joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10084f0d
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
cmp eax, 2
jne 0x10084f2e
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
pop esi
ret
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
pop esi
ret

Function at 0x10084f36
Capabilities:
Set file attributes

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, 0x10178fec
push edi
mov edi, edx
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push edi
push ecx
cmp eax, 2
jne 0x10084f5c
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x10084f62
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
pop edi
pop esi
pop ecx
ret

Function at 0x10084f66
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
cmp eax, 2
jne 0x10084f87
call dword [sym.imp.kernel32.dll_DeleteFileW]
pop esi
ret
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop esi
ret

Function at 0x10085838
Capabilities:
Copy file

Disassembly:
push 0x438
mov eax, 0x100e4404
call fcn.10001af6
mov edi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x434]
call fcn.10005575
push edi
call fcn.1001877f
xor esi, esi
lea ecx, [ebp - 0x444]
push ebx
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_4804
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.10005575
lea eax, [ebp - 0x444]
push eax
call fcn.1001877f
push edi
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_4730
test al, al
jne 0x100858d2
lea eax, [ebp - 0x444]
push eax
call sym.fpsrvutl.dll_Ordinal_4730
test al, al
jne 0x100858d2
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x234]
cmp eax, 2
jne 0x100858c8
call dword [sym.imp.kernel32.dll_CopyFileW]
jmp 0x100858ce
call dword [sym.imp.kernel32.dll_CopyFileA]
test al, al
jne 0x100858e2
push dword [ebx]
mov ecx, 0x20055
push dword [edi]
call fcn.1008503f
mov esi, eax
lea ecx, [ebp - 0x224]
call fcn.100057a4
lea ecx, [ebp - 0x444]
call sym.fpsrvutl.dll_Ordinal_974
lea ecx, [ebp - 0x434]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret 4

Function at 0x10086590
Capabilities:
Delete directory

Disassembly:
push 0x214
mov eax, 0x100dedc4
call fcn.10001af6
mov edi, ecx
call sym.fpsrvutl.dll_Ordinal_1195
lea ecx, [ebp - 0x220]
call fcn.10005575
push edi
call fcn.1001877f
xor esi, esi
mov ecx, 0x10178fec
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
push dword [ebp - 0x20]
cmp eax, 2
jne 0x100865d6
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x100865dc
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x100865f7
mov esi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
mov edx, eax
mov ecx, 0x20004
call fcn.1005ca7d
mov esi, eax
lea ecx, [ebp - 0x220]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret
Function at 0x10086a7b
Capabilities:
Delete file
Move file

Disassembly:
push 0x444
mov eax, 0x100e46fc
call fcn.10001af6
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x224]
xor ebx, ebx
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x43c], ebx
call fcn.10005575
push edi
call fcn.1001877f
lea ecx, [ebp - 0x434]
mov dword [ebp - 4], ebx
call fcn.10005575
push esi
call fcn.1001877f
mov byte [ebp - 4], 1
cmp byte [ebp + 0xc], bl
jne 0x10086b2b
push edi
lea ecx, [ebp - 0x450]
call sym.fpsrvutl.dll_Ordinal_4804
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_542
test al, al
je 0x10086b1c
lea eax, [ebp - 0x450]
mov ecx, esi
push eax
call sym.fpsrvutl.dll_Ordinal_1248
test al, al
jne 0x10086b1c
push dword [edi]
mov ecx, 0x20019
push dword [esi]
call fcn.1008503f
lea ecx, [ebp - 0x450]
mov ebx, eax
call sym.fpsrvutl.dll_Ordinal_974
jmp 0x10086c58
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 1
call sym.fpsrvutl.dll_Ordinal_974
mov ecx, esi
call sym.fpsrvutl.dll_Ordinal_542
test al, al
jne 0x10086b44
push dword [esi]
xor edx, edx
mov ecx, 0x20015
jmp 0x10086bf5
mov ecx, esi
call sym.fpsrvutl.dll_Ordinal_1195
push esi
call sym.fpsrvutl.dll_Ordinal_4730
test al, al
jne 0x10086b85
push edi
lea ecx, [ebp - 0x450]
call sym.fpsrvutl.dll_Ordinal_4804
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x43c], 1
call sym.fpsrvutl.dll_Ordinal_4730
mov byte [ebp - 0x435], bl
test al, al
je 0x10086b8c
mov byte [ebp - 0x435], 1
mov dword [ebp - 4], 1
test byte [ebp - 0x43c], 1
je 0x10086ba7
lea ecx, [ebp - 0x450]
call sym.fpsrvutl.dll_Ordinal_974
cmp byte [ebp - 0x435], 0
je 0x10086bb7
push dword [esi]
push 0xd
pop edx
jmp 0x10086bf0
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
jne 0x10086bfe
xor eax, eax
cmp byte [ebp + 0xc], al
setne al
add eax, 8
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x234]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x10086c50
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
mov edx, eax
mov ecx, 0x20014
call fcn.1005ca7d
mov ebx, eax
jmp 0x10086c58
push dword [ebp - 0x24]
push dword [ebp - 0x234]
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
jne 0x10086c50
cmp byte [ebp + 0xc], al
je 0x10086be5
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
sub eax, 0x50
je 0x10086c28
sub eax, 0x67
jne 0x10086c44
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileA]
push dword [ebp - 0x24]
push dword [ebp - 0x234]
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
jne 0x10086c4a
mov esi, dword [esi]
call edi
jmp 0x10086bed
mov edi, dword [ebp - 0x440]
push edi
mov ecx, esi
call fcn.1001877f
lea ecx, [ebp - 0x434]
call fcn.100057a4
lea ecx, [ebp - 0x224]
call fcn.100057a4
mov eax, ebx
call fcn.10001b2d
ret 8
Function at 0x10087b36
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
jne 0x10087ba6
cmp byte [0x1017bdd7], 0
je 0x10087ba6
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0xc
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x10087bb1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10087b9b
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.10087a32
push eax
call fcn.1001877f
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10087bb1
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
leave
ret 4

Function at 0x1008947e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [0x10150ddc]
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp byte [0x1017bdd7], 0
mov ecx, eax
je 0x100894a8
test ecx, ecx
je 0x100894a8
cmp byte [ecx + 5], 0
je 0x100894a8
xor ebx, ebx
jmp 0x100894ab
push 2
pop ebx
test ecx, ecx
je 0x100894b6
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100894bb
call sym.fpsrvutl.dll_Ordinal_981
mov esi, eax
test esi, esi
je 0x100894f9
push edi
mov edi, dword [esi + 0x1c]
cmp edi, 3
je 0x100894cd
mov dword [esi + 0x1c], ebx
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.1001877f
mov ecx, eax
test ecx, ecx
jne 0x100894e9
mov ecx, esi
call sym.fpsrvutl.dll_Ordinal_5512
jmp 0x100894ef
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x1c], 3
je 0x100894f8
mov dword [esi + 0x1c], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100896cf
Capabilities:
Access the windows event log
Get thread local storage value

Disassembly:
push 0x418
mov eax, 0x100e4c77
call fcn.10001af6
mov dword [ebp - 0x420], ecx
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov eax, dword [ebp + 0x18]
or edi, 0xffffffff
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x424], eax
test esi, esi
je 0x1008972b
push eax
push ebx
push esi
push edi
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.100401c9
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
add esp, 0x20
test eax, eax
cmovs eax, edi
test eax, eax
jns 0x1008972e
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x410]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10089734
add ecx, 0xfffffffe
mov al, byte [ecx]
cmp al, 0xa
je 0x10089748
cmp al, 0xd
jne 0x10089757
lea eax, [ebp - 0x410]
cmp ecx, eax
jb 0x10089757
mov byte [ecx], bl
dec ecx
jmp 0x1008973e
mov eax, dword [0x1017ca68]
push 2
pop edi
cmp dword [eax + 4], edi
setne bl
jne 0x10089893
cmp byte [ebp - 0x410], 0
je 0x100898ac
jmp 0x10089788
mov al, byte [ecx]
cmp al, 0xa
je 0x10089784
cmp al, 0xd
jne 0x10089787
mov byte [ecx], 0x20
dec ecx
lea eax, [ebp - 0x410]
cmp ecx, eax
jae 0x1008977a
push eax
lea ecx, [ebp - 0x414]
call fcn.1001877f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x414]
push 0
call sym.fpsrvutl.dll_Ordinal_2209
mov ecx, dword [ebp + 0x10]
movsx eax, cx
cmp eax, 0xfffffffd
je 0x100897d2
cmp eax, 0xfffffffe
je 0x100897d5
cmp eax, 0xffffffff
je 0x100897cd
test eax, eax
je 0x100897d2
cmp eax, 1
je 0x100897d5
push 4
pop edi
jmp 0x100897d5
xor edi, edi
inc edi
mov eax, dword [ebp - 0x414]
push dword [0x10150ddc]
mov dword [ebp - 0x41c], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
call sym.fpsrvutl.dll_Ordinal_5072
test eax, eax
je 0x1008980f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
jmp 0x10089893
push str.Windows_SharePoint_Services_4.0
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
jne 0x1008982b
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x10089849
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
push 1
push ebx
push 0x3e8
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x1008984b
mov bl, 1
test esi, esi
je 0x10089856
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
and dword [ebp - 4], 0
push dword [0x10150ddc]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
call sym.fpsrvutl.dll_Ordinal_2309
test eax, eax
je 0x1008987b
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov esi, dword [ebp - 0x418]
test bl, bl
je 0x100898ac
mov ecx, dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0x38]
call fcn.10001b2d
ret 0x14
Function at 0x1008e15a
Capabilities:
Delete registry value

Disassembly:
push 0x214
mov eax, 0x100e4fbe
call fcn.10001af6
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x220]
test ebx, ebx
mov eax, 0x100ea6e8
cmovne eax, ebx
push eax
call fcn.1001877f
xor edi, edi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.10005575
lea eax, [ebp - 0x220]
push eax
call fcn.1001877f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov esi, dword [esi + 0xc]
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
push dword [ebp - 0x1c]
push esi
cmp eax, 2
jne 0x1008e1d0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1008e1d6
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
je 0x1008e217
cmp dword [0x1017ca10], 0
push 0x14
je 0x1008e1ef
pop ecx
call fcn.1001877f
jmp 0x1008e1f6
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1008e217
push ebx
push esi
push edi
push 0x30021
push eax
call sym.fpsrvutl.dll_Ordinal_5274
add esp, 0x14
mov edi, eax
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, edi
call fcn.10001b2d
ret 4
Function at 0x1008e549
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x238
mov eax, 0x100e509b
call fcn.10001af6
mov edi, ecx
lea ecx, [ebp - 0x21c]
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x18]
jle 0x1008e594
push 1
push esi
lea ecx, [ebp - 0x21c]
call fcn.1001877f
xor esi, esi
mov ecx, ebx
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e5aa
shr eax, 1
mov ebx, dword [edi + 0xc]
mov ecx, 0x10178fec
mov dword [ebp - 0x220], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push ebx
jne 0x1008e60e
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1008e614
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1008e623
mov ecx, eax
call fcn.1008d65e
mov esi, eax
jmp 0x1008e63e
mov eax, dword [ebp - 0x224]
inc eax
mov byte [edi + 0x10], 1
mov dword [edi + 0x58], eax
mov eax, dword [ebp - 0x228]
inc eax
mov dword [edi + 0x54], esi
mov dword [edi + 0x5c], eax
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret
Function at 0x1008e651
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x430
mov eax, 0x100e50e4
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x428]
mov esi, dword [edi + 0x58]
mov dword [ebp - 0x43c], eax
call fcn.10005575
push 0
push esi
call fcn.1001877f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
mov esi, dword [edi + 0x5c]
call fcn.10005575
xor ebx, ebx
inc ebx
cmp esi, dword [ebp - 0x18]
jle 0x1008e6a2
push ebx
push esi
call fcn.1001877f
mov ecx, 0x10178fec
mov byte [ebp - 4], bl
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x224]
jne 0x1008e6bc
shr eax, 1
mov esi, dword [edi + 0x54]
mov ecx, 0x10178fec
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x430], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x42c], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x438]
push eax
push 0
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x228]
push esi
push dword [ebp - 0x42c]
jne 0x1008e715
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x1008e71b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1008e777
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
call sym.fpsrvutl.dll_Ordinal_2271
mov ecx, dword [ebp - 0x43c]
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
lea edx, [ebp - 0x42c]
push dword [ebp - 0x430]
push eax
push dword [ebp - 0x438]
call fcn.1008db58
mov ecx, eax
test ecx, ecx
je 0x1008e764
mov eax, dword [ecx]
push ebx
call dword [eax]
mov ecx, dword [ebp - 0x42c]
inc dword [edi + 0x54]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
jmp 0x1008e77d
mov byte [edi + 0x10], 0
xor bl, bl
lea ecx, [ebp - 0x21c]
call fcn.100057a4
lea ecx, [ebp - 0x428]
call fcn.100057a4
mov al, bl
call fcn.10001b2d
ret 4
Function at 0x1008e88d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x238
mov eax, 0x100e509b
call fcn.10001af6
mov edi, ecx
lea ecx, [ebp - 0x21c]
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x18]
jle 0x1008e8d8
push 1
push esi
lea ecx, [ebp - 0x21c]
call fcn.1001877f
xor esi, esi
mov ecx, ebx
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e8ee
shr eax, 1
mov ebx, dword [edi + 0xc]
mov ecx, 0x10178fec
mov dword [ebp - 0x220], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push ebx
jne 0x1008e952
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1008e958
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1008e967
mov ecx, eax
call fcn.1008d65e
mov esi, eax
jmp 0x1008e97b
mov eax, dword [ebp - 0x224]
inc eax
mov dword [edi + 0x5c], esi
mov dword [edi + 0x58], eax
mov byte [edi + 0x35], 1
mov dword [edi + 0x54], esi
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret

Function at 0x1008e98e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x224
mov eax, 0x100e5155
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
mov esi, dword [edi + 0x58]
mov dword [ebp - 0x228], eax
call fcn.10005575
xor ebx, ebx
push ebx
push esi
call fcn.1001877f
mov ecx, 0x10178fec
mov dword [ebp - 4], ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e9d6
shr eax, 1
mov ecx, dword [ebp - 0x228]
push 0x100ea6e8
mov dword [ebp - 0x220], eax
call fcn.1001877f
mov eax, dword [edi + 0xc]
mov ecx, 0x10178fec
mov esi, dword [edi + 0x54]
mov dword [ebp - 0x224], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0x224]
jne 0x1008ea2a
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1008ea30
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1008ea4d
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x21c]
push eax
call fcn.1001877f
inc dword [edi + 0x54]
mov bl, 1
jmp 0x1008ea50
mov byte [edi + 0x35], bl
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov al, bl
call fcn.10001b2d
ret 4
Function at 0x10094be4
Capabilities:
Compare security identifiers

Disassembly:
push 0x2c
mov eax, 0x100e57cf
call fcn.1000131b
mov ebx, ecx
push ecx
lea ecx, [ebp - 0x14]
call fcn.10001e74
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
add ebx, 0x1c
push eax
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
push dword [eax]
call fcn.1001877f
mov edi, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
sete byte [ebp - 0xd]
jne 0x10094c7f
lea ecx, [edi + 0xc]
call fcn.1001877f
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x18]
push eax
call fcn.1001877f
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x1c]
push eax
call fcn.1001877f
mov eax, dword [ebp + 0x14]
lea ecx, [edi + 0xc]
mov edx, dword [edi + 0x24]
mov dword [eax], edx
call fcn.1001877f
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
dec eax
push 1
pop ebx
jne 0x10094d2a
test edi, edi
je 0x10094d2a
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax]
jmp 0x10094d2a
and dword [ebp - 0x38], ecx
lea eax, [ebp - 0x38]
and dword [ebp - 0x34], ecx
mov ecx, ebx
movaps xmm0, xmmword [0x1012c1e0]
or dword [ebp - 0x20], 0xffffffff
push eax
movups xmmword [ebp - 0x30], xmm0
call fcn.1001877f
test eax, eax
jne 0x10094d1c
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x10094cbe
mov eax, dword [ebp - 0x2c]
cmp eax, 6
ja 0x10094cbe
mov esi, dword [esi + eax*4 + 0x20]
jmp 0x10094cc0
xor esi, esi
lea ecx, [esi + 0xc]
call fcn.1001877f
mov eax, dword [ebp + 8]
push dword [esi + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10094cfd
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0x18]
push eax
call fcn.1001877f
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1c]
push eax
call fcn.1001877f
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x24]
mov byte [ebp - 0xd], bl
mov dword [ecx], eax
lea ecx, [esi + 0xc]
call fcn.1001877f
cmp byte [ebp - 0xd], 0
jne 0x10094d1a
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.1001877f
test eax, eax
je 0x10094ca9
mov ebx, edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.1001877f
mov bl, byte [ebp - 0xd]
lea ecx, [ebp - 0x14]
call fcn.1000221e
mov al, bl
call fcn.100013b7
ret 0x10
Function at 0x10096d8a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jne 0x10096da3
xor eax, eax
jmp 0x10096e4c
lea eax, [ebp - 4]
push eax
push esi
push 0x40000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x10096e32
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x408]
add eax, ecx
mov edx, dword [edi + 0x40c]
cmp eax, edx
jbe 0x10096de2
sub eax, edx
mov ecx, edi
push eax
call fcn.1001877f
mov ecx, dword [edi + 0x408]
mov eax, dword [edi]
lea eax, [eax + ecx*2]
lea ecx, [ebp - 4]
push ecx
push eax
push 0x40000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x10096e1c
mov eax, dword [edi + 0x408]
mov esi, dword [ebp - 4]
add eax, esi
cmp eax, dword [edi + 0x40c]
ja 0x10096e4a
mov dword [edi + 0x408], eax
jmp 0x10096e4a
mov eax, dword [vtable.VprocessGlobals.0]
push str.Unable_to_write_base_64_encoded_value.
push esi
push esi
push 0x10178fec
call dword [eax + 0x24]
jmp 0x10096e47
mov ecx, dword [vtable.VprocessGlobals.0]
push str.Unable_to_determine_size_of_base_64_encoded_value.
push esi
push esi
push 0x10178fec
call dword [ecx + 0x24]
add esp, 0x10
mov eax, esi
pop edi
pop esi
leave
ret 8
Function at 0x10097396
Capabilities:
Get thread local storage value

Disassembly:
push 0xc
mov eax, 0x100e58bf
call fcn.1000131b
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push dword [0x10150ddc]
movzx esi, di
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1009749e
cmp dword [ebp + 8], 0x80001
je 0x1009749e
test di, di
jne 0x100973d7
movzx edi, word [eax + 0x68]
mov eax, 0x409
cmp di, ax
je 0x1009749e
test si, si
je 0x100973fb
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.100893c6
mov esi, eax
xor eax, eax
inc eax
jmp 0x10097408
lea ecx, [ebp + 0x14]
call fcn.100ab1e5
push 2
mov esi, eax
pop eax
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
lea ebx, [esi - 0xc]
lock inc dword [ebx]
mov dword [ebp - 4], 1
test al, 2
je 0x10097432
mov ecx, dword [ebp + 0x14]
and eax, 0xfffffffd
mov dword [ebp - 0x10], eax
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test al, 1
je 0x10097445
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
cmp dword [esi - 4], 0
je 0x10097495
test di, di
jne 0x10097467
push 0x5c
mov ecx, ebx
call fcn.1001877f
add eax, 0xfffffffc
add eax, esi
push eax
call fcn.1001877f
movzx edi, ax
mov eax, 0x409
cmp di, ax
je 0x10097495
push dword [ebp + 0x10]
lea edx, [ebp - 0x18]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1009754d
mov esi, eax
test esi, esi
je 0x10097495
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
jmp 0x100974ce
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_5727
xor ebx, ebx
mov ecx, dword [ebp + 8]
call fcn.100978aa
test eax, eax
js 0x100974cc
push 0xffffffffffffffff
push dword [eax*8 + 0x1014b384]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
push dword [ebp + 0xc]
call fcn.1001877f
mov ebx, eax
mov eax, ebx
call fcn.100013b7
ret 0x10