joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f16f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x81c
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x81c], eax
push 0x24
mov eax, 0x1017cbeb
call fcn.1008546d
mov eax, dword [ebp + 0x828]
mov edi, dword [ebp + 0x830]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x82c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x834]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x838]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x83c]
xor esi, esi
push eax
lea ecx, [ebp]
mov dword [ebp - 0x24], esi
call fcn.100015f0
lea eax, [ebp - 0x14]
push eax
mov ebx, 0x20119
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
je 0x1001f20e
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.100035e0
jmp 0x1001f2de
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push str.SoftWare
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x1001f22d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001f1fd
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x1001f251
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x14]
call edi
jmp 0x1001f1fd
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x1001f273
push dword [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x18]
jmp 0x1001f248
push 0x7fe
lea eax, [ebp + 0x1e]
push esi
push eax
mov word [ebp + 0x1c], si
call fcn.10085bc0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1c]
push eax
push esi
push esi
push dword [ebp - 0x30]
mov dword [ebp - 0x24], 0x400
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp + 0x1c]
push eax
call fcn.10085b54
test eax, eax
pop ecx
mov ecx, dword [ebp - 0x10]
je 0x1001f200
lea eax, [ebp + 0x1c]
push eax
call fcn.100015f0
push esi
push 1
lea ecx, [ebp]
call fcn.100017c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x81c]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x820
leave
ret
Function at 0x1001f30f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x81c
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x81c], eax
push 0x20
mov eax, 0x1017cc1b
call fcn.1008546d
mov eax, dword [ebp + 0x828]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x82c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x830]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x834]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x838]
xor esi, esi
push eax
lea ecx, [ebp]
mov dword [ebp - 0x20], esi
call fcn.100015f0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
mov ebx, 0x20119
push ebx
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
je 0x1001f3a9
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.100035e0
jmp 0x1001f450
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x1001f3c6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001f398
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x1001f3ea
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x18]
call edi
jmp 0x1001f398
push 0x7fe
lea eax, [ebp + 0x1e]
push esi
push eax
mov word [ebp + 0x1c], si
call fcn.10085bc0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
push esi
push esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x20], 0x400
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp + 0x1c]
push eax
call fcn.10085b54
test eax, eax
pop ecx
mov ecx, dword [ebp - 0x10]
je 0x1001f39b
lea eax, [ebp + 0x1c]
push eax
call fcn.100015f0
push esi
push 1
lea ecx, [ebp]
call fcn.100017c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x81c]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x820
leave
ret
Function at 0x1001fb8d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xf60]
sub esp, 0xfe0
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0xf5c], eax
push esi
mov esi, dword [ebp + 0xf68]
push edi
push 0x7d0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x1018ae1c
call fcn.10085b54
pop ecx
lea eax, [ebp + eax*2 - 0x44]
push eax
call fcn.100860cd
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.100860a3
push 0x3c
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.10085bc0
add esp, 0x1c
xor ecx, ecx
inc ecx
push ecx
push edi
push edi
mov eax, str.open
push esi
push eax
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], 0x200
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x1001fc2c
push edi
push edi
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.1001e2e0
add esp, 0x10
mov ecx, dword [ebp + 0xf5c]
pop edi
xor ecx, ebp
pop esi
call fcn.1008545e
add ebp, 0xf60
leave
ret

Function at 0x1001fc43
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
push esi
mov esi, dword [ebp + 0x1d0]
push esi
call fcn.10085b54
test eax, eax
pop ecx
je 0x1001fce7
push edi
push 0x104
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x38]
push str.Program_FilesInternet_Exploreriexplore.exe
push eax
call fcn.100860cd
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.100860a3
push 0x3c
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.10085bc0
add esp, 0x1c
push 1
push edi
push edi
mov eax, str.open
push esi
push eax
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], 0x200
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x1001fce3
push edi
push edi
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.1001e2e0
add esp, 0x10
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0x1c4]
xor ecx, ebp
pop esi
call fcn.1008545e
add ebp, 0x1c8
leave
ret

Function at 0x1001fcfd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.10085b54
test eax, eax
pop ecx
je 0x1001fd61
push esi
push 0x3c
xor esi, esi
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.10085bc0
add esp, 0xc
push 1
push esi
push esi
mov eax, str.open
push edi
push eax
push esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x1001fd5d
push esi
push esi
push esi
push edi
call fcn.1001e2e0
add esp, 0x10
jmp 0x1001fd60
xor eax, eax
inc eax
pop esi
pop edi
leave
ret
Function at 0x1001ffe7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1380]
mov eax, 0x1400
call fcn.100860f0
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x137c], eax
push ebx
mov ebx, dword [ebp + 0x138c]
push esi
mov esi, dword [ebp + 0x1388]
push esi
lea eax, [ebp + 0x1d4]
push 0x1018a8f0
push eax
call fcn.10004df5
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x80], eax
je 0x100200e2
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100200e2
cmp word [ebp - 0x50], 0x2e
je 0x10020046
cmp word [ebp - 0x4e], 0
je 0x10020046
cmp word [ebp - 0x4e], 0x2e
jne 0x10020077
cmp word [ebp - 0x4c], 0
je 0x10020046
and word [ebp + 0x1174], 0
push 0x206
lea eax, [ebp + 0x1176]
push 0
push eax
call fcn.10085bc0
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp + 0x9a4]
push 0x1018725c
push eax
call fcn.10004df5
lea eax, [ebp + 0x1174]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.1001ca2e
lea eax, [ebp + 0x1174]
push ebx
push eax
call fcn.100862d7
add esp, 0x2c
test eax, eax
jne 0x10020046
lea eax, [ebp + 0x9a4]
push eax
call fcn.1001fd64
pop ecx
jmp 0x10020046
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x137c]
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x1380
leave
ret
Function at 0x100211e8
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x63c
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x63c], eax
push 0x40
mov eax, 0x1017cf43
call fcn.1008546d
mov ebx, dword [ebp + 0x648]
xor esi, esi
push 0x228
lea eax, [ebp + 4]
push esi
push eax
mov dword [ebp], esi
call fcn.10085bc0
mov edi, 0x206
push edi
lea eax, [ebp + 0x436]
push esi
push eax
mov word [ebp + 0x434], si
call fcn.10085bc0
add esp, 0x18
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x10021257
xor eax, eax
jmp 0x100212b5
lea ecx, [ebp]
push ecx
push eax
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100212a5
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x434]
push eax
call fcn.100860cd
lea eax, [ebp + 0x434]
push eax
call fcn.100891f4
lea eax, [ebp + 0x434]
push eax
call fcn.1001fa10
add esp, 0x10
test al, al
jne 0x100212d8
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1002126a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x63c]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x640
leave
ret
push edi
lea eax, [ebp + 0x22e]
push esi
push eax
mov word [ebp + 0x22c], si
call fcn.10085bc0
add esp, 0xc
push dword [ebp + 8]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp + 0x22c]
push ecx
push esi
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
sub esp, 0x1c
lea eax, [ebp + 0x22c]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.100015f0
sub esp, 0x1c
lea eax, [ebp + 0x434]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 4], esi
call fcn.100015f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.1001e204
xor esi, esi
inc esi
push eax
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.10021193
lea ecx, [ebp - 0x4c]
call fcn.100592d3
mov eax, esi
jmp 0x100212b5
Function at 0x10021e4c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea ebx, [ecx + 0x210]
push edi
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x10]
call fcn.10051a72
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebx + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
call fcn.10051a72
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.10054d99
test al, al
jne 0x10021f44
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x10188544
mov eax, dword [ebp + 8]
add eax, 0xa8
push eax
call esi
push edi
call esi
lea ecx, [ebp - 8]
call fcn.10005225
add eax, 0xa8
push eax
call esi
push edi
call esi
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
call esi
push edi
call esi
lea ecx, [ebp - 8]
call fcn.10005225
add eax, 0x28
push eax
call esi
push edi
call esi
lea ecx, [ebp - 8]
call fcn.10005225
add eax, 0xa8
push eax
mov eax, dword [ebp + 8]
add eax, 0xa8
push eax
call fcn.1008b7d0
test eax, eax
pop ecx
pop ecx
jne 0x10021f1c
lea ecx, [ebp - 8]
call fcn.10005225
add eax, 0x28
push eax
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
call fcn.1008b7d0
test eax, eax
pop ecx
pop ecx
je 0x10021f64
lea ecx, [ebp - 8]
call fcn.10021761
push ebx
push dword [ebx + 8]
lea ecx, [ebp - 0x10]
call fcn.10051a72
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.10054d99
test al, al
je 0x10021e9e
mov esi, dword [ebp + 8]
lea eax, [esi + 0xa8]
push eax
call fcn.10084e70
test eax, eax
pop ecx
je 0x10021f64
push esi
mov ecx, ebx
call fcn.10021df7
mov al, 1
jmp 0x10021f66
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100224eb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x98], eax
and dword [ebp - 0x80], 0
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x210]
mov ecx, ebx
call fcn.10021b06
mov esi, 0x114
push esi
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.10085bc0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x6c], 2
jne 0x1002254c
mov ecx, edi
call fcn.10021f6d
jmp 0x10022564
xor esi, esi
cmp dword [ebp - 0x80], 0
jne 0x10022564
mov ecx, edi
call fcn.100223a7
inc esi
cmp esi, 0xa
mov dword [ebp - 0x80], eax
jl 0x1002254e
mov ecx, ebx
call fcn.10021731
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x9c
leave
ret

Function at 0x10022f83
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0xa4
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push 0x2c
mov eax, 0x1017cff3
call fcn.1008546d
mov eax, dword [ebp + 0xb0]
mov edi, dword [ebp + 0xb4]
mov esi, 0x101ebf0c
xor ebx, ebx
push esi
lea ecx, [ebp + 0x88]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
call fcn.100015f0
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.1002262c
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100230b9
push ebx
push 1
push 4
push ebx
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x10023010
mov ecx, dword [ebp - 0x10]
push esi
call fcn.100015f0
jmp 0x100230c8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
inc eax
push eax
call fcn.100621c1
mov edi, eax
cmp edi, ebx
pop ecx
je 0x10023002
mov eax, dword [ebp - 0x18]
inc eax
push eax
push ebx
push edi
call fcn.10085bc0
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
lea ecx, [ebp]
push edi
call fcn.10022e6b
push edi
call fcn.100621bc
pop ecx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp]
call fcn.10022f5e
push eax
lea eax, [ebp + 0x6c]
push eax
mov byte [ebp - 4], 1
call fcn.1001e780
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.10001770
cmp dword [ebp + 0x80], ebx
jbe 0x100230ab
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x6c]
push eax
lea ecx, [ebp + 0x88]
call fcn.10001d30
push ebx
push 1
lea ecx, [ebp + 0x6c]
mov byte [ebp - 4], bl
call fcn.100017c0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x88]
push eax
call fcn.100035e0
push ebx
push 1
lea ecx, [ebp + 0x88]
call fcn.100017c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
call fcn.1008545e
add ebp, 0xa8
leave
ret
Function at 0x10023116
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [esi + 4], ecx
pop esi
ret 4

Function at 0x10023140
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x1017d023
call fcn.1008546d
lea ecx, [ebp - 0x48]
call fcn.1003cec0
xor esi, esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.1003ce97
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
je 0x100231de
lea eax, [ebp - 0x18]
push eax
push 0xf013f
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, esi
jne 0x10023244
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push esi
push str.SmartCloudWBInput
push dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
call edi
cmp eax, esi
je 0x100231b2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10023244
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x104
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x18]
jmp 0x10023242
lea eax, [ebp - 0x10]
push eax
mov ebx, 0xf003f
push ebx
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], esi
call edi
cmp eax, esi
jne 0x10023244
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push str.SmartCloudWBInput
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
call edi
cmp eax, esi
je 0x10023218
push dword [ebp - 0x10]
jmp 0x100231a7
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x24], 0x104
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1003cdba
call fcn.10085545
ret 8
Function at 0x10023258
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x1017d046
call fcn.1008546d
lea ecx, [ebp - 0x40]
call fcn.1003cec0
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.1003ce97
test eax, eax
je 0x100232f1
lea eax, [ebp - 0x10]
push eax
mov edi, 0xf013f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10023358
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloudWBInput
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x100232ca
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10023358
push 0x104
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
jmp 0x10023356
lea eax, [ebp - 0x14]
push eax
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10023358
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloudWBInput
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x10023331
push dword [ebp - 0x14]
jmp 0x100232bf
push 0x104
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1003cdba
call fcn.10085545
ret 8

Function at 0x1002336c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x64
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x100233a7
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
movzx eax, si
movzx ecx, di
shl eax, 0x10
or eax, ecx
jmp 0x1002340e
push ebx
push 2
push edi
push 0x1018b558
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
je 0x1002340a
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x10023403
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x10023403
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x10023403
push 0x1018b538
lea eax, [esi + 6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10023403
cmp word [esi + 2], di
jbe 0x10023403
mov eax, dword [esi + 0x30]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10023412
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
mov eax, dword [ebp + 0x3b8]
push ebx
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x68]
push eax
xor ebx, ebx
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023464
xor eax, eax
jmp 0x1002353b
push esi
push edi
mov edi, 0x206
push edi
lea eax, [ebp + 0x1a6]
push ebx
push eax
mov word [ebp + 0x1a4], bx
call fcn.10085bc0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x1a4]
push eax
mov dword [ebp - 0x6c], ebx
push ebx
jmp 0x1002351c
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1a4]
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1002350e
push edi
lea eax, [ebp - 0x62]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov word [ebp - 0x64], bx
call fcn.10085bc0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.DisplayName
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10023505
push dword [ebp - 0x80]
lea eax, [ebp - 0x64]
push eax
call fcn.100885cc
test eax, eax
pop ecx
pop ecx
je 0x10023505
mov dword [ebp - 0x74], 1
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x6c]
push esi
lea eax, [ebp + 0x1a4]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10023499
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
mov ecx, dword [ebp + 0x3ac]
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x3b0
leave
ret 4