joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
mov esi, ecx
xor edx, eax
mov dword [esp + 0x14], esi
imul ecx, edx, 0x1000193
mov eax, ebx
sar eax, 0x10
movzx eax, al
sar ebx, 0x18
push edi
xor ecx, eax
movzx eax, bl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [ebp + 8]
call fcn.100b3790
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x10]
mov dword [esp + 0x18], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.1002fd70
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1003059a
lea eax, [ebp + 0xc]
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], eax
xor edi, edi
lea eax, [ebp + 8]
xor esi, esi
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x10], eax
test bl, 0x10
je 0x10030541
push dword [0x1014b4c8]
lea ecx, [esp + 0x20]
call fcn.100305b0
mov edi, eax
xor eax, eax
test bl, 0x20
je 0x10030559
push dword [0x1014b4c4]
lea ecx, [esp + 0x20]
call fcn.100305b0
mov dword [esp + 0x10], eax
test bl, 0x40
je 0x1003056f
push 0x40
lea ecx, [esp + 0x20]
call fcn.100305b0
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x20]
xor edx, edx
push 0
push ecx
push dword [ebp + 0x1c]
test cl, cl
mov ecx, dword [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push esi
push eax
mov eax, dword [ebp + 8]
push edi
cmovne eax, edx
push eax
push dword [esp + 0x3c]
call fcn.1002fe90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10034820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f8f40
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1013c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.10034360
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x1003488a
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [edi], eax
test eax, eax
jne 0x10034877
mov esi, 0x80004005
jmp 0x10034898
push dword [ebp - 0x10]
mov edx, esi
mov ecx, eax
call fcn.100a4780
add esp, 4
xor esi, esi
jmp 0x10034898
push edi
push 0
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 4], 2
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100348ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003bea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.100d5ce0
mov eax, dword [0x1013c014]
xor eax, esp
mov dword [esp + 0x100c], eax
cmp dword [0x10158ce8], 0
je 0x1003bf82
lea ecx, [esp]
call fcn.1003bfa0
push 0
push 0xf4240
mov ecx, dword [eax]
sub ecx, dword [0x1014c058]
mov eax, dword [eax + 4]
sbb eax, dword [0x1014c05c]
push eax
push ecx
call fcn.100f5860
push edx
push eax
push str._8d:
lea eax, [esp + 0x14]
push 0x800
push eax
call fcn.100a4830
add esp, 0x14
push dword [0x10158ce8]
push eax
lea eax, [esp + 0x10]
push 2
push eax
call fcn.100de84d
add esp, 0x10
lea eax, [ebp + 0xc]
mov edx, 0x800
push eax
push ecx
push dword [ebp + 8]
lea ecx, [esp + 0x14]
push 0x7ff
call fcn.100a4a90
push dword [0x10158ce8]
test eax, eax
mov ecx, 0x7ff
cmovs eax, ecx
xor ecx, ecx
push eax
push 2
mov word [esp + eax*2 + 0x24], cx
lea eax, [esp + 0x24]
push eax
call fcn.100de84d
push dword [0x10158ce8]
push 2
push 2
push 0x1010ff30
call fcn.100de84d
push dword [0x10158ce8]
call fcn.100dee72
add esp, 0x34
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
Function at 0x1003e390
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [0x1014b4d4], 3
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x1003e3c1
test bl, 0x10
jne 0x1003e3c1
test edi, edi
je 0x1003e3c1
cmp byte [edi + 0x30], 0
jne 0x1003e3c1
push 0
push 0
mov ecx, edi
call fcn.100603b0
mov esi, dword [0x1014c068]
mov eax, 0
sub esi, dword [0x1014c064]
sar esi, 2
test bl, 2
setne al
inc eax
sub esi, eax
js 0x1003e453
mov eax, dword [0x1014c064]
mov eax, dword [eax + esi*4]
cmp eax, edi
je 0x1003e453
cmp byte [eax + 0x31], 0
jne 0x1003e44e
test bl, 4
je 0x1003e400
test dword [eax + 0x3c], 0x400000
jne 0x1003e44e
test bl, 8
je 0x1003e40e
test dword [eax + 0x3c], 0x400000
je 0x1003e44e
mov eax, dword [eax + 0xc]
test bl, 1
je 0x1003e447
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x1014c064]
push 0
push 0
push 0x10
mov eax, dword [eax + esi*4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x1014c064]
mov eax, dword [eax + esi*4]
mov byte [eax + 0x196], 1
jmp 0x1003e44e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
sub esi, 1
jns 0x1003e3e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f97f0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1013c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x20019
push str.SOFTWAREMicrosoftWindowsUpdateOrchestrator
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.10013210
mov edi, dword [ebp - 0x2c]
test eax, eax
jne 0x1003f51f
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.EnhancedShutdownEnabled
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003f51f
cmp dword [ebp - 0x14], 4
jne 0x1003f51f
test edi, edi
je 0x1003f3fe
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 0x1011151c
push 4
push 0
push 0x10111550
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1003f4f8
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x1003f4e7
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
push edx
push 0x101114ec
push eax
mov ecx, dword [eax]
call dword [ecx]
mov byte [ebp - 4], 2
test eax, eax
js 0x1003f48a
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x84]
test eax, eax
js 0x1003f4d6
mov esi, dword [ebp - 0x14]
jmp 0x1003f4d6
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push edx
push 0x101114dc
push eax
mov ecx, dword [eax]
call dword [ecx]
mov byte [ebp - 4], 4
test eax, eax
js 0x1003f4c5
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x88]
test eax, eax
cmovns esi, dword [ebp - 0x20]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1003f4d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1003f4e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003f4f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1003f52a
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1003f52a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10046870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10158f98
mov dword [ebp - 0x68], 0x770025
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x6e0069
push edi
mov dword [ebp - 0x60], 0x690064
mov edx, 0x32
mov dword [ebp - 0x5c], 0x250072
sub esi, eax
mov dword [ebp - 0x58], 0x49005c
mov dword [ebp - 0x54], 0x6d006d
mov dword [ebp - 0x50], 0x720065
mov dword [ebp - 0x4c], 0x690073
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x6f0043
mov dword [ebp - 0x40], 0x74006e
mov dword [ebp - 0x3c], 0x6f0072
mov dword [ebp - 0x38], 0x50006c
mov dword [ebp - 0x34], 0x6e0061
mov dword [ebp - 0x30], 0x6c0065
mov dword [ebp - 0x2c], 0x73005c
mov dword [ebp - 0x28], 0x730079
mov dword [ebp - 0x24], 0x650074
mov dword [ebp - 0x20], 0x73006d
mov dword [ebp - 0x1c], 0x740065
mov dword [ebp - 0x18], 0x690074
mov dword [ebp - 0x14], 0x67006e
mov dword [ebp - 0x10], 0x2e0073
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffcc]
test ecx, ecx
je 0x1004695f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004695f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10046941
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
Function at 0x100491a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x1004921d
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x100491d7
push edi
mov ecx, esi
call fcn.10021230
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x100491fe
mov ecx, dword [esi]
test ecx, ecx
je 0x10049202
push dword [ecx - 8]
push ecx
call fcn.100de0b5
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x1004921d
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x1004921d
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.10013970
int3
Function at 0x1005a500
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa7fb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x194], 0
jne 0x1005a726
push 0x100
lea eax, [ebp - 0x214]
mov byte [edi + 0x194], 1
push eax
push dword [edi + 0x1a4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x100
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea esi, [ebp - 0x214]
movzx eax, word [esi]
cmp eax, 0x20
je 0x1005a581
cmp eax, 9
jne 0x1005a586
add esi, 2
jmp 0x1005a574
xor ebx, ebx
test ax, ax
je 0x1005a703
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005a596
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x1005a5c5
lea eax, [ecx - 1]
lea eax, [esi + eax*2]
nop
movzx edx, word [eax]
cmp edx, 0x20
je 0x1005a5bd
cmp edx, 9
jne 0x1005a5c5
dec ecx
sub eax, 2
test ecx, ecx
jg 0x1005a5b0
xor eax, eax
push esi
mov word [esi + ecx*2], ax
call dword [sym.imp.USER32.dll_CharUpperW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005a5d7
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, 0x1014c074
call fcn.10021eb0
push 0x1014c074
call fcn.1007b580
mov byte [0x1014c070], 1
mov byte [0x1014b4fe], bl
cmp byte [0x1014b4d1], bl
je 0x1005a680
cmp byte [0x1014b4fb], bl
je 0x1005a680
mov eax, dword [edi + 0x198]
mov edx, str.Searching...
sub eax, dword [edi + 0x1a0]
mov ecx, str.Menu.Searching
inc eax
imul esi, eax, 0x54
add esi, dword [edi + 0xa0]
mov dword [esi], 0x32
call fcn.100a4f10
mov edx, eax
lea eax, [esi + 8]
test edx, edx
jne 0x1005a651
xor ecx, ecx
jmp 0x1005a668
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005a656
sub ecx, ebx
lea eax, [esi + 8]
sar ecx, 1
push ecx
push edx
mov ecx, eax
call fcn.10021eb0
push 0
push str.imageres.dll_8
call fcn.1002bc70
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x4c]
cmp eax, dword [edi + 0x198]
je 0x1005a6e3
cmp dword [0x1014b4d4], 2
je 0x1005a6e3
lea ecx, [ebp - 0x22c]
call fcn.10023510
mov eax, ecx
mov dword [ebp - 4], 0
push eax
push 0
push 3
push dword [edi + 0x198]
mov ecx, edi
mov byte [ebp - 0x22c], 1
call fcn.10040810
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x1005a6d9
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov dword [ebp - 0x220], 0
mov eax, dword [0x1014b61c]
test eax, eax
je 0x1005a6fc
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, 2
jmp 0x1005a717
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [edi + 0x1a4]
mov ecx, 1
cmove ebx, ecx
push ebx
mov ecx, edi
call fcn.1005a3d0
mov byte [edi + 0x194], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret 4
Function at 0x1005ebb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100faa31
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
test dword [ebx + 0x3c], 0x400
je 0x1005edb3
cmp dword [ebx + 0x60], 0
je 0x1005edb3
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
push 0x2001f
push str.Software360WallPaperOpenShellStartMenuOrder
push SysReAllocString
lea ecx, [ebp - 0xfc]
mov dword [ebp - 4], 0
call fcn.10013210
test eax, eax
je 0x1005ec5a
sub esp, 8
lea ecx, [ebp - 0xfc]
push 0x2001f
sub esp, 8
push str.Software360WallPaperOpenShellStartMenuOrder
push SysReAllocString
call fcn.100380f0
push fcn.10010820
push fcn.10010800
push 2
push 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.100d4cab
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x1005ecf6
lea edi, [esi + 4]
cmp dword [ebx + 0x64], 0
je 0x1005ecbb
cmp byte [edi + 6], 2
jne 0x1005ecbb
mov ecx, dword [ebp - 0xe0]
cmp dword [ebp - 0xdc], ecx
je 0x1005ecac
mov eax, dword [edi]
mov dword [ecx], eax
add dword [ebp - 0xe0], 4
jmp 0x1005ece8
push edi
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xe4]
jmp 0x1005ece3
mov ecx, dword [ebp - 0xec]
cmp dword [ebp - 0xe8], ecx
je 0x1005ecd6
mov eax, dword [edi]
mov dword [ecx], eax
add dword [ebp - 0xec], 4
jmp 0x1005ece8
push edi
push dword [ebp - 0xec]
lea ecx, [ebp - 0xf0]
call fcn.10012820
mov eax, dword [ebp + 8]
add esi, 0xc
add edi, 0xc
cmp esi, dword [eax + 4]
jne 0x1005ec85
push dword [ebx + 0x60]
lea eax, [ebp - 0xd8]
push str._08X
push 0x64
push eax
call fcn.100a4830
mov ecx, dword [ebp - 0xf0]
add esp, 0x10
mov eax, dword [ebp - 0xec]
mov esi, dword [ebp - 0xfc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp ecx, eax
jne 0x1005ed31
push 0
push 0
jmp 0x1005ed38
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push 3
push 0
lea eax, [ebp - 0xd8]
push eax
push esi
call edi
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x1005ed8f
push eax
push str._08X
lea eax, [ebp - 0xd8]
push 0x64
push eax
call fcn.100a4830
mov ecx, dword [ebp - 0xe4]
add esp, 0x10
mov eax, dword [ebp - 0xe0]
cmp ecx, eax
jne 0x1005ed7a
push 0
push 0
jmp 0x1005ed81
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push 3
push 0
lea eax, [ebp - 0xd8]
push eax
push esi
call edi
push fcn.10010820
push 2
push 0xc
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0
push eax
call fcn.100d4d1f
test esi, esi
je 0x1005edb3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret 4
Function at 0x1005f7d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2001f
push str.Software360WallPaperOpenShellStartMenuMRU
push SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.10013210
test eax, eax
je 0x1005f830
sub esp, 8
lea ecx, [ebp - 0x10]
push 0x2001f
sub esp, 8
push str.Software360WallPaperOpenShellStartMenuMRU
push SysReAllocString
call fcn.100380f0
push ebx
push esi
push edi
mov edi, dword [ebp - 0x10]
xor bl, bl
xor esi, esi
nop word [eax + eax]
push esi
push 0x10112fec
lea eax, [ebp - 0x18]
push 0xa
push eax
call fcn.100a4830
mov edx, dword [esi*4 + 0x1014c0c8]
add esp, 0x10
movzx ebx, bl
mov eax, 1
cmp dword [edx - 0xc], 0
cmove ebx, eax
test bl, bl
je 0x1005f8f8
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x200
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005f93c
mov eax, dword [ebp - 0x220]
cmp eax, 1
je 0x1005f8ba
cmp eax, 2
jne 0x1005f93c
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x1005f8e2
test al, 1
jne 0x1005f93c
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
jne 0x1005f93c
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1005f932
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1005f932
test edx, edx
je 0x1005f932
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x21c], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005f907
sub eax, dword [ebp - 0x21c]
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc esi
cmp esi, 0x28
jl 0x1005f840
test edi, edi
je 0x1005f947
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret
Function at 0x1005f960
Capabilities:
Delete registry value
Encode data using xor
Hash data using fnv
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, byte [ebp + 0xc]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount
push ebx
test cl, cl
mov dword [ebp - 0x21c], 0
push 0x2001f
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount
mov dword [ebp - 0x218], 0
cmove eax, edx
mov dword [ebp - 0x214], 0
push eax
push SysReAllocString
lea ecx, [ebp - 0x21c]
call fcn.10013210
mov ebx, dword [ebp - 0x21c]
test eax, eax
jne 0x1005fa8c
push edi
xor edi, edi
mov dword [ebp - 0x210], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x1005fa8b
push esi
nop dword [eax + eax]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005fa10
sub eax, edx
xor ecx, ecx
sar eax, 1
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
jle 0x1005fa45
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x20c]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jl 0x1005fa30
cmp edx, dword [ebp + 8]
je 0x1005fa7c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
inc edi
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x1005fa00
jmp 0x1005fa8a
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop esi
pop edi
test ebx, ebx
je 0x1005fa97
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret 8
Function at 0x10068440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100684b1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1006847f
cmp eax, 2
jne 0x1006849b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x100684ab
test ecx, ecx
je 0x100684a6
test cl, 1
jne 0x1006849b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x100684ab
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100736e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov cx, word [0x10159320]
test cx, cx
jne 0x1007371e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx eax, al
shr ecx, 8
movzx ecx, cl
shl ax, 8
or cx, ax
mov word [0x10159320], cx
mov eax, 0xa00
cmp cx, ax
jae 0x10073738
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x20019
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
call fcn.10013210
test eax, eax
jne 0x10073899
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100d6eb0
mov esi, dword [ebp - 0x428]
lea eax, [ebp - 0x41c]
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.ProgId
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007389f
mov eax, dword [ebp - 0x418]
cmp eax, 1
je 0x100737de
cmp eax, 2
jne 0x1007389f
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x10073802
test al, 1
jne 0x1007389f
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x1007380b
jmp 0x1007389f
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push str._sApplication
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.100a4830
add esp, 0x10
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x428]
push 0x20019
push eax
push SysReAllocString
call fcn.10013210
test eax, eax
jne 0x10073899
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push str.AppUserModelID
lea ecx, [ebp - 0x428]
call fcn.10068440
test eax, eax
jne 0x10073899
lea eax, [ebp - 0x20c]
push str.Microsoft.MicrosoftEdge_8wekyb3d8bbwe_MicrosoftEdge
push eax
call fcn.100dc721
add esp, 8
test eax, eax
jne 0x10073899
mov esi, dword [ebp - 0x428]
mov bl, 1
jmp 0x100738a1
mov esi, dword [ebp - 0x428]
xor bl, bl
test esi, esi
je 0x100738ac
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret