joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468803
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x468822
test byte [ebp - 4], 7
je 0x468822
xor eax, eax
inc eax
leave
ret
call fcn.00468790
leave
ret

Function at 0x468bfc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.00484950
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x468cdf
test edi, edi
je 0x468cdf
cmp dword [ebp + 0x10], 0x80
jl 0x468cdf
and dword [ebp - 0x200c], 0
push 0x2000
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00484150
add esp, 0xc
lea eax, [ebp - 0x200c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x468cdf
cmp eax, 0x1fff
ja 0x468cdf
lea ecx, [ebp - 0x2004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x468cdf
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x2008]
push eax
push 0x4ce4dc
lea eax, [ebp - 0x2004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x468cdf
push dword [ebp + 0x10]
push 0
push edi
call fcn.00484150
mov eax, dword [ebp - 0x2008]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x4c5ea8
push dword [ebp + 0x10]
push edi
call fcn.00446d7d
xor eax, eax
add esp, 0x28
inc eax
jmp 0x468ce1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00484247
leave
ret

Function at 0x469013
Capabilities:
Get disk information

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x4baeca
call fcn.0048501f
push 0x800
xor ebx, ebx
lea eax, [ebp]
push ebx
push eax
call fcn.00484150
add esp, 0xc
lea eax, [ebp]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea esi, [ebp]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp word [ebp], bx
je 0x4690cf
push 0x4ecda4
lea ecx, [ebp - 0x10]
call fcn.0040ba90
movzx eax, word [esi]
push eax
lea eax, [ebp - 0x10]
push str._c:_
push eax
mov dword [ebp - 4], ebx
call fcn.0041cbb1
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0046869a
mov eax, dword [ebp - 0x14]
add esp, 0x14
cmp eax, dword [ebp + 0x810]
jg 0x4690f4
jl 0x4690b3
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x80c]
ja 0x4690f4
push esi
call fcn.00484927
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [edi - 0x10]
lea esi, [esi + eax*2 + 2]
call fcn.0040dd20
cmp word [esi], bx
jne 0x469069
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00484247
add ebp, 0x804
leave
ret
movzx esi, word [esi]
lea ecx, [edi - 0x10]
call fcn.0040dd20
mov ax, si
jmp 0x4690d1
Function at 0x476e10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x47882a
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + 8], 2
xor edx, edx
cmp dword [esp + 8], edx
jle 0x478867
push esi
push edi
mov eax, dword [esp + 0xc]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
rol eax, 0x10
mov esi, eax
shr esi, 8
mov edi, eax
shl edi, 8
xor esi, edi
and esi, 0xff00ff
shl eax, 8
xor esi, eax
inc edx
cmp edx, dword [esp + 0x10]
mov dword [ecx], esi
jl 0x478839
pop edi
pop esi
ret

Function at 0x47b302
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x4bc028
call fcn.0048501f
lea ecx, [ebp - 0x1c]
call fcn.0046fbd2
push 0x4c633c
xor esi, esi
push 0x13f
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.0046fede
test eax, eax
jne 0x47b37b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0046fbe3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00484247
add ebp, 0x20c
leave
ret
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.00484150
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b680
push str.5D71384B_38EA_4fe7_8C03_64840F939E27
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041cb8c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00470142
test eax, eax
jne 0x47b3ed
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0046fbe3
mov eax, esi
jmp 0x47b358
push str.urlproc.dll
lea ecx, [ebp - 0x10]
call fcn.0047b2bf
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47b3cf
push dword [ebp - 0x10]
call fcn.0040e4f0
mov esi, eax
jmp 0x47b3cf
Function at 0x4ab613
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0049479e
and dword [ebp - 4], 0
cmp dword [0x4ee334], 0
mov ebx, eax
jne 0x4ab6c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4ab775
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4ab775
push eax
call fcn.0049472c
mov dword [esp], 0x4cc644
push edi
mov dword [0x4ee334], eax
call esi
push eax
call fcn.0049472c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ee338], eax
call esi
push eax
call fcn.0049472c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ee33c], eax
call esi
push eax
call fcn.0049472c
pop ecx
mov dword [0x4ee344], eax
test eax, eax
je 0x4ab6c4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0049472c
pop ecx
mov dword [0x4ee340], eax
mov eax, dword [0x4ee340]
cmp eax, ebx
je 0x4ab71c
cmp dword [0x4ee344], ebx
je 0x4ab71c
push eax
call fcn.004947a7
push dword [0x4ee344]
mov esi, eax
call fcn.004947a7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4ab71c
test edi, edi
je 0x4ab71c
call esi
test eax, eax
je 0x4ab713
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4ab713
test byte [ebp - 0xc], 1
jne 0x4ab71c
or dword [ebp + 0x10], 0x200000
jmp 0x4ab755
mov eax, dword [0x4ee338]
cmp eax, ebx
je 0x4ab755
push eax
call fcn.004947a7
pop ecx
test eax, eax
je 0x4ab755
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4ab755
mov eax, dword [0x4ee33c]
cmp eax, ebx
je 0x4ab755
push eax
call fcn.004947a7
pop ecx
test eax, eax
je 0x4ab755
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ee334]
call fcn.004947a7
pop ecx
test eax, eax
je 0x4ab775
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4ab777
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x1002672
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x10113f1
call fcn.01001410
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x10056b2
cmp dword [ebp + 8], esi
je 0x10056bc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10056f1
mov eax, dword [ebp - 0x18]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or eax, ecx
push eax
call dword [0x1014498]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x100273b
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [edi], eax
cmp eax, esi
je 0x1002734
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10056da
xor ebx, ebx
push dword [ebp - 0x14]
call dword [0x1014494]
mov eax, ebx
call fcn.01001350
ret 8
mov ebx, 0x8007000e
jmp 0x1002721
mov ebx, 0x8007000e
jmp 0x100272a
mov eax, 0x80004003
jmp 0x100272c
mov eax, 0x80070057
jmp 0x100272c
call fcn.01002d9a
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x1002721
push eax
call fcn.01009449
mov ebx, eax
jmp 0x100272a

Function at 0x10034fe
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01002793
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10035a0
cmp dword [ebp - 0x94], 5
jb 0x1003573
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10035bc
call fcn.01002230
test eax, eax
jl 0x1005de4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010012fd
leave
ret
cmp dword [ebp - 0x88], 1
je 0x1005dcc
jmp 0x1003573
cmp dword [ebp - 0x90], 0
jbe 0x1003573
jmp 0x100356f
cmp dword [ebp - 0x94], 4
ja 0x100356f
je 0x10035af
jmp 0x1003573
mov byte [0x1014548], 1
jmp 0x1003591
Function at 0x1003759
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1001ea0
call fcn.010021e6
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1014078
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1005df0
xor esi, esi
inc esi
mov eax, dword [0x101403c]
cmp eax, esi
je 0x1005e0f
mov eax, dword [0x101403c]
test eax, eax
jne 0x1001e5d
mov dword [0x101403c], esi
push 0x1001e98
push 0x1001e8c
call fcn.01002a44
pop ecx
pop ecx
test eax, eax
jne 0x1005e1c
mov eax, dword [0x101403c]
cmp eax, esi
jne 0x1001e12
push 0x1001e88
push 0x1001e68
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101403c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1001e1f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10144b4], ebx
jne 0x1005e2a
push dword [0x101408c]
push dword [0x1014090]
push dword [0x1014088]
call fcn.010016a0
add esp, 0xc
mov dword [0x1014038], eax
cmp dword [0x101402c], ebx
jne 0x1005e7c
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov dword [0x1014570], esi
jmp 0x1001dee
call fcn.01003768
jmp 0x1001d7f
cmp eax, esi
jne 0x1005dff
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1001db5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001da1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001dee
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1005e96
push 0x10144b4
call fcn.0100c1ec
pop ecx
test eax, eax
je 0x1001e2b
push ebx
push 2
push ebx
call dword [0x10144b4]
jmp 0x1001e2b
cmp dword [0x1014570], ebx
jne 0x1005e8a
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1014038]
call fcn.0100227c
ret

Function at 0x1009bec
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x1009c07
push 0x80004005
call fcn.0100981d
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1009c09
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100a2f7
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.01009b4a
mov edi, eax
cmp edi, esi
je 0x100a369
lea ecx, [ebp - 0x214]
call fcn.01009ad7
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.010012fd
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100a387
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.0100a2f7
cmp eax, esi
jne 0x100a3d2
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x100a371
lea ecx, [ebp - 0x214]
call fcn.01009ad7
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.010099be
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01009ad7
mov eax, esi
jmp 0x100a359
Function at 0x100b735
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1011997
call fcn.0100c025
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x100b78e
call fcn.01002d9a
mov esi, eax
jmp 0x100b897
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x100b7a7
call fcn.01002d9a
jmp 0x100b889
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x100b79d
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x100b80d
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100b7f3
lea ecx, [ebp - 0x418]
call fcn.0100a296
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.0100a1a5
mov eax, esi
call fcn.0100c065
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0100a85f
mov dword [ebp - 4], 1
jmp 0x100b83b
cmp dword [ebp - 0x418], esi
jne 0x100b84a
mov esi, 0x8007000e
jmp 0x100b88b
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x100b79d
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.0100b5f9
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100b7f8
lea ecx, [ebp - 0x418]
call fcn.0100a296
jmp 0x100b7f8
Function at 0x100d2d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x278
mov eax, 0x1011e31
call fcn.0100c025
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
mov edi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x224], eax
call ebx
mov eax, dword [edi + 0x9c]
test eax, eax
jne 0x100d315
push 6
call ebx
xor eax, eax
call fcn.0100c065
ret 8
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov dword [ebp - 0x220], 0x208
call esi
mov dword [ebp - 0x22c], eax
mov ecx, 0xea
test eax, eax
je 0x100d353
cmp eax, ecx
jne 0x100d36e
cmp dword [ebp - 0x228], 1
je 0x100d371
cmp dword [ebp - 0x228], 7
je 0x100d371
cmp dword [ebp - 0x228], 2
je 0x100d371
push eax
jmp 0x100d309
and dword [ebp - 4], 0
cmp dword [ebp - 0x228], 2
jne 0x100d457
cmp eax, ecx
jne 0x100d3b3
push 0x80010135
lea ecx, [ebp - 0x244]
call fcn.0100c557
mov esi, eax
lea edi, [ebp - 0x284]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x101272c
lea eax, [ebp - 0x284]
push eax
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0x224]
mov esi, 0x104
push esi
call fcn.0100c97d
push esi
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [eax - 1]
mov dword [ebp - 0x220], eax
cmp ecx, 0x102
ja 0x100d42b
add eax, eax
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x100d4de
jle 0x100d406
and eax, 0xffff
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x244]
call fcn.0100c557
mov esi, eax
lea edi, [ebp - 0x254]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x101272c
lea eax, [ebp - 0x254]
jmp 0x100d3ad
push 0x80010135
lea ecx, [ebp - 0x244]
call fcn.0100c557
mov esi, eax
lea edi, [ebp - 0x274]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x101272c
lea eax, [ebp - 0x274]
jmp 0x100d3ad
cmp eax, ecx
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x224]
jne 0x100d493
shr eax, 1
push eax
call fcn.0100c97d
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x230]
push dword [edi + 0x9c]
call esi
jmp 0x100d3f2
shr eax, 1
push eax
call fcn.0100c97d
lea ecx, [ebp - 0x21c]
push ecx
push dword [ebp - 0x220]
push eax
call fcn.0100525d
test eax, eax
jge 0x100d3ec
push eax
lea ecx, [ebp - 0x244]
call fcn.0100c557
mov esi, eax
lea edi, [ebp - 0x264]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x101272c
lea eax, [ebp - 0x264]
jmp 0x100d3ad
or dword [ebp - 4], 0xffffffff
shr dword [ebp - 0x220], 1
mov ecx, dword [ebp - 0x224]
je 0x100d4fa
mov eax, dword [ebp - 0x220]
dec eax
push eax
jmp 0x100d4fc
push 0
call fcn.0100c9d7
xor eax, eax
inc eax
jmp 0x100d30d
Function at 0x100dfd4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x100647c
push 0x10
xor ebx, ebx
push eax
mov byte [ebp - 0x25], bl
call fcn.01003c0d
add esp, 0x10
test eax, eax
jl 0x100e056
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push 8
lea eax, [ebp - 0x24]
push eax
push edi
push 0x80000002
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0x14
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x100e056
cmp dword [ebp - 0x2c], 0x14
jne 0x100e056
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.0100dfa7
mov byte [ebp - 0x25], al
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x25]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010012fd
leave
ret 4

Function at 0x100e06f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x100647c
push 0x10
push eax
xor bl, bl
call fcn.01003c0d
add esp, 0x10
test eax, eax
jl 0x100e0df
lea eax, [ebp - 0x28]
push eax
push 2
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100e0df
push 0x14
push esi
push 3
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100e0d6
inc bl
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.010012fd
leave
ret 4
Function at 0x100e0f7
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0100dccd
test al, al
je 0x100e284
push dword [esi + 0x14]
lea ecx, [ebp - 0x16c]
call fcn.0100dca7
push 0x100e2a8
lea ecx, [ebp - 0x16c]
call fcn.0100dfd4
test al, al
je 0x100e16d
mov eax, dword [ebp - 0x16c]
cmp eax, dword [esi]
jne 0x100e16d
mov eax, dword [ebp - 0x168]
cmp eax, dword [esi + 4]
jne 0x100e16d
mov eax, dword [ebp - 0x164]
cmp eax, dword [esi + 8]
jne 0x100e16d
mov eax, dword [ebp - 0x15c]
cmp eax, dword [esi + 0x10]
je 0x100e284
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x100e29c
push 0x10
push eax
call fcn.01003c0d
add esp, 0x10
test eax, eax
jl 0x100e284
push dword [esi + 0x10]
lea eax, [ebp - 0x44]
push 0x100e294
push 0x10
push eax
call fcn.01003c0d
add esp, 0x10
test eax, eax
jl 0x100e284
push edi
xor edi, edi
push edi
push 0x2710
push dword [esi + 8]
push dword [esi + 4]
call fcn.010053e7
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - 0x148], edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x100e283
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x17c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x100e283
push 0x80
lea eax, [ebp - 0x144]
push eax
push edi
lea eax, [ebp - 0x164]
push eax
push edi
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
jle 0x100e283
lea eax, [ebp - 0x24]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14c], eax
push 0x10063e8
lea eax, [ebp - 0x144]
push edi
mov dword [ebp - 0x154], 0x1006390
mov dword [ebp - 0x148], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x100e283
push edi
lea eax, [ebp - 0x154]
push eax
push edi
push 4
push edi
push 0x800003f7
push 1
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010012fd
leave
ret