joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101af7a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102e77c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor ebx, ebx
push ebx
mov esi, 0x10059f4
push esi
push 0x80000001
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x218], 0x208
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
je 0x101aff3
push 0x293
push 0x10058f0
call fcn.0100c9d4
push esi
push edi
push 0x10059d0
call fcn.0100cb2d
add esp, 0xc
jmp 0x101b0c6
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
mov esi, 0x10059bc
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
je 0x101b039
push 0x29d
push 0x10058f0
call fcn.0100c9d4
push esi
push edi
push 0x1005998
jmp 0x101afe6
cmp dword [ebp - 0x21c], 1
jne 0x101b098
mov esi, dword [0x1001090]
lea eax, [ebp - 0x20c]
push eax
push 0x1005990
mov word [ebp - 6], bx
call esi
test eax, eax
jne 0x101b064
mov dword [ebp - 0x210], ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1005984
call esi
test eax, eax
jne 0x101b07c
mov dword [ebp - 0x210], ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1005980
call dword [0x1001170]
test eax, eax
jne 0x101b098
mov dword [ebp - 0x210], ebx
push 0x2c0
push 0x10058f0
call fcn.0100c9d4
cmp dword [ebp - 0x210], ebx
mov eax, 0x1005974
jne 0x101b0b9
mov eax, 0x1005968
push eax
push 0x1005940
call fcn.0100cb2d
pop ecx
pop ecx
cmp dword [ebp - 0x214], ebx
pop edi
pop esi
pop ebx
je 0x101b0dd
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
call fcn.0102222e
leave
ret
Function at 0x101b8a2
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1028921
call fcn.01022df8
sub esp, 0x214
mov eax, dword [0x102e77c]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x21c], ebx
je 0x101b8e6
push 0x4fc0
push 3
call fcn.0100dcc2
push eax
call fcn.0100d552
add esp, 0xc
push 0x1005d38
jmp 0x101b900
push 0x4fc1
push 3
call fcn.0100dcc2
push eax
call fcn.0100d552
add esp, 0xc
push 0x1005990
lea eax, [ebp - 0x218]
push 0x82
push eax
call fcn.0101ae26
cmp eax, ebx
jge 0x101b91c
and eax, 0xffff
jmp 0x101b96d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea edi, [eax + eax + 2]
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push ebx
push 0x10059f4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x101b973
push edi
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push 0x10059bc
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x101b9aa
push esi
lea eax, [ebp - 0x220]
push eax
call fcn.010200f3
push dword [eax]
mov dword [ebp - 4], ebx
push esi
push 0x4fc2
push 2
call fcn.0100dcc2
push eax
call fcn.0100d7f3
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea ecx, [ebp - 0x220]
call sub.MFC42u.DLL_CString::CString
cmp dword [ebp - 0x21c], ebx
pop edi
pop esi
pop ebx
je 0x101b9c1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
adc al, 0x10
add byte [ecx], al

Function at 0x101bd55
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
inc dword [0x102f7ac]
push esi
mov esi, ecx
mov dword [0x102f7a8], ebx
mov eax, 0x102f7b8
cmp dword [eax], ebx
je 0x101bdf0
add eax, 4
cmp eax, 0x102f7d0
jl 0x101bd6e
push edi
xor eax, eax
mov edi, 0x102f79c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, esi
stosd dword es:[edi], eax
call fcn.0101af7a
mov ecx, esi
mov dword [0x102e4d8], eax
call fcn.0101b400
mov ecx, esi
call fcn.0101b7ac
push 0x10000000
push ebx
push ebx
push ebx
push 0x1005dc0
call dword [0x10015b4]
cmp eax, ebx
mov dword [0x102f7b4], eax
pop edi
jne 0x101bdf7
call dword [fcn.010010e4]
mov esi, eax
push esi
push 0x4fb1
push 2
call fcn.0100dcc2
push eax
call fcn.0100d552
add esp, 0x10
cmp esi, ebx
jle 0x101bdec
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
jmp 0x101be3a
mov ebx, 0x8007000e
jmp 0x101be3a
push 0x101b298
push eax
call dword [0x10015ac]
cmp eax, 0xffffffff
jne 0x101be2e
call dword [fcn.010010e4]
push 0x14b
push 0x10058f0
mov esi, eax
call fcn.0100c9d4
push esi
push 0x1005d94
call fcn.0100cb4a
pop ecx
pop ecx
jmp 0x101bddc
push dword [0x102f7b0]
call dword [0x10010a8]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x101bd60
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
inc dword [0x102f7ac]
push esi
mov esi, ecx
mov dword [0x102f7a8], ebx
mov eax, 0x102f7b8
cmp dword [eax], ebx
je 0x101bdf0
add eax, 4
cmp eax, 0x102f7d0
jl 0x101bd6e
push edi
xor eax, eax
mov edi, 0x102f79c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, esi
stosd dword es:[edi], eax
call fcn.0101af7a
mov ecx, esi
mov dword [0x102e4d8], eax
call fcn.0101b400
mov ecx, esi
call fcn.0101b7ac
push 0x10000000
push ebx
push ebx
push ebx
push 0x1005dc0
call dword [0x10015b4]
cmp eax, ebx
mov dword [0x102f7b4], eax
pop edi
jne 0x101bdf7
call dword [fcn.010010e4]
mov esi, eax
push esi
push 0x4fb1
push 2
call fcn.0100dcc2
push eax
call fcn.0100d552
add esp, 0x10
cmp esi, ebx
jle 0x101bdec
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
jmp 0x101be3a
mov ebx, 0x8007000e
jmp 0x101be3a
push 0x101b298
push eax
call dword [0x10015ac]
cmp eax, 0xffffffff
jne 0x101be2e
call dword [fcn.010010e4]
push 0x14b
push 0x10058f0
mov esi, eax
call fcn.0100c9d4
push esi
push 0x1005d94
call fcn.0100cb4a
pop ecx
pop ecx
jmp 0x101bddc
push dword [0x102f7b0]
call dword [0x10010a8]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x101beb9
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 0x24], 1
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
jne 0x101bee4
mov dword [ebp - 8], 0x800000
mov ecx, 0x1bb
jmp 0x101beea
push 0x50
mov dword [ebp - 8], edi
pop ecx
push esi
push edi
push 3
push edi
push edi
lea eax, [esi + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push ecx
push eax
push dword [0x102f7b4]
call dword [0x10015a0]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, edi
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c033
push ebx
push 0x494
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005e40
call fcn.0100cb2d
pop ecx
pop ecx
push esi
push dword [ebp - 8]
lea ebx, [esi + 0x14]
push edi
push edi
push edi
push 0x1001938
push 0x1005e34
push dword [esi + 0x10]
mov dword [esi + 0x1c], ebx
call dword [0x10015c4]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, edi
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c032
push 0x4a0
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005e18
call fcn.0100cb2d
pop ecx
pop ecx
push edi
push edi
push edi
push edi
push dword [ebx]
mov dword [esi + 0x1c], edi
call dword [0x10015bc]
push dword [ebp + 8]
mov ecx, esi
push edi
push eax
call fcn.0101bb79
test eax, eax
je 0x101c032
push 0x4aa
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005dfc
call fcn.0100cb2d
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push dword [ebx]
mov dword [ebp - 0xc], 4
call dword [0x10015b8]
test eax, eax
je 0x101c020
mov eax, dword [ebp - 4]
push 0x64
xor edx, edx
pop ecx
div ecx
cmp eax, 2
je 0x101c014
cmp eax, 3
je 0x101c014
push dword [ebp + 8]
push dword [ebp - 4]
push edi
jmp 0x101c02b
push dword [ebp + 8]
mov ecx, esi
call fcn.0101bc54
jmp 0x101c032
push dword [ebp + 8]
push edi
call dword [fcn.010010e4]
push eax
mov ecx, esi
call fcn.0101c24c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x101c03e
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x102e77c]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [0x102e4d8], ebx
mov ecx, 0x93
lea edi, [ebp - 0x250]
mov dword [ebp - 0x254], ebx
rep stosd dword es:[edi], eax
je 0x101c11d
cmp dword [esi + 4], ebx
je 0x101c126
xor ecx, ecx
mov eax, dword [esi]
push esi
push ecx
push 1
push ebx
push ebx
push 0x15
lea edi, [esi + 0x10]
push eax
mov dword [esi + 0x1c], edi
push dword [0x102f7b4]
call dword [0x10015a0]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, ebx
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c10e
push 0x4e4
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005e5c
call fcn.0100cb2d
pop ecx
pop ecx
push ebx
lea eax, [esi + 0x14]
push ebx
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push dword [edi]
call dword [0x10015c0]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, ebx
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c10e
push dword [ebp + 8]
mov ecx, esi
call fcn.0101bc54
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102222e
leave
ret 4
cmp dword [esi + 4], ebx
je 0x101c082
mov ecx, 0x8000000
jmp 0x101c084

Function at 0x101c90e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push 5
pop eax
cmp dword [ecx + 0x34], eax
je 0x101c9bb
mov dword [ecx + 0x34], eax
mov ecx, dword [0x102f7d0]
call fcn.0101f0c5
test eax, eax
jne 0x101c9de
and dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
inc edi
push edi
push 0
push 0x1001808
push 0x80000002
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c99b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1006160
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c98e
cmp dword [ebp - 0xc], 4
jne 0x101c98c
cmp dword [ebp - 0x10], eax
jne 0x101c98e
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x101c9a6
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x15
jmp 0x101c9af
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x1d
mov eax, dword [ebp + 8]
mov dword [eax], 1
pop edi
jmp 0x101c9e4
mov ecx, dword [0x102f7d0]
call fcn.0101f0c5
test eax, eax
jne 0x101c9de
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x16
jmp 0x101c9e4
mov eax, dword [ebp + 8]
and dword [eax], 0
xor eax, eax
leave
ret 8
Function at 0x10200f3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1028e62
call fcn.01022df8
sub esp, 0x224
mov eax, dword [0x102e77c]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x1001938
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], ebx
call sub.MFC42u.DLL_CString::CString_3
xor esi, esi
inc esi
xor edi, edi
cmp dword [ebp + 0xc], 0x2ee0
mov dword [ebp - 4], esi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x228], 0x1300
jb 0x1020202
cmp dword [ebp + 0xc], 0x2f8e
ja 0x1020202
lea ecx, [ebp - 0x220]
call sub.MFC42u.DLL_CString::CString_2
push 0x104
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 2
call dword [0x100115c]
test eax, eax
jne 0x10201b9
push 0xdd
push 0x100861c
call fcn.0100c9d4
call dword [fcn.010010e4]
push eax
push 0x1005c94
call fcn.0100cb4a
pop ecx
pop ecx
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
jmp 0x1020235
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push 0x1005c74
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
push 2
push ebx
push dword [ebp - 0x220]
call dword [0x100111c]
mov edi, eax
cmp edi, ebx
je 0x10201f3
mov dword [ebp - 0x228], 0x1b00
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0x400
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x228]
call dword [fcn.010010b4]
test eax, eax
je 0x1020235
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x224]
call sub.MFC42u.DLL_CString::operator_1
cmp dword [ebp - 0x21c], ebx
je 0x1020249
push dword [ebp - 0x21c]
call dword [fcn.010010ec]
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x224]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x22c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0102222e
leave
ret 8

Function at 0x1020901
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102e77c]
push esi
push edi
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [0x100115c]
test eax, eax
mov edi, 0x100861c
jne 0x1020950
push 0x22d
push edi
call fcn.0100c9d4
call dword [fcn.010010e4]
push eax
push 0x1008790
call fcn.0100cb4a
pop ecx
pop ecx
push 0x100877c
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101e8b4
mov esi, eax
test esi, esi
je 0x1020980
push 0x235
push edi
call fcn.0100c9d4
push esi
push 0x1008738
call fcn.0100cb4a
pop ecx
pop ecx
push 1
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
push 0
call dword [0x1001504]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0102222e
leave
ret
Function at 0x10218c3
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, 0x10290dd
call fcn.01022df8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], ebx
call dword [eax + 4]
push eax
mov dword [ebp - 0x18], eax
push 0x1008a88
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42u.DLL_operator_2
push dword [eax]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.010211a1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
cmp dword [ebp - 0x18], ebx
mov edi, 0x80004005
jne 0x1021918
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 4]
cmp dword [eax - 8], ebx
jne 0x102192c
mov dword [ebp - 0x10], 0x80070057
jmp 0x10219d5
push eax
call dword [0x1001128]
test eax, eax
jne 0x1021996
call dword [fcn.010010e4]
mov dword [ebp - 0x20], eax
dec eax
dec eax
je 0x102197c
dec eax
je 0x1021966
push 0x100
push 0x1008a54
call fcn.0100c9d4
push dword [ebp - 0x20]
push 0x1008a30
call fcn.0100cb4a
pop ecx
jmp 0x10219d1
push 0xee
push 0x1008a54
call fcn.0100c9d4
push 0x10089fc
jmp 0x10219cc
push 0xf7
push 0x1008a54
call fcn.0100c9d4
push 0x10089c4
call fcn.0100cb2d
pop ecx
cmp dword [ebp - 0x10], ebx
jne 0x10219d5
mov esi, dword [esi + 4]
push ebx
push 0x80
push 2
push ebx
push ebx
push 2
push esi
call dword [fcn.010010fc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10219f3
push 0x116
push 0x1008a54
call fcn.0100c9d4
push 0x1008980
call fcn.0100cb4a
pop ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
cmp ecx, ebx
pop ebx
je 0x10219e4
call fcn.010217e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
cmp dword [ebp - 0x18], ebx
je 0x10219d2
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1021a03
mov edi, dword [eax]
jmp 0x1021a05
xor edi, edi
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.010211fa
shl eax, 1
push eax
push edi
push esi
call dword [fcn.010010f0]
push esi
call dword [fcn.0100116c]
jmp 0x10219d5

Function at 0x1023213
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1023236
mov ebx, 0x80070057
jmp 0x10232be
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1008fd8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x1023264
and eax, edi
or eax, esi
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10232ad
cmp dword [ebp - 4], eax
jne 0x1023278
mov ebx, 0x80004005
jmp 0x10232bc
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push eax
push 0x1008fbc
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x102329f
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jl 0x10232ad
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x10232bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x10232ca
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [0x1001178]
movzx eax, word [ebp - 0x2c]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
movzx eax, word [ebp - 0xa]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
movzx eax, word [ebp - 0xc]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1009040
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x1023340
and eax, edi
or eax, esi
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x102337c
cmp dword [ebp - 4], eax
jne 0x1023354
mov ebx, 0x80004005
jmp 0x102338b
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 8], 4
push eax
push eax
push 0x1009034
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x102337a
and eax, edi
or eax, esi
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x102338b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14

Function at 0x10235eb
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x1029186
call fcn.01022df8
sub esp, 0x25c
mov eax, dword [0x102e77c]
push ebx
push esi
mov dword [ebp - 0x10], eax
push edi
mov esi, ecx
and dword [ebp - 4], 0
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x268], esp
push eax
call sub.MFC42u.DLL_CString::CString_4
lea eax, [ebp - 0x264]
push eax
mov ecx, esi
call fcn.01023551
mov eax, dword [ebp - 0x264]
cmp dword [eax - 8], 0
mov byte [ebp - 4], 1
jle 0x102364c
push 0x1008cec
lea ecx, [ebp - 0x264]
call fcn.010229d6
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call dword [fcn.01001190]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10236d8
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
call sub.MFC42u.DLL_operator_1
push dword [eax]
mov esi, dword [0x1001128]
call esi
lea ecx, [ebp - 0x268]
call sub.MFC42u.DLL_CString::CString
mov edi, dword [0x100118c]
jmp 0x10236c3
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
call sub.MFC42u.DLL_operator_1
push dword [eax]
call esi
lea ecx, [ebp - 0x268]
call sub.MFC42u.DLL_CString::CString
lea eax, [ebp - 0x260]
push eax
push ebx
call edi
test eax, eax
jne 0x102369a
push ebx
call dword [0x1001188]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0102222e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1023ded
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x102926c
call fcn.01022df8
sub esp, 0x18
push esi
xor esi, esi
push edi
push 0x1001938
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
call sub.MFC42u.DLL_CString::CString_3
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x1023e2b
mov dword [ebp - 0x10], 0x80070057
jmp 0x1023f67
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push 0x1009318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov edi, 0xffff
jle 0x1023e55
and eax, edi
or eax, 0x80070000
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x1023f67
cmp dword [ebp - 0x14], esi
jne 0x1023e71
mov dword [ebp - 0x10], 0x80004005
jmp 0x1023f75
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x1009308
push ebx
push dword [ebp - 0x14]
call esi
cmp eax, 2
je 0x1023f64
test eax, eax
jle 0x1023ea1
and eax, edi
or eax, 0x80070000
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x1023f64
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x1023f64
push 1
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
add eax, 2
push eax
call fcn.01023c1d
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x1023f64
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push 0
push 0
push ebx
push dword [ebp - 0x14]
call esi
test eax, eax
jle 0x1023ef8
and eax, edi
or eax, 0x80070000
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x1023f64
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::operator_1
push 0
push 0x2e
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Replace_1
cmp eax, 1
jge 0x1023f22
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp - 0x10], 0
jl 0x1023f64
push dword [ebp - 0x18]
mov esi, dword [sym.imp.msvcrt.dll__wtol]
call esi
mov ebx, dword [ebp + 8]
pop ecx
shl eax, 0x10
push 0
lea ecx, [ebp - 0x18]
mov dword [ebx], eax
call sub.MFC42u.DLL_CString::Find_2
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Mid_1
push dword [eax]
call esi
pop ecx
and eax, edi
or dword [ebx], eax
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
xor esi, esi
pop ebx
cmp dword [ebp - 0x14], esi
je 0x1023f75
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x14], esi
call fcn.01023d2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4