joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440441
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp eax, 0xffffffff
push ebx
push esi
push edi
mov ebx, ecx
jne 0x440496
mov ecx, 0x102
sbb eax, 0xffffff8e
call 0xffc3e348
aaa
jmp fcn.004403e4
xchg esi, eax
add byte [eax], al
or byte [ebp + 3], dh
mov dword [ebp + 0x1c], eax
add edi, dword [ebp + 0x60]
push dword [ebp + 0x13]
mov dword [ebp + 0x20], eax
cmp dword [edi], edi
sbb byte [eax + 0x6750048], ah
invalid

Function at 0x440df3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, ebp
push ecx
mov eax, dword [esi + 0x4358]
cmp eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push edi
je 0x440e7b
push 3
pop eax
cmp dword [esi + 0x14], eax
mov dword [ebp - 4], eax
jl 0x440e72
pop ebp
lea edi, [esi + 0x64]
mov eax, dword [edi]
test dword [eax + 0x74], eax
inc esi
cmp byte [eax + 0x70], 3
je 0x440e64
retf 0x7348
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 4
cmp eax, dword [esi + 0x14]
jle 0x440e18
mov al, byte [ebp + 8]
mov dword [edi + 0x44158], eax
push 3
pop eax
cmp dword [esi + 0x14], eax
mov dword [ebp - 4], edx
cld
jne 0x440e14
jle 0x440eed
mov eax, dword [edi]
test eax, eax
je 0x440f05
cmp al, 0x60
or esi, dword [edx + edi + 0xf]
mov dh, 0x48
xor edi, dword [ebx + 0x41588e]
add ch, dh
sub al, 0xf6
inc eax
jb 0x440ec5
jne 0x440ecd
push 0
mov edi, 0x8bd3fd30
pop es
push 4
push dword [ecx]
call ebx
mov eax, dword [edi]
jbe 0x440ef9
jb 0x440f03
je 0x440ecd
cmp byte [eax + 0x70], 0x1a
jne 0x440ecd
ljmp 0x5815:0xff30ff01
push dword [eax]
call dword [0x463558]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 4
cmp eax, dword [esi]
adc al, 0x7e
scasb al, byte es:[edi]
push 0
push dword [ebp + 8]
push 0x10130c
push dword [esi + 0x4150]
call dword [0x204675c4]
pop edi
pop ebx
les esi, [ebp + 0x46]
and byte [edi + 0x5b], bl
leave
ret 4
in al, dx
mov dword [0x575e34ec], eax
push 0xa
mov esi, esp
mov bl, 0xc0
pop ebp
lea edi, [ebp - 0x30]
mov dword [ebp - 0x34], 0x82c
rep stosd dword es:[edi], eax
or ecx, dword [ebp + 0xc]
cmp ecx, 0xffffffff
jne 0x440f25
mov eax, dword [esi + 0x4164]
mov dword [ebx + 0x24], eax
jecxz 0x440f99
lea eax, [ebp - 8]
push eax
int 0x75
cld
mov edi, 0x48a010
call fcn.0043abe5
test al, al
jne 0x440f41
xor al, al
jmp 0x460fc1
mov eax, dword [ebp - 4]
wait
dec ebp
clc
lea eax, [eax*4 + 0x48a060]
mov esi, dword [eax]
lea ecx, [ecx*4 + 0x18]
mov edx, dword [esi + ecx]
mov edx, dword [edx + 4]
mov dword [ebx + 4], edx
mov eax, dword [eax]
mov eax, dword [eax + ecx]
sbb byte [eax + 0x78], 0xc
je 0x440f8c
lea edx, [ebp - 0x32]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x2e], 4
push edx
call dword [0x4654e0]
test eax, eax
je 0x440f3a
add dword [ebp - 0x20], 0xffffff89
inc ebx
add al, 0xff
jae 0x440f93
push dword [ebx + 4]
call dword [0x404674b4]
inc esi
inc eax
test eax, eax
je 0x440f3a
call dword [sym.imp.USER32.dll_Ena_leWindoW]
mov edi, eax
test edi, edi
je 0x440f3a
mov eax, dword [ebp + 0x14]
xchg dword [ebp - 0x2c], esp
add dword [ecx + 0x459bf051], ecx
or byte [ecx + 0x458dde45], cl
int3
inc eax
pop esi
ret
Function at 0x44500f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ecx, byte [eax]
mov cl, byte [ecx + 0x468410]
mov dl, 0x24
invalid

Function at 0x44556d
Capabilities:
Parse credit card information

Disassembly:
jmp 0x4455ed
sbb ecx, 0x51
je 0x4455fa
cmp ecx, 0x4f
jne 0x445587
xor ecx, ecx
mov ch, byte [eax + 1]
mov cl, byte [eax + 2]
jmp 0x4455ed
cmp ecx, 0x38
jl 0x4455b4
cmp ecx, 0x3d
jle 0x4455a5
cmp ecx, 0x40
jl 0x4455a0
cmp ecx, 0x43
jle 0x4455a9
cmp ecx, 0x44
jne 0x4455d4
mov dl, byte [eax + 3]
jmp 0x4455a8
mov dl, byte [eax + 1]
cmp dl, 0xf
je 0x4455b2
cli
pcmpeqb mm0, qword [0xf50efa88]
mov dl, bh
push cs
cmc
add al, byte [eax + 0x40]
inc eax
inc eax
pop es
mov dh, 0x91
add byte [ebp - 0x2dfcffba], 0x83
jl 0x4455e4
add al, 0
je 0x4455ed
cmp ebx, 0x3b
jle 0x4455ed
cmp ecx, 0x1c
jle 0x4455d8
cmp ecx, 0x1d
jle 0x4455ed
cmp ecx, 0x2a
jg 0x4455ed
stc
sub bh, byte [edi + 0x15]
movzx ecx, byte [eax - 0x41]
cmp cl, 0xc0
jb 0x4455ed
ret
movzx ecx, byte [ecx + 0x468660]
adc eax, ecx
movzx ecx, byte [eax]
test ecx, ecx
jne 0x44556f
xor esp, eax
ret

Function at 0x44602c
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x78]
mov ecx, dword [ebp + 0x5c]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x60]
xor eax, eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x54], eax
mov dword [ebp + 0x48], eax
mov dword [ebp], eax
mov dword [ebp - 8], eax
mov ebx, dword [ecx]
mov ecx, dword [ebp + 0x64]
mov esi, dword [ecx]
xor ecx, ecx
inc ecx
mov eax, edx
shr eax, 0xb
and eax, ecx
mov dword [ebp + 0x1c], eax
mov eax, edx
shr eax, 9
and eax, ecx
mov dword [ebp - 0x68], eax
xor eax, ecx
mov dword [ebp - 0x64], eax
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x24], eax
mov eax, edx
and eax, ecx
shl eax, 8
mov dword [ebp + 0x2c], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp + 0x50], esi
mov dword [ebp - 0x18], eax
Function at 0x446c48
Capabilities:
Authenticate hmac
Encode data using base64
Parse credit card information
Parse pe header

Disassembly:
cmp eax, edx
je 0x446c8b
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, 0x7fffffeb
sub edx, eax
lea esi, [ecx - 6]
cmp edx, esi
jl 0x448736
lea eax, [eax + ecx - 6]
mov ecx, dword [ebp + 0x7c]
mov dword [ecx], eax
mov byte [ebx], 0x5d
inc ebx
mov byte [ebx], 0
mov byte [ebx + 1], 3
inc ebx
inc ebx
mov byte [ebx], 0x54
inc ebx
mov byte [ebx], 0
mov byte [ebx + 1], 3
inc ebx
inc ebx
jmp 0x4485c0
cmp ecx, 0x65
mov ebx, dword [ebp + 0x14]
je 0x4485c0
cmp ecx, 0x5c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x54], edx
jl 0x446cee
cmp eax, 0xfffffffe
jne 0x446ccd
mov eax, dword [ebp - 0x20]
cmp eax, edx
jl 0x446cc3
mov dword [ebp + 0x24], eax
mov dword [ebp - 0x54], 1
jmp 0x446cc7
or dword [ebp + 0x24], 0xffffffff
or dword [ebp + 0xc], 0xffffffff
jmp 0x446ce0
cmp dword [ebp - 0x20], edx
jl 0x446ce0
cmp dword [ebp - 0x1c], edx
jge 0x446ce9
mov eax, dword [ebp + 0x40]
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jl 0x4485c0
mov eax, dword [ebp - 0x1c]
jmp 0x446d02
cmp ecx, 0x57
jne 0x4485c0
mov eax, dword [ebp - 0x1c]
cmp eax, edx
jl 0x4485c0
mov dword [ebp + 0x10], eax
jmp 0x4485c0
inc dword [ebp + 0x50]
mov esi, dword [ebp + 0x50]
jmp 0x4460aa
mov eax, dword [ebp + 0x68]
mov dword [eax], 0x14
mov eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x64]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret
Function at 0x4551e3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x476b50]
je 0x4551fe
inc edi
cmp edi, 0x17
jb 0x4551ef
cmp edi, 0x17
jae 0x45537e
push ebp
push 3
call fcn.00460825
cmp eax, 1
pop ecx
je 0x45534a
push 3
call fcn.00460825
test eax, eax
pop ecx
jne 0x455232
cmp dword [0x476388], 1
je 0x45534a
cmp ebx, 0xfc
je 0x45537d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x478a90
push ebp
call fcn.00460549
add esp, 0xc
test eax, eax
je 0x455268
push esi
push esi
push esi
push esi
push esi
call fcn.00454f21
add esp, 0x14
push 0x104
mov esi, 0x478aa9
push esi
push 0
mov byte [0x478bad], 0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x45537d
cmp ebp, 0xffffffff
je 0x45537d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x476b54]
push dword [esi]
call fcn.00450bb0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]

Function at 0x455e45
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x58]
call 0xfc446927
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x455e66
ret
add cl, byte [ecx + 0x75fb7b3c]
sub ebp, eax
or eax, 0x53fffff2
mov dword [ebx + edi*2], edi
sti
jnp 0x455e63
jne 0x455e95
call fcn.0045507c
push ebx
push ebx
push ebx
push ebx
push ebx
invalid
cmp dword [ebp + 0x14], ebx
je 0x455ec6
cmp dword [ebp + 4], 2
jge 0x455e6a
cmp dword [ebp + 0x14], 0x24
jg 0x455e6a
push esi
movzx esi, word [edi]
or dword [ebp - 4], ebx
add edi, 2
jmp 0x455eb7
movzx esi, word [edi]
inc edi
inc edi
lea eax, [ebp - 0x14]
push eax
push 8
push esi
in al, dx
jnp 0x455ec5
add byte [eax], al
add esp, 0x75c0850c
call 0x2e43e234
or al, 0x85
sal byte [ebp - 0x18], 0x66
cmp esi, 0x2d
test eax, eax
jne 0x455eb2
cmp si, 0x2d
jne 0x455ed6
or dword [eax + ebx + 2], 0xffffffeb
cmp si, 0xffab
cmp si, 0xffab
jne 0x455e61
movzx esi, word [edi]
inc edi
inc edi
cmp dword [ecx + 0x14], ebx
jne 0x455f19
push esi
call fcn.00460967
test eax, eax
pop eax
je 0x455efa
mov dword [ebp + 0x10], 0xa
jmp 0x455f40
movzx eax, word [edi]
cmp ax, 0x58
je 0x455f0a
cmp ax, 0x58
je 0x455f12
mov dword [ebp + 0x14], 8
jmp 0x455f41
inc ebp
adc al, 8
add byte [eax], al
add bl, ch
das
mov dword [ebp + 0x34], 0x810
cmp dword [ebp + 4], 0x10
jne 0x455f40
push esi
call fcn.00460967
xchg ebp, eax
rcr byte [ecx - 0xb], 0x16
movzx eax, word [edi]
cmp ax, 0x78
push es
xor ax, 0x58
jne 0x455f40
inc edi
inc edi
invalid
or eax, 0xfffffffe
xor edx, edx
enter 0x33fe, 0xffffffffffffffd2
div dword [ebp + 0x14]
lea edx, [ebp - 8]
mov ebx, eax
push esi
clc
adc al, 0xaa
add byte [eax], al
ret
Function at 0x456632
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x3f4]
sub esp, 0x474
mov eax, dword [0x476dec]
add al, 0
add byte [ecx + 0x476dec], ah
xor eax, ebp
mov dword [ebp - 0x7ffffc10], eax
mov eax, dword [ebp + 0x3fc]
push ebx
mov ebx, dword [ebp + 0x408]
inc esi
mov esi, dword [ebp + 0x400]
push edi
push dword [ebp + 0x404]
xor bh, bh
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x54], edi
or dword [ebp - 0x14], esi
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x18]
mov dword [eax + edx*8 - 0x77], edi
jge 0x456632
mov dword [ebp - 0x34], edi
call fcn.0044e727
movsd dword es:[edi], dword [esi]
cmp bh, 0xff
cmp dword [ebp - 0x3c], edi
jne 0x4566b4
call fcn.0045507c
push edi
push ebp
push edi
push edi
mov dword [eax], 0x20000016
push edi
call 0xbe45521d
add dword [esi + edx - 0x80], 0x7f
test al, 0
push ss
add byte [eax], al
and byte [edi - 0x18], dl
sub ebx, 0x4483bdff
push ss
cmp byte [edi - 0x58], 0
je 0x4566b4
wait
inc ebp
movsb byte es:[edi], byte [esi]
and dword [eax + 0x70], 0xfffffffd
or eax, 0xffffffff
loope 0x4566fc
or byte [eax], al
add byte [edx], bh
div dword [edi + ecx*8 + 0xf]
mov bh, 0x16
cmp dh, bh
je 0x456687
movzx edx, word [esi]
xor ecx, ecx
cmp dx, word [edi - 0x762b8255]
jge 0x4566a6
fnstcw word [ebp - 0x50]
mov dword [ecx - 0x24], edx
je 0x456f2f
push 2
pop edi
add esi, edi
mov dword [0x8900d578], eax
jne 0x456692
jl 0x456eef
lea eax, [edx - 0x20]
cmp ax, 0x58
ja 0x4566fc
movzx eax, dx
movzx eax, byte [eax + 0x479708]
and eax, 0xf
jmp 0x45667e
xor eax, dword [eax + 0xf]
mov esi, 0xd728c184
inc esi
add byte [edx + 3], ch
sar eax, 2
pop ecx
cmp eax, ecx
mov dword [eax + ebx*4 + 0xf], eax
xchg dword [esi - 0x1fffff9], esp
and al, 0x85
adc ebp, dword [edi + 0x45]
add byte [ebx], dh
rol byte [ebx - 0x760017b3], 0x45
call 0x948af126
cmp byte [ebp - 0x58], 0
je 0x456efc
invalid
inc ebp

Function at 0x457170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub ebp, 0x10
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edi
sub esi, ecx
or al, 0x83
invalid
Function at 0x460668
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00454998
xor ebx, ebx
cmp dword [0x479228], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x46073e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x46081e
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x46081e
push eax
call fcn.0045492a
mov dword [esp], 0x46b48c
push edi
mov dword [0x479228], eax
call esi
push eax
call fcn.0045492a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47922c], eax
call esi
push eax
call fcn.0045492a
mov dword [0x479230], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044eb00
test eax, eax
pop ecx
pop ecx
je 0x46070c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00454f21
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x46073e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0045492a
cmp eax, ebx
pop ecx
mov dword [0x479238], eax
je 0x46073e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045492a
pop ecx
mov dword [0x479234], eax
mov eax, dword [0x479234]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4607c3
cmp dword [0x479238], ecx
je 0x4607c3
push eax
call fcn.004549a1
push dword [0x479238]
mov esi, eax
call fcn.004549a1
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4607c3
cmp edi, ebx
je 0x4607c3
call esi
cmp eax, ebx
je 0x460790
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x460790
test byte [ebp - 0x18], 1
jne 0x4607c3
lea eax, [ebp - 0x10]
push eax
call fcn.0044eb37
test eax, eax
pop ecx
je 0x4607ab
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00454f21
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4607ba
or dword [ebp + 0x10], 0x200000
jmp 0x4607fe
or dword [ebp + 0x10], 0x40000
jmp 0x4607fe
mov eax, dword [0x47922c]
cmp eax, dword [ebp - 8]
je 0x4607fe
push eax
call fcn.004549a1
cmp eax, ebx
pop ecx
je 0x4607fe
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4607fe
mov eax, dword [0x479230]
cmp eax, dword [ebp - 8]
je 0x4607fe
push eax
call fcn.004549a1
cmp eax, ebx
pop ecx
je 0x4607fe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x479228]
call fcn.004549a1
cmp eax, ebx
pop ecx
je 0x46081e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x460820
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0102b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x102b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102b06a
add dl, dl
jne 0x102b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102b0dc
xor eax, eax
add dl, dl
jne 0x102b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102b17d
add dl, dl
jne 0x102b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x102b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x102b075
mov eax, 1
add dl, dl
jne 0x102b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102b0e1
sub eax, ebx
mov ebx, 1
jne 0x102b128
mov ecx, 1
add dl, dl
jne 0x102b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x102b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102b136
cmp eax, 0x7d00
jae 0x102b16d
cmp eax, 0x500
jb 0x102b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102b075
cmp eax, 0x7f
ja 0x102b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x102b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x102b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x158c95
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x158d18
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x16aee7
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], esi
jne 0x16aeda
cmp dword [ebp - 0x10], 1
jne 0x16aee7
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x15bcbe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x18a02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x210]
push ecx
xor ebx, ebx
push ebx
push dword [0x18b470]
xor edi, edi
inc edi
push eax
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x15bd61
push dword [0x18b484]
lea eax, [ebp - 0x20c]
push eax
call fcn.001589d2
test eax, eax
je 0x16b160
push dword [0x18b488]
lea eax, [ebp - 0x20c]
push eax
call fcn.001589d2
test eax, eax
jne 0x16b168
mov dword [esi + 8], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.001586a6
leave
ret 4
mov ebx, 0x80041012
jmp 0x15bd4e
Function at 0x15d089
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push dword [0x18b474]
lea eax, [ebp - 4]
push dword [ebp + 8]
mov esi, ecx
push eax
push 2
call fcn.0015d2a1
mov ebx, eax
add esp, 0x10
test ebx, ebx
jl 0x15d14b
xor ecx, ecx
cmp dword [esi + 0x644], 0x20
mov eax, 0x100
setne cl
dec ecx
and ecx, eax
add eax, ecx
lea ecx, [ebp + 8]
push ecx
or eax, 0x20019
push eax
push 0
push dword [ebp - 4]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x15d142
push edi
push dword [ebp + 8]
xor edi, edi
inc edi
mov ecx, esi
mov dword [esi + 0x10], edi
call fcn.0015bcbe
mov ebx, eax
test ebx, ebx
jl 0x15d111
push dword [ebp + 8]
mov ecx, esi
call fcn.0015d158
mov ebx, eax
lea eax, [ebp - 8]
push eax
add esi, 0x2c
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x18b4e4]
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push dword [ebp - 4]
call dword [fcn.00151284]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x15d158
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x18a02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push 0
push dword [0x18b47c]
xor edi, edi
inc edi
push eax
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x16b1ad
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.001586a6
leave
ret 4
Function at 0x15d366
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
xor ebx, ebx
push edi
cmp eax, ebx
jne 0x16b2c7
mov edi, dword [fcn.00151288]
cmp dword [ebp + 8], ebx
je 0x15d39b
push dword [ebp + 8]
call edi
mov dword [esi + 0x20], eax
cmp eax, ebx
je 0x16b2d6
mov eax, dword [esi + 0x28]
cmp eax, ebx
jne 0x16b2e0
cmp dword [ebp + 0xc], ebx
je 0x15d3bb
push dword [ebp + 0xc]
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
je 0x16b2d6
push dword [ebp + 8]
lea eax, [ebp - 4]
push dword [0x18b46c]
mov dword [ebp - 4], ebx
push eax
push 2
call fcn.0015d2a1
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x15d488
push 0x20
pop ebx
push dword [ebp - 4]
lea edi, [esi + 0x644]
mov ecx, esi
mov dword [edi], ebx
call fcn.0015d1ca
xor ecx, ecx
cmp dword [edi], ebx
mov dword [ebp + 8], eax
setne cl
mov eax, 0x100
xor ebx, ebx
dec ecx
and ecx, eax
add eax, ecx
lea ecx, [ebp + 0xc]
push ecx
or eax, 0x20019
push eax
push ebx
push dword [ebp - 4]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
inc edi
test eax, eax
jne 0x15d477
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x43c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x18b4e4]
mov dword [ebp - 0xc], edi
push dword [ebp + 0xc]
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0015d497
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x15d46e
cmp dword [esi + 0x10], edi
jne 0x16b2ef
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [fcn.00151284]
cmp dword [ebp + 8], ebx
jl 0x15d488
mov dword [esi + 0x1c], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x15d497
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x18a02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x210]
push ecx
xor edi, edi
push edi
push dword [0x18b480]
mov dword [ebp - 0x210], 1
push eax
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x16b297
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.001586a6
leave
ret 4