joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2429030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, dword [sym.imp.kernel32.dll_VirtualAlloc]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x40
push 0x2000
push edi
push 0
mov esi, ecx
call ebx
test eax, eax
mov dword [esi], eax
jne 0x242905b
mov ecx, 0x24daf6c
call fcn.0247f7e0
mov eax, dword [esi]
push 0x40
push 0x1000
push edi
push eax
call ebx
cmp dword [esi], eax
je 0x2429076
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
pop edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0xa
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x242d6c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
xor eax, eax
mov ecx, 0x24
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
pop edi
jne 0x242d6f3
add esp, 0x94
ret
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x242d716
cmp dword [esp + 4], 4
jne 0x242d70a
cmp dword [esp + 8], 0x5a
jb 0x242d731
mov eax, 0xe6
add esp, 0x94
ret
cmp eax, 2
jne 0x242d70a
mov eax, dword [esp + 4]
cmp eax, 4
je 0x242d731
cmp eax, 5
jne 0x242d70a
mov eax, dword [esp + 8]
test eax, eax
jne 0x242d70a
mov eax, 0xe7
add esp, 0x94
ret
Function at 0x242e5c6
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x24e2760
jmp 0x242e5b0
push 0xffffffffffffffff
push 0x24bfb68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], edi
call fcn.024870a0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x242ed81
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x30]
push edi
mov edi, dword [esi]
and edi, ecx
cmp edi, eax
jb 0x242ed9e
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0x1c]
lea ebx, [eax + edi*4]
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 8]
add edi, 8
cmp edi, eax
jbe 0x242edbb
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xc]
jbe 0x242edff
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x242eddb
mov edi, ecx
mov eax, dword [esi + 4]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 4], eax
je 0x242edfc
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xc], edi
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 4]
xor ecx, ecx
add edx, edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
add eax, 8
mov dword [esi + 0x10], eax
add eax, 0xfffffff8
shl ecx, 3
cmp eax, ecx
je 0x242ee2e
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov ecx, dword [esi + 0x18]
inc ecx
mov eax, ecx
lea edi, [eax - 1]
cmp edi, eax
mov dword [esi + 0x18], ecx
mov dword [esp + 0x14], edi
jb 0x242ee4c
mov ecx, 0x24dad88
call fcn.0247f7e0
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov edx, dword [esi + 4]
lea eax, [edx + edi*8]
je 0x242ee5f
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
mov edx, dword [ebx]
pop edi
mov dword [eax], edx
mov dword [ebx], eax
pop esi
add eax, 4
pop ebx
ret 8
Function at 0x242eea9
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x24bfbab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push 0x64
mov dword [esp + 0xc], esi
call fcn.024adc5e
mov ebp, eax
add esp, 4
mov dword [esp + 0xc], ebp
test ebp, ebp
mov dword [esp + 0x18], 0
je 0x242ef90
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push edi
push 0
push 0
push eax
push ebx
mov ecx, ebp
call fcn.0248b930
lea esi, [ebx*8]
sub esi, ebx
shl esi, 5
push 0x40
sub esi, ebx
push 0x2000
shl esi, 4
push esi
push 0
lea edi, [ebp + 0x4c]
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
mov dword [edi], eax
jne 0x242ef1b
mov ecx, 0x24daf6c
call fcn.0247f7e0
mov ecx, dword [edi]
push 0x40
push 0x1000
push esi
push ecx
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [edi], eax
je 0x242ef3a
mov ecx, 0x24daf0c
call fcn.0247f7e0
xor eax, eax
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0xa
mov dword [edi + 0x14], eax
push esi
mov ecx, edi
mov dword [ebp], 0x24c7a58
call fcn.02428f30
mov ecx, dword [edi + 0x14]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 5
sub edx, ecx
shl edx, 4
cmp eax, edx
je 0x242ef80
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov eax, dword [edi + 0x14]
mov esi, dword [esp + 0x10]
add eax, ebx
mov dword [edi + 0x14], eax
pop edi
pop ebx
jmp 0x242ef92
xor ebp, ebp
test ebp, ebp
mov dword [esi], ebp
je 0x242efa2
add ebp, 4
push ebp
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x242f1e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_VirtualAlloc]
push esi
push edi
push 0x40
push 0x2000
lea edi, [eax*8]
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
push 0
lea ebx, [ecx*8]
call ebp
test eax, eax
mov dword [esi], eax
jne 0x242f21e
mov ecx, 0x24daf6c
call fcn.0247f7e0
mov edx, dword [esi]
push 0x40
push 0x1000
push ebx
push edx
call ebp
cmp dword [esi], eax
je 0x242f239
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 4], edi
pop edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ecx
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x242f2a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.kernel32.dll_VirtualAlloc]
push esi
push edi
push 0x40
push 0x2000
lea edi, [eax*4]
push edi
push 0
mov esi, ecx
call ebx
test eax, eax
mov dword [esi], eax
jne 0x242f2d2
mov ecx, 0x24daf6c
call fcn.0247f7e0
mov ecx, dword [esi]
push 0x40
push 0x1000
push edi
push ecx
call ebx
cmp dword [esi], eax
je 0x242f2ed
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
pop edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0xa
mov dword [esi + 0x14], 0
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x242f310
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 0xc]
lea ebx, [ebp*4]
add edi, ebx
cmp edi, eax
jbe 0x242f337
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 8]
jbe 0x242f379
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x242f357
mov edi, ecx
mov eax, dword [esi]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi], eax
je 0x242f376
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 8], edi
mov edi, dword [esi + 0xc]
add edi, dword [esi]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
add edx, ebx
mov eax, edx
sub eax, ebx
shl ecx, 2
cmp eax, ecx
mov dword [esi + 0xc], edx
je 0x242f3b0
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edx, dword [esi + 0x14]
add edx, ebp
pop edi
mov dword [esi + 0x14], edx
mov eax, edx
pop esi
sub eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x242f490
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 0xc]
lea ebx, [ebp*8]
add edi, ebx
cmp edi, eax
jbe 0x242f4b7
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 8]
jbe 0x242f4f9
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x242f4d7
mov edi, ecx
mov eax, dword [esi]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi], eax
je 0x242f4f6
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 8], edi
mov edi, dword [esi + 0xc]
add edi, dword [esi]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
add edx, ebx
mov eax, edx
sub eax, ebx
shl ecx, 3
cmp eax, ecx
mov dword [esi + 0xc], edx
je 0x242f530
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edx, dword [esi + 0x14]
add edx, ebp
pop edi
mov dword [esi + 0x14], edx
mov eax, edx
pop esi
sub eax, ebp
pop ebp
mov dword [esp + 8], eax
pop ebx
ret 4
Function at 0x24303c0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
push esi
push edi
mov esi, ecx
jne 0x24303d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
cmp dword [esi], 0
je 0x24303ee
mov ecx, esi
call fcn.024304d0
test eax, eax
jne 0x24303ee
pop edi
pop esi
pop ebp
pop ebx
ret 4
lea eax, [esp + 0x14]
xor ebx, ebx
test eax, eax
je 0x243043d
test esi, esi
je 0x243043d
mov ecx, 0x24e2968
xor edi, edi
call fcn.024871d0
xor ecx, ecx
mov eax, 0x24e27d8
cmp dword [eax], 0
je 0x2430421
add eax, 4
inc ecx
cmp eax, 0x24e2968
jb 0x243040f
jmp 0x243042f
mov ebx, ecx
mov dword [ecx*4 + 0x24e27d8], esi
mov edi, 1
mov ecx, 0x24e2968
call fcn.02487290
test edi, edi
jne 0x2430446
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
cmp ebx, 0x64
jb 0x2430454
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
mov eax, dword [esi + 8]
test eax, eax
lea edi, [ebx*4]
je 0x2430476
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov ecx, dword [edi + 0x24db0d8]
push eax
push 0
push ecx
push 2
jmp 0x243048a
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov edx, dword [edi + 0x24db0d8]
push eax
push edx
push 0xd
call dword [sym.imp.user32.dll_SetWindowsHookExA]
test eax, eax
mov dword [esi], eax
jne 0x24304bd
mov ecx, 0x24e2968
call fcn.024871d0
mov ecx, 0x24e2968
mov dword [edi + 0x24e27d8], 0
call fcn.02487290
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
pop edi
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebp
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x2430540
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [ecx + 8]
test eax, eax
push ebx
mov dword [esp + 4], ecx
je 0x24305a0
mov edx, dword [ecx + 4]
test edx, edx
mov eax, dword [esp + 0x10c]
je 0x2430593
test eax, eax
jne 0x2430593
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
push eax
shr eax, 0x1f
push ecx
or eax, 0x100
push eax
push edx
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, 1
pop ebx
add esp, 0x104
ret 0xc
mov edx, dword [esp + 0x114]
push edx
jmp 0x24306bc
mov eax, dword [ecx + 4]
mov ebx, dword [esp + 0x114]
test eax, eax
mov eax, dword [esp + 0x10c]
je 0x24306bb
test eax, eax
jne 0x24306bb
test ebx, ebx
je 0x24306bb
push ebp
mov ebp, dword [ebx]
lea eax, [ebp - 0xa0]
cmp eax, 5
push esi
ja case.default.0x24305d8
jmp dword [eax*4 + 0x24306d8]
mov ebp, 0x10
jmp case.default.0x24305d8
mov ebp, 0x11
jmp case.default.0x24305d8
mov ebp, 0x12
mov esi, dword [ebx + 4]
mov eax, dword [ebx + 8]
and esi, 0xff
shl esi, 0x10
or esi, 1
test al, 1
je 0x243060e
or esi, 0x1000000
test al, 0x20
je 0x2430618
or esi, 0x20000000
and eax, 0x80
je 0x2430625
or esi, 0x40000000
test eax, eax
je 0x243062f
or esi, 0x80000000
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.user32.dll_GetKeyboardState]
test eax, eax
pop edi
je 0x2430687
test byte [ebx + 8], 0x80
je 0x2430668
mov edx, ebp
and edx, 0xff
mov cl, byte [esp + edx + 0x10]
lea eax, [esp + edx + 0x10]
and cl, 0x7f
jmp 0x243067a
mov eax, ebp
and eax, 0xff
mov cl, byte [esp + eax + 0x10]
lea eax, [esp + eax + 0x10]
or cl, 0x80
mov byte [eax], cl
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.user32.dll_SetKeyboardState]
mov edx, dword [ebx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
and edx, 0x80
push esi
or edx, 0x8000
push ebp
shr edx, 7
push edx
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret 0xc
push ebx
mov edx, dword [esp + 0x114]
push edx
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.user32.dll_CallNextHookEx]
pop ebx
add esp, 0x104
ret 0xc
Function at 0x2435ca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push ebp
push esi
push edi
mov edi, ecx
je 0x2435d12
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x2435d12
push 2
push edx
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x2435d12
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp eax, 0x28
jb 0x2435d12
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x2435d12
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov ecx, eax
test ecx, ecx
je 0x2435d12
cmp dword [ecx], 0x28
jb 0x2435d12
mov eax, dword [ecx + 4]
cdq
xor eax, edx
sub eax, edx
mov dword [ebx], eax
mov eax, dword [ecx + 8]
cdq
xor eax, edx
pop edi
sub eax, edx
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x243b990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x24c0258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0247c720
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x14], edi
call fcn.024870a0
mov dword [esi + 0x3c], edi
mov dword [esi], 0x24c7e50
mov dword [esi + 0x28], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x38], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x243f970
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x87c]
call fcn.0243c080
push 1
lea ecx, [esi + 0x188]
mov dword [esi + 0x878], 0
call fcn.024787d0
mov edi, dword [sym.imp.user32.dll_EnableWindow]
push eax
call edi
push 1
lea ecx, [esi + 0x490]
call fcn.024787d0
push eax
call edi
push 1
lea ecx, [esi + 0x248]
call fcn.024787d0
push eax
call edi
push 1
lea ecx, [esi + 0x54c]
call fcn.024787d0
push eax
call edi
push 0
lea ecx, [esi + 0xa8]
call fcn.024787d0
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov edi, dword [esi]
push 0
push 0
push 7
mov ecx, esi
call fcn.024787d0
push eax
mov ecx, esi
call dword [edi + 4]
pop edi
pop esi
ret
Function at 0x2443690
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
push ebx
mov ebx, dword [sym.imp.shell32.dll_SHGetFileInfo]
push esi
push edi
mov esi, ecx
push 0x4010
xor eax, eax
mov dword [esp + 0x10], 0
mov ecx, 0x57
lea edi, [esp + 0x14]
push 0x160
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push 0x10
push 0x24e25d0
call ebx
test eax, eax
mov dword [esi + 0x174], eax
jne 0x24436e2
pop edi
pop esi
pop ebx
add esp, 0x160
ret
push 0x4011
xor eax, eax
mov dword [esp + 0x10], 0
mov ecx, 0x57
lea edi, [esp + 0x14]
push 0x160
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0x10
push 0x24e25d0
call ebx
xor edx, edx
test eax, eax
setne dl
pop edi
mov dword [esi + 0x178], eax
pop esi
pop ebx
mov eax, edx
add esp, 0x160
ret
Function at 0x2457f90
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 8
call fcn.024adc5e
mov esi, eax
add esp, 4
test esi, esi
je 0x2457feb
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0x24e2998
mov dword [esi], eax
mov dword [esi + 4], ecx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x2457f60
push 0
push 0
call fcn.024adeaf
add esp, 0x18
test eax, eax
jne 0x2457fed
push 0x24e2998
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
push esi
call fcn.024adc89
add esp, 4
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x245eb60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebx
mov ebx, ecx
test ebx, ebx
push ebp
mov ebp, edx
je 0x245ec1e
test ebp, ebp
je 0x245ec1e
or ecx, 0xffffffff
push esi
push edi
xor eax, eax
mov edi, 0x24db5a4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x20]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dcce8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x20]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x80000001
mov dword [esp + 0x20], 4
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
pop edi
pop esi
jne 0x245ec1e
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push ebx
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x245ec26
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
xor eax, eax
pop ebx
add esp, 0x74
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [esp + 0x10], 3
jne 0x245ec1e
cmp dword [esp + 0xc], 4
jne 0x245ec1e
mov edx, dword [esp + 0x14]
mov dword [ebp], edx
pop ebp
mov eax, 1
pop ebx
add esp, 0x74
ret

Function at 0x245ec60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x6c
push ebx
mov ebx, ecx
test ebx, ebx
mov dword [esp + 8], edx
jne 0x245ec75
xor eax, eax
pop ebx
add esp, 0x6c
ret
or ecx, 0xffffffff
push ebp
push esi
push edi
xor eax, eax
mov edi, 0x24db5a4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x18]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dcce8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
or ecx, 0xffffffff
mov esi, edi
lea edx, [esp + 0x18]
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
pop edi
pop esi
pop ebp
je 0x245ecef
xor eax, eax
pop ebx
add esp, 0x6c
ret
mov eax, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 3
push 0
push ebx
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
je 0x245ed1c
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
pop ebx
add esp, 0x6c
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 1
pop ebx
add esp, 0x6c
ret
Function at 0x245ed40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x70
push ebx
push ebp
mov ebp, ecx
test ebp, ebp
mov ebx, edx
je 0x245ee02
test ebx, ebx
je 0x245ee02
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x245ee02
or ecx, 0xffffffff
push esi
push edi
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, 0x24db5a4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x1c]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dcce8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x1c]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
pop edi
pop esi
jne 0x245ee02
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
push 0
push ebp
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x245ee0c
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
xor eax, eax
pop ebx
add esp, 0x70
ret 4
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [esp + 0x10], 3
jne 0x245ee02
mov ecx, dword [esp + 0x7c]
cmp dword [esp + 0xc], ecx
jne 0x245ee02
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret 4

Function at 0x245ee40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x68
push ebx
push ebp
mov ebp, ecx
test ebp, ebp
mov ebx, edx
je 0x245eefa
test ebx, ebx
je 0x245eefa
mov eax, dword [esp + 0x74]
test eax, eax
je 0x245eefa
or ecx, 0xffffffff
push esi
push edi
xor eax, eax
mov edi, 0x24db5a4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x14]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dcce8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x14]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
pop edi
pop esi
jne 0x245eefa
mov edx, dword [esp + 0x74]
push edx
push ebx
push 3
push eax
mov eax, dword [esp + 0x18]
push ebp
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
je 0x245ef04
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 4
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
mov eax, 1
pop ebx
add esp, 0x68
ret 4