joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a603
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
mov dword [ebp - 0x14], ecx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edx
push esi
push edi
test ecx, ecx
je 0x1003a71d
test eax, eax
je 0x1003a71d
cmp dword [ebp + 8], edx
je 0x1003a71d
mov edi, dword [ebp + 8]
xor eax, eax
push edx
push edx
push 0x10007808
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov esi, eax
test esi, esi
js 0x1003a722
push 0
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x10007814
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov esi, eax
test esi, esi
js 0x1003a70c
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov esi, edi
neg esi
sbb esi, esi
and esi, 0x3fffffe9
add esi, 0xc0000017
js 0x1003a70c
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
js 0x1003a6f8
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
js 0x1003a6ef
push 0
push 0x14
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
test edi, edi
je 0x1003a70c
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
test esi, esi
jns 0x1003a730
jmp 0x1003a722
mov esi, 0xc000000d
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
not esi
shr esi, 0x1f
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1003f9e9
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
and dword [esp + 4], 0
lea eax, [esp + 4]
and dword [esp + 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push eax
push dword [ebx]
mov esi, edx
mov edi, ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1003fa69
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003fa31
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1003fa4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003fa51
movzx esi, si
or esi, 0x80070000
jmp 0x1003fa4f
mov esi, 0x80004005
test esi, esi
jns 0x1003fa65
push esi
push 0x1b3
mov ecx, 0x10007fa0
call fcn.1003a254
jmp 0x1003fa86
mov esi, dword [esp + 0xc]
test edi, edi
je 0x1003fa81
push dword [ebp + 0x10]
mov edx, esi
mov ecx, edi
push ebx
push dword [ebp + 8]
call fcn.1003f904
mov esi, eax
jmp 0x1003fa86
mov esi, 0x80070057
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003fd46
Capabilities:
Delete file
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov eax, ecx
mov dword [ebp - 0xc], edx
xor edi, edi
mov dword [ebp - 0x14], eax
xor esi, esi
inc edi
mov dword [ebp - 0x10], esi
call fcn.100371cd
and dword [ebp - 8], esi
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1003fd7d
test byte [eax + 0x10], 0x10
je 0x1003fd7d
mov esi, edi
mov dword [ebp - 0x10], edi
lea eax, [ebp - 8]
push eax
lea eax, [esi + esi]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
mov esi, eax
test esi, esi
jne 0x1003fe37
cmp dword [ebp - 8], eax
je 0x1003fe37
push esi
push 0x8000100
push 2
push esi
push esi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1003fe22
push dword [ebp - 8]
mov dword [ebp - 0x1c], esi
push eax
push 0x1003fd00
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_ReadEncryptedFileRaw]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1003fe2a
mov eax, dword [ebp + 8]
xor ecx, ecx
push ecx
add eax, 0x14
mov edx, ebx
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.10038413
test eax, eax
je 0x1003fe22
cmp dword [ebp - 0x10], esi
jne 0x1003fe2c
mov eax, dword [ebp + 8]
push dword [eax + 0x2c]
push dword [eax + 0x28]
push dword [ebp - 0x14]
call fcn.1001bd30
jmp 0x1003fe2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
jmp 0x1003fe39
xor edi, edi
test ebx, ebx
je 0x1003fe54
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x1003fe5f
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10040001
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x1000815c
mov dword [ebp - 0x228], edx
lea edi, [ebp - 0x10]
mov dword [ebp - 0x224], ecx
xor ebx, ebx
lea eax, [ebp - 0x218]
push 0x208
movsd dword es:[edi], dword [esi]
push ebx
push eax
mov dword [ebp - 0x220], ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x224]
add esp, 0xc
mov dword [ebp - 0x21c], ebx
test esi, esi
je 0x100400ce
cmp esi, 0xffffffff
je 0x100400ce
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x100400ce
push eax
lea eax, [ebp - 0x10]
mov edi, 0x104
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x21c]
mov edx, edi
lea ecx, [ebp - 0x218]
push eax
call fcn.10015a63
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x220]
push ebx
mov dword [ebp - 0x220], eax
add eax, eax
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100400d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100400d1
push 0x57
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret

Function at 0x100400f0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x10008168
mov dword [ebp - 0x228], edx
lea edi, [ebp - 0x10]
mov dword [ebp - 0x224], ecx
xor ebx, ebx
lea eax, [ebp - 0x218]
push 0x208
movsd dword es:[edi], dword [esi]
push ebx
push eax
mov dword [ebp - 0x220], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x224]
add esp, 0xc
mov dword [ebp - 0x21c], ebx
test esi, esi
je 0x100401bc
cmp esi, 0xffffffff
je 0x100401bc
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x100401bc
push eax
lea eax, [ebp - 0x10]
mov edi, 0x104
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x21c]
mov edx, edi
lea ecx, [ebp - 0x218]
push eax
call fcn.10015a63
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x220]
push ebx
mov dword [ebp - 0x220], eax
add eax, eax
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100401bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100401bf
push 0x57
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret
Function at 0x100401de
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 6
mov dword [ebp - 0x230], eax
lea edi, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
pop ecx
mov dword [ebp - 0x234], eax
mov esi, 0x10008174
mov eax, dword [ebp + 0x10]
push 0x208
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x224]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x22c], ebx
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x230]
add esp, 0xc
mov dword [ebp - 0x228], ebx
test esi, esi
je 0x100402c7
cmp esi, 0xffffffff
je 0x100402c7
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x100402c7
mov ecx, dword [ebp - 0x238]
test ecx, ecx
je 0x100402c7
push eax
push ecx
push eax
lea eax, [ebp - 0x1c]
mov edi, 0x104
push eax
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.1001fec9
add esp, 0x18
lea eax, [ebp - 0x228]
mov edx, edi
lea ecx, [ebp - 0x224]
push eax
call fcn.10015a63
mov eax, dword [ebp - 0x228]
lea ecx, [ebp - 0x22c]
push ebx
mov dword [ebp - 0x22c], eax
add eax, eax
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100402ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100402ca
push 0x57
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100402eb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
push edi
mov edi, edx
test ecx, ecx
je 0x10040437
test edi, edi
je 0x10040437
lea eax, [ebp - 0x418]
push eax
push 0x20019
push ebx
push 0x10008190
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10040340
push eax
jmp 0x10040439
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1004033a
cmp dword [ebp - 0x41c], ebx
je 0x1004033a
mov edx, 0x10008204
mov ecx, edi
call fcn.10040001
test eax, eax
je 0x1004043f
mov esi, ebx
cmp dword [ebp - 0x41c], ebx
jbe 0x10040429
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x424], 0x104
push ebx
push eax
mov dword [ebp - 0x420], 0x208
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1004033a
cmp dword [ebp - 0x428], 1
jne 0x1004041c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.100401de
test eax, eax
je 0x1004043f
inc esi
cmp esi, dword [ebp - 0x41c]
jb 0x1004038b
mov edx, 0x10008204
mov ecx, edi
call fcn.100400f0
jmp 0x1004043f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x418], 0
pop edi
pop esi
pop ebx
je 0x10040457
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.10083b20
mov esp, ebp
pop ebp
ret
Function at 0x10040470
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x42c], edx
lea eax, [ebp - 0x20c]
mov esi, ecx
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x418], edi
mov edx, 0x104
mov dword [ebp - 0x41c], edi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x428], edi
mov ebx, edi
push 0x10008220
call fcn.10015ac7
lea eax, [ebp - 0x418]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004060a
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x420], 0x104
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
inc edi
test esi, esi
jne 0x100405f2
lea eax, [ebp - 0x414]
push eax
push 0x1000806c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1001fec9
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x100405f2
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0x100082a8
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x100405e6
mov ebx, dword [ebp - 0x42c]
push 0x208
push eax
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
mov edx, 0x104
mov ecx, ebx
push eax
call fcn.10015ac7
xor ebx, ebx
inc ebx
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x10040508
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 4
Function at 0x1004061f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov ebx, edx
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], edi
mov edx, 0x104
mov dword [ebp - 0x210], edi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
push 0x100082d0
call fcn.10015ac7
lea eax, [ebp - 0x210]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100406ee
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push edi
push 0x10008318
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100406ee
push 0x10
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 4
mov edx, ebx
mov ecx, eax
call fcn.10083557
test eax, eax
je 0x100406ee
inc edi
cmp dword [ebp - 0x210], 0
je 0x10040703
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 4

Function at 0x10040718
Capabilities:
Write file on windows

Disassembly:
push 0x74
push 0x10084f80
call fcn.10083d38
mov eax, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x6c], 1
push 0x13
pop ecx
mov esi, 0x10008338
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x78], ebx
cmp dword [ebp - 0x80], ebx
je 0x10040850
test eax, eax
je 0x10040850
test edx, edx
je 0x10040850
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10040850
mov dword [ebp - 4], edi
mov dword [ebp - 0x7c], edi
lea ecx, [ebp - 0x7c]
push ecx
mov edx, 0x104
mov ecx, eax
call fcn.10015a63
test eax, eax
jns 0x10040795
mov esi, edi
jmp 0x10040816
mov eax, dword [ebp - 0x7c]
add eax, 0x27
add esi, eax
lea eax, [esi + esi]
mov dword [ebp - 0x74], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x78], ebx
test ebx, ebx
je 0x1004078e
push dword [ebp - 0x84]
push dword [ebp - 0x70]
lea eax, [ebp - 0x68]
push eax
push esi
push ebx
call fcn.1001fec9
add esp, 0x14
test eax, eax
js 0x1004078e
lea eax, [ebp - 0x70]
push eax
mov edx, esi
mov ecx, ebx
call fcn.10015a63
test eax, eax
js 0x1004078e
mov dword [ebp - 0x74], edi
mov eax, dword [ebp - 0x70]
add eax, eax
mov dword [ebp - 0x70], eax
push edi
lea ecx, [ebp - 0x74]
push ecx
push eax
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004078e
mov esi, dword [ebp - 0x74]
sub esi, dword [ebp - 0x70]
neg esi
sbb esi, esi
not esi
and esi, 1
mov dword [ebp - 0x6c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.10040831
mov eax, esi
jmp 0x10040852
xor eax, eax
call fcn.10083d80
ret 8
Function at 0x1004085a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x444
push 0x10084fa0
call fcn.10083d38
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x440], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x448], eax
xor esi, esi
inc esi
mov dword [ebp - 0x434], esi
xor edi, edi
mov dword [ebp - 0x43c], edi
push 0x208
push edi
lea eax, [ebp - 0x430]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, edi
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x450], edi
mov edx, dword [ebp - 0x448]
test edx, edx
je 0x10040ac3
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x10040ac3
cmp eax, 0xffffffff
je 0x10040ac3
mov eax, dword [ebp - 0x440]
test eax, eax
je 0x10040ac3
lea ecx, [ebp - 0x43c]
push ecx
push esi
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10040ac3
mov dword [ebp - 4], edi
push 0x10008384
mov edx, 0x104
lea ecx, [ebp - 0x430]
call fcn.10015ac7
test eax, eax
js 0x10040a77
mov eax, edi
mov dword [ebp - 0x444], eax
cmp eax, 2
jge 0x10040a38
mov dword [ebp - 0x440], 0x208
push 0x20a
push edi
lea eax, [ebp - 0x228]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x450]
push eax
push edi
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10040a38
push 0xffffffffffffffff
push 0x100051e8
push 0xffffffffffffffff
lea eax, [ebp - 0x228]
push eax
push esi
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
je 0x10040a38
test ebx, ebx
jne 0x10040a0e
push 0x208
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x438], ebx
test ebx, ebx
jne 0x100409d0
mov esi, edi
jmp 0x10040a71
lea eax, [ebp - 0x228]
push eax
mov edx, 0x104
mov ecx, ebx
call fcn.10015ac7
test eax, eax
js 0x100409c9
lea eax, [ebp - 0x228]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x430]
call fcn.10015ac7
test eax, eax
js 0x100409c9
mov eax, dword [ebp - 0x444]
inc eax
jmp 0x10040920
push 0x100083a4
mov edx, 0x104
mov ecx, ebx
call fcn.1001a5bc
test eax, eax
js 0x100409c9
lea eax, [ebp - 0x228]
push eax
mov edx, 0x104
mov ecx, ebx
call fcn.1001a5bc
jmp 0x100409e3
test ebx, ebx
je 0x10040a77
lea eax, [ebp - 0x454]
push eax
mov edx, 0x104
mov ecx, ebx
call fcn.10015a63
test eax, eax
js 0x100409c9
push dword [ebp - 0x454]
push ebx
mov edx, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x44c]
call fcn.10040718
mov esi, eax
mov dword [ebp - 0x434], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.10040a95
mov eax, esi
jmp 0x10040ac5
xor eax, eax
call fcn.10083d80
ret 4
Function at 0x10040acd
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x280
push 0x10084fc0
call fcn.10083d38
mov eax, edx
mov dword [ebp - 0x278], eax
mov esi, ecx
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x288], eax
push 0x208
xor edi, edi
push edi
lea eax, [ebp - 0x264]
push eax
call sub.msvcrt.dll_memset
push 0x40
pop eax
mov dword [ebp - 0x270], eax
push eax
push edi
lea eax, [ebp - 0x5c]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x26c], edi
mov ebx, edi
mov dword [ebp - 0x27c], ebx
push 0x100083a8
mov edx, 0x104
lea ecx, [ebp - 0x264]
call fcn.10015ac7
lea eax, [ebp - 0x26c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10040b75
xor eax, eax
jmp 0x10040bfd
mov dword [ebp - 4], edi
mov dword [ebp - 0x284], 0x40
push 0x80
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x268], esi
test esi, esi
je 0x10040be9
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x280], eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x280]
push eax
push esi
push dword [ebp - 0x274]
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
sub eax, edi
je 0x10040c68
sub eax, 0xea
je 0x10040c05
sub eax, 0x19
jne 0x10040be9
xor ebx, ebx
inc ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x278]
call fcn.10040ced
mov eax, ebx
call fcn.10083d80
ret 0xc
mov eax, dword [ebp - 0x270]
add eax, eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x284], eax
add eax, eax
push eax
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
jne 0x10040c5b
test esi, esi
je 0x10040c51
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, esi
mov dword [ebp - 0x268], eax
mov esi, edi
mov dword [ebp - 0x268], esi
jmp 0x10040be9
mov esi, eax
mov dword [ebp - 0x268], esi
jmp 0x10040ba2
push esi
push 0x10008780
push dword [ebp - 0x278]
call fcn.100401de
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x290], eax
push esi
mov edx, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x26c]
call fcn.1004085a
xor eax, eax
cmp ax, word [ebp - 0x5c]
je 0x10040cc8
push 0xffffffffffffffff
push dword [ebp - 0x288]
push 0xffffffffffffffff
push esi
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
jne 0x10040ba2
push esi
push 0x20
pop edx
lea ecx, [ebp - 0x5c]
call fcn.10015ac7
jmp 0x10040ba2