joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003fee
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x214], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
add eax, 0x820
push eax
mov dword [ebx], 0x493e0
mov dword [ebp - 0x218], 0x104
call fcn.01002942
mov eax, 0x100a0ac
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004042
push edi
sub eax, edx
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x1004057
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [fcn.01001018]
mov esi, eax
test esi, esi
pop edi
jne 0x10040e5
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.TimeOut
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 4
call dword [fcn.01001014]
mov esi, eax
test esi, esi
jne 0x10040d9
mov eax, dword [ebp - 0x214]
mov dword [ebx], eax
push dword [ebp - 0x210]
call dword [fcn.01001010]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007a04
leave
ret

Function at 0x10040fa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1004170
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1004170
and word [edi], 0
push esi
push 1
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
add esi, 0x618
push esi
push 0x80000002
call dword [fcn.01001018]
mov esi, eax
test esi, esi
jne 0x100416c
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push str.Service_Account
push dword [ebp + 8]
mov dword [ebp - 4], pe_nt_image_headers32
call dword [fcn.01001014]
push dword [ebp + 8]
mov esi, eax
call dword [fcn.01001010]
mov eax, esi
jmp 0x1004175
mov eax, 0x80070057
pop edi
pop esi
leave
ret

Function at 0x100417e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
je 0x10041f7
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10041f7
push esi
push 1
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
add esi, 0x618
push esi
push 0x80000002
call dword [fcn.01001018]
mov esi, eax
test esi, esi
jne 0x10041f3
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10041c2
sub eax, edx
sar eax, 1
add eax, eax
push eax
push dword [ebp + 8]
push 1
push 0
push str.Service_Account
push dword [ebp - 4]
call dword [0x100101c]
push dword [ebp - 4]
mov esi, eax
call dword [fcn.01001010]
mov eax, esi
jmp 0x10041fc
mov eax, 0x80070057
pop esi
leave
ret
Function at 0x10043ab
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push 2
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
add esi, 0x618
push esi
push 0x80000002
call dword [fcn.01001018]
mov esi, eax
test esi, esi
jne 0x1004454
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push 0x10015a4
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [fcn.01001014]
mov esi, eax
test esi, esi
jne 0x1004454
test edi, edi
je 0x1004454
lea eax, [ebp - 0x20c]
mov edx, edi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x1004446
cmp dword [ebp - 0x210], 0
je 0x1004469
push dword [ebp - 0x210]
call dword [fcn.01001010]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01007a04
leave
ret
Function at 0x1004673
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 1
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
add esi, 0x618
push esi
push 0x80000002
call dword [fcn.01001018]
cmp eax, edi
mov esi, dword [ebp + 8]
jne 0x10046e9
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001934
push dword [ebp - 4]
mov dword [ebp - 8], 0xf90
call dword [fcn.01001014]
push dword [ebp - 4]
mov ebx, eax
mov word [esi + 0xf8e], di
call dword [fcn.01001010]
cmp ebx, edi
je 0x1004916
push 0x1001920
mov edi, 0x84
push edi
lea eax, [esi + 4]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001908
push edi
lea eax, [esi + 0x10c]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
mov eax, dword [ebp + 0xc]
add eax, 0x820
push eax
push edi
lea eax, [esi + 0x21c]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x10018f8
push edi
lea eax, [esi + 0x324]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x10018e8
push edi
lea eax, [esi + 0x42c]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x10018d4
push edi
lea eax, [esi + 0x534]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x10018b4
push edi
lea eax, [esi + 0x648]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x10018f8
push edi
lea eax, [esi + 0x768]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001868
push 0x28
lea eax, [esi + 0x870]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001818
push 0x28
lea eax, [esi + 0x8c0]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x10017c8
push 0x28
lea eax, [esi + 0x910]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001730
push edi
lea eax, [esi + 0x960]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001730
push edi
lea eax, [esi + 0xa68]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001730
push edi
lea eax, [esi + 0xc78]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001730
push edi
lea eax, [esi + 0xb70]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001730
push edi
lea eax, [esi + 0xd80]
push eax
call fcn.010028b5
mov ebx, eax
test ebx, ebx
jl 0x1004933
push 0x1001730
push edi
lea eax, [esi + 0xe88]
push eax
call fcn.010028b5
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x1004933
mov dword [esi + 0x214], 8
mov dword [esi + 0x218], eax
mov dword [esi + 0x63c], eax
mov dword [esi + 0x640], eax
mov dword [esi + 0x644], eax
mov dword [esi + 0x750], eax
mov dword [esi + 0x754], eax
mov dword [esi + 0x758], eax
mov dword [esi + 0x75c], eax
mov dword [esi + 0x760], eax
mov dword [esi + 0x764], eax
xor ebx, ebx
jmp 0x1004933
add esi, 0x324
cmp word [esi], di
jne 0x1004933
push 0x10018f8
push 0x84
push esi
call fcn.010028b5
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1005f41
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x48bc
call fcn.01007dd0
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x48b4]
push ecx
push edi
push dword [ebp + 0xc]
xor esi, esi
push 0x104
lea ecx, [ebp - 0x25c]
push ecx
push eax
mov dword [ebp - 0x48a4], esi
mov dword [ebp - 0x48b4], esi
mov dword [ebp - 0x48ac], esi
mov dword [ebp - 0x48b0], esi
mov dword [ebp - 0x48a8], esi
call fcn.01005959
add esp, 0x18
cmp eax, esi
jl 0x1006139
push ebx
lea eax, [ebp - 0x48a4]
push eax
push 0x1002708
lea eax, [ebp - 0x25c]
push eax
call dword [0x100b508]
cmp eax, esi
jl 0x1006064
lea eax, [ebp - 0x48a0]
push edi
push eax
call fcn.01003e30
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
mov dword [ebp - 0x48b8], ebx
jne 0x10060ee
cmp dword [ebp + 0xc], 1
jne 0x1006000
lea eax, [ebp - 0x48a0]
push eax
push edi
call fcn.01003712
pop ecx
pop ecx
mov eax, dword [ebp - 0x48a4]
push 0xc
pop ecx
lea ebx, [ebp - 0x48bc]
push ebx
push ecx
push 0x100a1f0
mov dword [ebp - 0x48bc], ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
cmp eax, esi
jl 0x1006064
cmp dword [ebp - 0x48b4], esi
je 0x10060e8
mov eax, dword [ebp - 0x48a4]
mov ecx, dword [eax]
lea edx, [ebp - 0x48b0]
push edx
push 0x1002728
push eax
call dword [ecx]
cmp eax, esi
jl 0x1006064
mov eax, dword [ebp - 0x48b0]
mov ecx, dword [eax]
lea edx, [ebp - 0x48a8]
push edx
push eax
call dword [ecx + 0x24]
cmp eax, esi
je 0x100606b
mov ebx, eax
jmp 0x10060ee
mov eax, dword [ebp - 0x48a8]
cmp eax, esi
je 0x1006088
lea edx, [ebp - 0x54]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, si
jne 0x100607a
push edi
push 2
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 0x48ac]
push eax
push 2
push esi
add edi, 0x618
push edi
push 0x80000002
call dword [fcn.01001018]
mov ebx, eax
cmp ebx, esi
jne 0x10060ee
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10060ba
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x54]
push eax
push 1
push esi
push 0x10015a4
push dword [ebp - 0x48ac]
call dword [0x100101c]
jmp 0x1006064
mov ebx, dword [ebp - 0x48b8]
cmp dword [ebp - 0x48a8], esi
je 0x1006102
push dword [ebp - 0x48a8]
call dword [0x100116c]
cmp dword [ebp - 0x48ac], esi
je 0x1006116
push dword [ebp - 0x48ac]
call dword [fcn.01001010]
mov eax, dword [ebp - 0x48b0]
cmp eax, esi
je 0x1006126
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48a4]
cmp eax, esi
je 0x1006136
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01007a04
leave
ret
Function at 0x1006296
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x46ac
call fcn.01007dd0
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push ebx
push 2
mov dword [ebp - 0x46ac], eax
mov dword [ebp - 0x46a8], esi
mov dword [ebp - 0x46a4], esi
mov dword [ebp - 0x46a0], esi
mov dword [ebp - 0x469c], esi
call fcn.01003beb
lea eax, [ebp - 0x4698]
push ebx
push eax
call fcn.01003e30
add esp, 0x10
cmp eax, esi
jne 0x100644f
lea eax, [ebp - 0x4698]
push eax
push ebx
call fcn.01003712
mov eax, dword [edi]
pop ecx
pop ecx
lea ecx, [ebp - 0x46a8]
push ecx
push 0xe
push 0x100a0d8
lea ecx, [ebx + 0x410]
push ecx
push edi
call dword [eax + 0x18]
mov edi, eax
cmp edi, esi
jl 0x10063a4
mov eax, dword [ebp - 0x46a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x46a4]
push edx
push 0x1002728
push eax
call dword [ecx]
mov edi, eax
cmp edi, esi
jl 0x10063a4
push esi
push 1
push dword [ebp - 0x46ac]
push esi
push esi
push esi
push esi
push 0x40030
push dword [ebp - 0x46a4]
call fcn.01005180
mov edi, eax
add esp, 0x24
cmp edi, esi
jne 0x10063a4
mov eax, dword [ebp - 0x46a4]
mov ecx, dword [eax]
lea edx, [ebp - 0x46a0]
push edx
push eax
call dword [ecx + 0x24]
mov edi, eax
cmp edi, esi
jne 0x10063a4
mov eax, dword [ebp - 0x46a0]
cmp eax, esi
je 0x10063b8
lea edx, [ebp - 0x54]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, si
jne 0x1006396
cmp dword [ebp - 0x46a0], esi
je 0x10063b8
push dword [ebp - 0x46a0]
call dword [0x100116c]
mov eax, dword [ebp - 0x46a4]
cmp eax, esi
je 0x10063c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x46a8]
cmp eax, esi
je 0x10063d8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
jne 0x100644d
push ebx
push 2
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 0x469c]
push eax
push 2
push esi
add ebx, 0x618
push ebx
push 0x80000002
call dword [fcn.01001018]
mov edi, eax
cmp edi, esi
jne 0x1006439
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x100640e
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x54]
push eax
push 1
push esi
push 0x10015a4
push dword [ebp - 0x469c]
call dword [0x100101c]
mov edi, eax
cmp dword [ebp - 0x469c], esi
je 0x100644d
push dword [ebp - 0x469c]
call dword [fcn.01001010]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007a04
leave
ret
Function at 0x100663e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push edi
push 1
push esi
push 1
mov dword [ebp - 0x87c], ecx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x870], edi
mov dword [ebp - 0x874], edi
mov dword [ebp - 0x86c], edi
mov dword [ebp - 0x864], edi
mov dword [ebp - 0x868], edi
call fcn.010056c4
add esp, 0x1c
cmp eax, edi
jl 0x100687b
push ebx
lea eax, [ebp - 0x870]
push eax
push 0x1002708
lea eax, [ebp - 0x20c]
push eax
call dword [0x100b508]
mov ebx, eax
cmp ebx, edi
jl 0x10067a6
push esi
push 4
call fcn.01003beb
lea eax, [ebp - 0x860]
push esi
push eax
call fcn.01003ea2
add esp, 0x10
cmp eax, edi
je 0x10066f4
mov ebx, eax
jmp 0x10067a6
lea eax, [ebp - 0x860]
push eax
push esi
call fcn.01003a8c
mov eax, dword [ebp - 0x870]
pop ecx
pop ecx
mov ecx, dword [eax]
lea edx, [ebp - 0x874]
push edx
push 0xe
push 0x100a558
lea edx, [esi + 0x410]
push edx
push eax
call dword [ecx + 0x18]
mov ebx, eax
cmp ebx, edi
jl 0x10067a6
mov eax, dword [ebp - 0x874]
mov ecx, dword [eax]
lea edx, [ebp - 0x86c]
push edx
push 0x1002728
push eax
call dword [ecx]
mov ebx, eax
cmp ebx, edi
jl 0x10067a6
push edi
push 1
push dword [ebp - 0x87c]
push edi
push edi
push edi
push edi
push 0x40030
push dword [ebp - 0x86c]
call fcn.01005180
mov ebx, eax
add esp, 0x24
cmp ebx, edi
jne 0x10067a6
mov eax, dword [ebp - 0x86c]
mov ecx, dword [eax]
lea edx, [ebp - 0x864]
push edx
push eax
call dword [ecx + 0x24]
mov ebx, eax
cmp ebx, edi
jne 0x10067a6
mov eax, dword [ebp - 0x864]
cmp eax, edi
je 0x10067ba
lea edx, [esi + 0x10a4]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1006798
cmp dword [ebp - 0x864], edi
je 0x10067ba
push dword [ebp - 0x864]
call dword [0x100116c]
mov eax, dword [ebp - 0x86c]
cmp eax, edi
je 0x10067ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x874]
cmp eax, edi
je 0x10067da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x870]
cmp eax, edi
je 0x10067ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp ebx, edi
jne 0x1006878
push esi
push 4
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 0x868]
push eax
push 2
push edi
lea eax, [esi + 0x618]
push eax
push dword [ebp - 0x878]
call dword [fcn.01001018]
mov ebx, eax
cmp ebx, edi
jne 0x1006864
add esi, 0x10a4
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100682a
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
push 1
push edi
push 0x10015a4
push dword [ebp - 0x868]
call dword [0x100101c]
mov ebx, eax
cmp ebx, edi
jne 0x1006864
push esi
push 0x1001f1c
call dword [0x1001144]
pop ecx
pop ecx
cmp dword [ebp - 0x868], edi
je 0x1006878
push dword [ebp - 0x868]
call dword [fcn.01001010]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01007a04
leave
ret
Function at 0x1006fbf
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1414
call fcn.01007dd0
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x25c]
push edi
push eax
mov dword [ebp - 0x1408], edi
mov dword [ebp - 0x1400], edi
mov dword [ebp - 0x1414], edi
mov dword [ebp - 0x140c], edi
mov dword [ebp - 0x260], edi
call fcn.01007dbe
lea eax, [ebp - 0x13fc]
push esi
push eax
call fcn.01004673
add esp, 0x14
cmp eax, edi
jne 0x10071db
cmp dword [ebp + 0xc], 1
jne 0x1007040
lea eax, [ebp - 0x13fc]
push eax
push esi
call fcn.010034e1
pop ecx
pop ecx
push edi
push 1
push esi
push 1
push 0x105
lea eax, [ebp - 0x46c]
push eax
push ebx
call fcn.010056c4
add esp, 0x1c
cmp eax, edi
mov dword [ebp - 0x1404], eax
jne 0x100718d
lea eax, [ebp - 0x1400]
push eax
push 0x1002708
lea eax, [ebp - 0x46c]
push eax
call dword [0x100b508]
cmp eax, edi
mov dword [ebp - 0x1404], eax
jl 0x100718d
push esi
push dword [ebp + 0xc]
call fcn.010033b4
pop ecx
pop ecx
lea eax, [ebp - 0x1408]
push eax
push 2
push edi
lea eax, [esi + 0x618]
push eax
push ebx
call dword [fcn.01001018]
test eax, eax
jne 0x1007131
mov eax, dword [ebp - 0x1400]
mov ecx, dword [eax]
lea edx, [ebp - 0x1414]
push edx
push 0x1002728
push eax
call dword [ecx]
test eax, eax
jl 0x1007131
mov eax, dword [ebp - 0x1414]
mov ecx, dword [eax]
lea edx, [ebp - 0x140c]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x140c]
cmp eax, edi
je 0x1007131
lea edx, [ebp - 0x54]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x10070f4
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1007108
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x54]
push eax
push 1
push edi
push 0x10015a4
push dword [ebp - 0x1408]
call dword [0x100101c]
lea eax, [ebp - 0x260]
push esi
push eax
call fcn.010040fa
test eax, eax
pop ecx
pop ecx
je 0x1007151
push esi
push str.LocalSystem
call fcn.0100417e
pop ecx
pop ecx
cmp dword [esi + 0x10f4], edi
mov eax, dword [ebp - 0x1400]
lea esi, [ebp - 0x1410]
jne 0x1007171
push 0x12
pop ecx
push esi
push ecx
push 0x100abc0
jmp 0x100717b
push 0x18
pop ecx
push esi
push ecx
push 0x100a9e0
mov dword [ebp - 0x1410], ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
mov dword [ebp - 0x1404], eax
cmp dword [ebp - 0x140c], edi
je 0x10071a1
push dword [ebp - 0x140c]
call dword [0x100116c]
mov eax, dword [ebp - 0x1414]
cmp eax, edi
je 0x10071b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1400]
cmp eax, edi
je 0x10071c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x1408], edi
je 0x10071d5
push dword [ebp - 0x1408]
call dword [fcn.01001010]
mov eax, dword [ebp - 0x1404]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007a04
leave
ret
Function at 0x10071ef
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1208
call fcn.01007dd0
mov eax, dword [0x100ae94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x11ec]
push esi
inc ebx
push eax
mov dword [ebp - 0x11f4], ebx
call fcn.01004673
test eax, eax
pop ecx
pop ecx
jne 0x10073ea
cmp dword [ebp + 0xc], ebx
jne 0x1007245
lea eax, [ebp - 0x11ec]
push eax
push esi
call fcn.010034e1
pop ecx
pop ecx
lea eax, [ebp - 0x11f8]
push eax
push 0x20019
push 0
lea eax, [esi + 0x618]
push eax
push edi
call dword [fcn.01001018]
test eax, eax
jne 0x10072aa
lea eax, [ebp - 0x1200]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x1208]
push eax
push 0
push 0x10015a4
push dword [ebp - 0x11f8]
mov dword [ebp - 0x1200], 0x50
call dword [fcn.01001014]
test eax, eax
mov dword [ebp - 0x11f0], eax
je 0x10072c6
push dword [ebp - 0x11f8]
call dword [fcn.01001010]
push esi
call fcn.01005b83
and dword [ebp - 0x11f4], 0
test eax, eax
mov dword [ebp - 0x11f0], eax
pop ecx
jne 0x10073e4
push 2
xor eax, eax
pop ebx
movzx ecx, word [eax + 0x1001a30]
mov word [ebp + eax - 0x25c], cx
add eax, ebx
test cx, cx
jne 0x10072cb
cmp dword [ebp - 0x11f4], 1
jne 0x1007310
lea eax, [ebp - 0x54]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x10072ef
sub eax, edx
lea edi, [ebp - 0x25c]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x1007303
jmp 0x1007337
lea eax, [esi + 0xc30]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x1007318
sub eax, edx
lea edi, [ebp - 0x25c]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x100732c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x25c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x100734f
lea eax, [ebp - 0x11fc]
push eax
push 0x1002708
lea eax, [ebp - 0x25c]
mov esi, 0x1001a2c
push eax
movsd dword es:[edi], dword [esi]
call dword [0x100b508]
test eax, eax
jl 0x10073c9
mov eax, dword [ebp - 0x11fc]
lea edx, [ebp - 0x1204]
push edx
xor edi, edi
inc edi
push edi
push 0x100a9cc
mov dword [ebp - 0x1204], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 0x11fc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jge 0x10073cf
cmp dword [ebp - 0x11f4], edi
jne 0x10073c5
push dword [ebp - 0x11f8]
call dword [fcn.01001010]
mov eax, esi
jmp 0x10073ea
mov dword [ebp - 0x11f0], eax
cmp dword [ebp - 0x11f4], 1
jne 0x10073e4
push dword [ebp - 0x11f8]
call dword [fcn.01001010]
mov eax, dword [ebp - 0x11f0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007a04
leave
ret
Function at 0x402a48
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043dc
test esi, esi
jne 0x402a7e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004044cc
jmp 0x402a9c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040295c
mov edi, eax
test esi, esi
je 0x402a9c
cmp dword [ebx], 0
je 0x402a9c
dec esi
jmp 0x402a85
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4034e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403580
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403560
xor eax, eax
push ebp
push 0x403559
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40359c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403560
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404260
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48804c], 0
je 0x4042c1
cmp word [0x488220], 0xd7b2
jne 0x404289
cmp dword [0x488228], 0
jbe 0x404289
mov eax, 0x48821c
call dword [0x488238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x485054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042e8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48501c], 0
jne 0x4042dd
push 0
push 0x485074
push 0x485054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret