joyce8/EMBER2024-capa huggingface dataset:
Function at 0x132654
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x132720
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor ecx, ecx
push ebp
push 0x132703
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1326e1
mov eax, 4
mov edx, 4
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 0xc]
push eax
push edx
push 0
push 0x132730
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13270a
cmp dword [ebp - 8], 0
je 0x1326fd
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x132748
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x1327ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0x132800
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x1327cd
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x13283c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x1327cd
cmp dword [ebp - 0x10], 4
jne 0x1327cd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1327f6
cmp dword [ebp - 0x14], 0
je 0x1327e9
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0x132850
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x1328de
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x1328ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1328bc
mov eax, 4
mov edx, 4
xor ecx, ecx
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 8]
push eax
push edx
push 0
push 0x132928
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1328e5
cmp dword [ebp - 0xc], 0
je 0x1328d8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x136be4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x136bec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, 0x2a89fc
xor eax, eax
push ebp
push 0x136dd8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x136de8
call fcn.00031d88
push dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, 0x136e04
call fcn.00031d88
push dword [ebp - 0x10]
mov eax, dword [ebx]
call fcn.001322b8
cdq
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0002b0cc
push dword [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, 0x136e08
call fcn.00031d88
push dword [ebp - 0x18]
mov eax, dword [ebx]
call fcn.001324bc
test eax, eax
sete al
lea edx, [ebp - 0x1c]
call fcn.0002d050
push dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov eax, 0x136e08
call fcn.00031d88
push dword [ebp - 0x20]
push esi
lea edx, [ebp - 0x24]
mov eax, 0x136e0c
call fcn.00031d88
push dword [ebp - 0x24]
push dword [0x2a8a3c]
lea edx, [ebp - 0x28]
mov eax, 0x136e08
call fcn.00031d88
push dword [ebp - 0x28]
mov eax, dword [ebx]
call fcn.00132300
push eax
call sub.kernel32.dll_GetTickCount
pop edx
call fcn.0002cde4
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0002b0cc
push dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
mov eax, 0x136e10
call fcn.00031d88
push dword [ebp - 0x30]
mov eax, dword [ebx]
call fcn.00132474
push eax
call sub.kernel32.dll_GetTickCount
pop edx
call fcn.0002cde4
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.0002b0cc
push dword [ebp - 0x34]
lea edx, [ebp - 0x38]
mov eax, 0x136e14
call fcn.00031d88
push dword [ebp - 0x38]
lea eax, [ebp - 8]
mov edx, 0xe
call fcn.00013f8c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.001387e0
xor eax, eax
push ebp
push 0x136d6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.00132504
test eax, eax
je 0x136d45
push 0
mov eax, dword [ebx]
call fcn.00132504
push eax
call sub.kernel32.dll_TerminateThread
xor edx, edx
mov eax, dword [ebx]
call fcn.001324e0
xor edx, edx
mov eax, dword [ebx]
call fcn.00132528
xor edx, edx
mov eax, dword [ebx]
call fcn.001322dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x136da5
lea edx, [ebp - 0x40]
mov eax, 0x136e28
call fcn.00031d88
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.001387e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x136ddf
lea eax, [ebp - 0x40]
mov edx, 0xf
call fcn.00013c60
ret
Function at 0x1385e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, eax
mov byte [ebp - 1], 0
cmp byte [0x2a8a18], 0
jne 0x1386c1
lea edx, [ebp - 0x10]
mov eax, dword [0x2a89fc]
call fcn.001323b8
cmp dword [ebp - 0x10], 0
je 0x1386c1
cmp dword [ebp - 0xc], 0
je 0x1386c1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1386ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x1386cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x138698
mov esi, 8
mov ebx, 3
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x1386f8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x138698
mov byte [0x2a8a18], 1
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1386c1
cmp dword [ebp - 8], 0
je 0x1386b4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x138704
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [0x2a89fc]
mov edx, dword [ebp - 8]
mov dword [eax + 0x74], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x78], edx
mov byte [0x2a8a18], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x138795
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x1387a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x138773
push 0x1387cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13879c
cmp dword [ebp - 0xc], 0
je 0x13878f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x13a07c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x13a085
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x13a28c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, 0x2a8bdc
mov edx, edi
call fcn.00013c90
xor eax, eax
push ebp
push 0x13a1fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push ebp
push 0x13a1ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00014538
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp dword [ebp - 8], 0xffffffff
je 0x13a198
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
cmp esi, ebx
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x13a134
mov eax, 0x13a2a4
call fcn.00138f64
jmp 0x13a1cf
lea edx, [ebp - 0x14]
mov eax, 0x13a2b4
call fcn.00031d88
push dword [ebp - 0x14]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.0002b0cc
push dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
mov eax, 0x13a2c4
call fcn.00031d88
push dword [ebp - 0x1c]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0002b0cc
push dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.000144c4
mov eax, dword [ebp - 0xc]
call fcn.001391dc
jmp 0x13a1cf
lea edx, [ebp - 0x28]
mov eax, 0x13a2b4
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.000144c4
mov eax, dword [ebp - 0x24]
call fcn.001391dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13a1f3
cmp dword [ebp - 8], 0xffffffff
je 0x13a1eb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x14b064
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x14b145
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
xor edx, edx
push ebp
push 0x14b128
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x14b106
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x14b154
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x14b106
cmp dword [ebp - 8], 4
jne 0x14b106
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14b12f
cmp dword [ebp - 0x14], 0
je 0x14b122
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0x14b170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x14b251
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 2
xor edx, edx
push ebp
push 0x14b234
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x14b212
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x14b260
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x14b212
cmp dword [ebp - 8], 4
jne 0x14b212
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14b23b
cmp dword [ebp - 0xc], 0
je 0x14b22e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x14b288
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x14b369
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 2
xor edx, edx
push ebp
push 0x14b34c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x14b32a
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x14b378
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x14b32a
cmp dword [ebp - 0x14], 4
jne 0x14b32a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14b353
cmp dword [ebp - 0xc], 0
je 0x14b346
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0x14b3a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x14b485
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
xor edx, edx
push ebp
push 0x14b468
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x14b446
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x14b494
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x14b446
cmp dword [ebp - 0x10], 4
jne 0x14b446
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14b46f
cmp dword [ebp - 0x14], 0
je 0x14b462
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret
Function at 0x151748
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x151829
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 2
xor edx, edx
push ebp
push 0x15180c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x1517ea
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x151838
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x1517ea
cmp dword [ebp - 0xc], 4
jne 0x1517ea
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x151813
cmp dword [ebp - 8], 0
je 0x151806
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x153db8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x153dc0
push ecx
xor eax, eax
push ebp
push 0x153eff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x2a96b8]
mov byte [eax], 0
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x18]
mov eax, 0x153f10
call fcn.00031d88
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
call fcn.0002e234
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00035eb0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
pop ecx
call fcn.00013f18
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push ebp
push 0x153ed5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp - 0x10]
lea edx, [ebp - 0x28]
mov eax, 0x153f18
call fcn.00031d88
push dword [ebp - 0x28]
push 0x153f24
lea edx, [ebp - 0x2c]
mov eax, 0x153f34
call fcn.00031d88
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00013f8c
mov eax, dword [ebp - 0x24]
call fcn.00014090
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x153eb8
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
cmp dword [ebp - 0xc], 0
je 0x153eb8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [0x2a8ecc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x153edc
cmp dword [ebp - 8], 0xffffffff
je 0x153ed4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x153f38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x153f40
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x15413f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00012b94
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00012b94
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x64]
call fcn.0002b6e4
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00035eb0
mov eax, dword [ebp - 0x60]
push eax
lea eax, [ebp - 0x68]
call fcn.00027f5c
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 4]
pop edx
call fcn.00013f18
lea edx, [ebp - 0x6c]
mov eax, 0x154150
call fcn.00031d88
push dword [ebp - 0x6c]
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.00035eb0
push dword [ebp - 0x70]
lea eax, [ebp - 0x74]
call fcn.000acfd8
push dword [ebp - 0x74]
lea edx, [ebp - 0x78]
mov eax, 0x154150
call fcn.00031d88
push dword [ebp - 0x78]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00013f8c
xor eax, eax
push ebp
push 0x15410d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
call fcn.00014090
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00014090
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x1540a6
call sub.kernel32.dll_GetLastError_1
mov edi, eax
lea edx, [ebp - 0x7c]
mov eax, 0x154154
call fcn.00031d88
push dword [ebp - 0x7c]
push ebx
lea edx, [ebp - 0x80]
mov eax, 0x15415c
call fcn.00031d88
push dword [ebp - 0x80]
mov eax, dword [ebp - 0x5c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x84]
call fcn.00033468
push dword [ebp - 0x84]
lea edx, [ebp - 0x88]
mov eax, 0x154160
call fcn.00031d88
push dword [ebp - 0x88]
lea edx, [ebp - 0x8c]
mov eax, edi
call fcn.0002b100
push dword [ebp - 0x8c]
mov eax, esi
mov edx, 6
call fcn.00013f8c
jmp 0x1540f7
lea edx, [ebp - 0x90]
mov eax, 0x154164
call fcn.00031d88
push dword [ebp - 0x90]
push ebx
lea edx, [ebp - 0x94]
mov eax, 0x15415c
call fcn.00031d88
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x98]
call fcn.00033468
push dword [ebp - 0x98]
mov eax, esi
mov edx, 4
call fcn.00013f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x154114
lea eax, [ebp - 0x5c]
call fcn.00031d5c
ret
Function at 0x1571e4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x1571ec
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014080
xor eax, eax
push ebp
push 0x15742d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x1573c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push dword [ebp - 4]
lea edx, [ebp - 0x20]
mov eax, 0x15743c
call fcn.00031d88
push dword [ebp - 0x20]
push 0x157448
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x157366
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x157484
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x157328
cmp dword [ebp - 0x18], 4
jne 0x157328
cmp dword [ebp - 0x10], 1
jne 0x1573a2
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x157484
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov byte [ebp - 5], 1
test ebx, ebx
je 0x1573a2
lea edx, [ebp - 0x28]
mov eax, 0x157490
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.000144c4
mov edx, dword [ebp - 0x24]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x1573a2
lea edx, [ebp - 0x34]
mov eax, 0x15749c
call fcn.00031d88
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.000144c4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x1573a2
lea edx, [ebp - 0x40]
mov eax, 0x1574a8
call fcn.00031d88
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x44]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.000144c4
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1573cb
cmp dword [ebp - 0x14], 0
je 0x1573be
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret