebp - 4], 0
je 0x4097eb
mov eax, 0xc3b27f92
mov dword [ebp - 0x10], eax
jmp 0x409710
cmp eax, 0x2d7f7cd9
jne 0x409710
mov dword [ebp - 0x10], 0x4d97875e
jmp 0x409710
cmp eax, 0xde3117bf
jne 0x409710
mov dword [ebp - 0x10], 0x6cb61b16
jmp 0x409710
mov dword [ebp - 0x10], 0x6cb61b16
jmp 0x409710
cmp eax, 0x9f0b1b50
jne 0x409710
add esp, 0x28
pop ebp
ret
Function at 0x40aad0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [0x40b7c0]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0x14051242
jmp 0x40ab10
mov dword [ebp - 0x1c], 0x7df11e08
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x1c]
cmp eax, 0xb0416b5b
jg 0x40ab30
cmp eax, 0x82dff0c3
jne 0x40ab10
jmp 0x40ab02
cmp eax, 0x7df11e07
jg 0x40ab60
cmp eax, 0xbd6d299f
jg 0x40ab6c
cmp eax, 0xb0416b5c
jne 0x40ab10
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0x7df11e08
jmp 0x40ab10
cmp eax, 0x7df11e08
jne 0x40ab10
jmp 0x40acf9
cmp eax, 0xfc338e09
jg 0x40ab83
cmp eax, 0xbd6d29a0
jne 0x40ab10
mov dword [ebp - 0x1c], 0x7df11e08
jmp 0x40ab10
cmp eax, 0x8f79996
jg 0x40aba8
cmp eax, 0xfc338e0a
jne 0x40ab10
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0x63940cf0
jmp 0x40ab10
cmp eax, 0x14051241
jg 0x40abc6
cmp eax, 0x8f79997
jne 0x40ab10
mov dword [ebp - 0x1c], 0x63940cf0
jmp 0x40ab10
cmp eax, 0x2cf0810a
jg 0x40abf0
cmp eax, 0x14051242
jne 0x40ab10
mov eax, 0x8f79997
cmp dword [ebp - 8], 0
je 0x40abe8
mov eax, 0x46bf80ca
mov dword [ebp - 0x1c], eax
jmp 0x40ab10
cmp eax, 0x46bf80c9
jg 0x40ac21
cmp eax, 0x2cf0810b
jne 0x40ab10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x41b11c], eax
call fcn.0041186f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x4f44487d
jmp 0x40ab10
cmp eax, 0x4f44487c
jg 0x40aca2
cmp eax, 0x46bf80ca
jne 0x40ab10
mov dword [esp], 0
call fcn.0040ad10
mov esi, eax
call fcn.004021a0
imul eax, esi
mov dword [esp], eax
call fcn.00411892
mov eax, dword [ebp - 0x10]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.004037f0
mov ecx, 1
sub ecx, eax
mov eax, dword [ebp - 0x10]
add ecx, ecx
neg ecx
movzx eax, word [eax + ecx]
add esi, 0x714aba0e
neg eax
sub esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [eax + esi - 0x714aba0e]
mov dword [ebp - 0x14], ecx
mov eax, 0x5d546234
cmp ecx, dword [ebp - 0x18]
je 0x40ac9a
mov eax, 0xb0416b5c
mov dword [ebp - 0x1c], eax
jmp 0x40ab10
cmp eax, 0x4f44487d
je 0x40acbc
cmp eax, 0x5d546234
jne 0x40acdb
mov dword [ebp - 0x1c], 0x4f44487d
jmp 0x40ab10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x41b11c], eax
call fcn.0041186f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xbd6d29a0
jmp 0x40ab10
cmp eax, 0x63940cf0
jne 0x40ab10
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0x82dff0c3
jmp 0x40ab10
mov eax, dword [ebp - 0xc]
add esp, 0x1c
pop esi
pop ebp
ret
Function at 0x4198ba
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00416713
mov dword [ebp - 0x14], eax
cmp dword [0x465fd4], edi
jne 0x4199ab
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x419938
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x419a8b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x419a8b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419a8b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x465fd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x465fd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x465fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465fe4], eax
test eax, eax
je 0x4199a8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465fe0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4199d0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4199c3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4199e5
push 4
pop eax
jmp 0x419a8d
cmp dword [ebp - 0x14], edi
je 0x4199e5
push dword [0x465fd4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4199ca
mov eax, dword [0x465fe0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x419a43
cmp dword [0x465fe4], esi
je 0x419a43
push eax
call ebx
push dword [0x465fe4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x419a43
test eax, eax
je 0x419a43
call ecx
test eax, eax
je 0x419a38
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x419a38
test byte [ebp - 8], 1
jne 0x419a43
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x419a73
mov eax, dword [0x465fd8]
cmp eax, esi
je 0x419a70
push eax
call ebx
test eax, eax
je 0x419a70
call eax
mov edi, eax
test edi, edi
je 0x419a70
mov eax, dword [0x465fdc]
cmp eax, esi
je 0x419a70
push eax
call ebx
test eax, eax
je 0x419a70
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x465fd4]
call ebx
test eax, eax
je 0x419a8b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x419a8d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413819
leave
ret
Function at 0x10025fb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080b34
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100ab008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x10], esi
push dword [eax]
call fcn.10007310
mov dword [ebp - 4], 0
add esi, 0x18
mov dword [ebp + 0xc], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 3
push 0x18
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.1007b70a
add esp, 4
mov dword [esi + 0x30], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082250
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100ab008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], edx
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x10030f3f
xor al, al
jmp 0x100310e0
push 0x21
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x2c]
push str.SystemCurrentControlSet_services
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.100057c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x44]
call fcn.1006c060
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x80000002
mov dword [ebp - 0x48], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x10030fb7
xor bl, bl
jmp 0x10031033
push 0x400
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0x400
call fcn.1007b76b
push dword [ebp - 0x4c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push 0
push str.ImagePath
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003101c
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10031001
mov ecx, dword [ebp - 0x50]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.100057c0
mov bl, 1
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x1003102a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1007bdfd
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x10031073
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10031069
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10031069
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007b73a
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100310ca
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100310c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100310c0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007b73a
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov al, bl
mov dword [ebp - 0x18], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007b6f9
mov esp, ebp
pop ebp
ret
Function at 0x10031100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082290
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100ab008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x1003113e
xor al, al
jmp 0x100312e8
push 0x21
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x30]
push str.SystemCurrentControlSet_services
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.100057c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x30]
push esi
lea ecx, [ebp - 0x48]
call fcn.1006c060
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push ecx
cmovae eax, dword [ebp - 0x48]
push eax
push 0x80000002
mov dword [ebp - 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x100311b6
xor bl, bl
jmp 0x1003123b
push 0x40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x4c], 0x40
call fcn.1007b76b
push dword [ebp - 0x4c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push str.Type
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10031224
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x10031224
mov dword [ebp - 0x14], 0
cmp eax, 4
jbe 0x1003120f
mov eax, dword [esi]
jmp 0x10031220
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [edi], eax
mov bl, 1
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x10031232
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1007bdfd
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x1003127b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10031271
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10031271
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007b73a
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x100312d2
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100312c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100312c8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007b73a
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov al, bl
mov dword [ebp - 0x1c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007b6f9
mov esp, ebp
pop ebp
ret
Function at 0x10031310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082290
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100ab008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x1003134e
xor al, al
jmp 0x100314f8
push 0x21
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x30]
push str.SystemCurrentControlSet_services
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.100057c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x30]
push esi
lea ecx, [ebp - 0x48]
call fcn.1006c060
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push ecx
cmovae eax, dword [ebp - 0x48]
push eax
push 0x80000002
mov dword [ebp - 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x100313c6
xor bl, bl
jmp 0x1003144b
push 0x40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x4c], 0x40
call fcn.1007b76b
push dword [ebp - 0x4c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push str.Start
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10031434
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x10031434
mov dword [ebp - 0x14], 0
cmp eax, 4
jbe 0x1003141f
mov eax, dword [esi]
jmp 0x10031430
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [edi], eax
mov bl, 1
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x10031442
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1007bdfd
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x1003148b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10031481
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10031481
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007b73a
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x100314e2
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100314d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100314d8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007b73a
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov al, bl
mov dword [ebp - 0x1c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007b6f9
mov esp, ebp
pop ebp
ret