joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f60a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
jne 0x1001f623
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001f696
mov ecx, esi
call fcn.1001f982
test al, al
je 0x1001f65e
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x1001f65e
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.1001f60a
jmp 0x1001f699
cmp dword [esi + 0xc], 1
jne 0x1001f673
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1001f673
xor eax, eax
jmp 0x1001f699
cmp dword [esi + 0xc], 0
jne 0x1001f691
mov ebx, 0x8000
cmp dword [ebp + 0xc], ebx
jbe 0x1001f691
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x1001f691
push ebx
jmp 0x1001f652
or eax, 0xffffffff
jmp 0x1001f699
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001fae3
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.100214e7
movzx eax, word [eax]
cmp eax, 0x2e
je 0x1001fb1e
cmp eax, 0x20
je 0x1001fb1e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1001fb51
push esi
call fcn.1001ff84
test al, al
jne 0x1001fb64
push 0x800
lea eax, [ebp - 0x1004]
push eax
push esi
call fcn.1002252e
test al, al
je 0x1001fb64
push 0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1001fb64
cmp byte [ebp + 0xc], 0
je 0x1001fb60
push dword [ebp + 0x10]
push esi
call fcn.100200fc
xor eax, eax
jmp 0x1001fb7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1001fb79
cmp eax, 3
je 0x1001fb79
xor eax, eax
inc eax
jmp 0x1001fb7c
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002f614
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001fee8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1004]
push 0x800
push ecx
push eax
call fcn.100218da
and dword [ebp - 0x1008], 0
lea eax, [ebp - 0x1014]
and dword [ebp - 0x100c], 0
lea ecx, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x100c]
push eax
movzx eax, word [ebp - 0x1004]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1001ff70
mov edx, dword [ebp - 0x1008]
cmp edx, dword [ebp - 0x1010]
ja 0x1001ff70
xor eax, eax
add eax, dword [ebp - 0x100c]
adc edx, 0
jmp 0x1001ff74
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f614
mov esp, ebp
pop ebp
ret 4
Function at 0x10020099
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100200e8
push 0x800
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.1002252e
test al, al
je 0x100200e8
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 4

Function at 0x100200fc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x10020156
push 0x800
lea eax, [ebp - 0x1004]
push eax
push esi
call fcn.1002252e
test al, al
je 0x10020156
push dword [ebp + 0xc]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 8
Function at 0x10020ac6
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1254
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x1254]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push eax
cmp esi, 0xffffffff
jne 0x10020b5f
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10020b88
push 0x800
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.1002252e
test al, al
je 0x10020b38
lea eax, [ebp - 0x1254]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10020b88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10020b52
cmp eax, 3
je 0x10020b52
cmp eax, 0x12
je 0x10020b52
xor eax, eax
inc eax
jmp 0x10020b54
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x10020c4d
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10020b7f
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [edi + 0x1044], al
cmp esi, 0xffffffff
je 0x10020c4d
push 0x800
push ebx
push edi
call fcn.100261b9
push 0x800
lea eax, [ebp - 0x1228]
push eax
push edi
call fcn.1002168c
mov ecx, dword [ebp - 0x1238]
xor eax, eax
add eax, dword [ebp - 0x1234]
mov dword [edi + 0x1000], eax
mov eax, dword [ebp - 0x1254]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [ebp - 0x1250]
mov dword [edi + 0x1028], eax
mov eax, dword [ebp - 0x124c]
mov dword [edi + 0x102c], eax
mov eax, dword [ebp - 0x1248]
mov dword [edi + 0x1030], eax
mov eax, dword [ebp - 0x1244]
mov dword [edi + 0x1034], eax
mov eax, dword [ebp - 0x1240]
mov dword [edi + 0x1038], eax
mov eax, dword [ebp - 0x123c]
mov dword [edi + 0x103c], eax
lea eax, [ebp - 0x1240]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.1002713b
lea eax, [ebp - 0x1250]
push eax
lea ecx, [edi + 0x1018]
call fcn.1002713b
lea eax, [ebp - 0x1248]
push eax
lea ecx, [edi + 0x1020]
call fcn.1002713b
and dword [edi + 0x1040], 0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100219e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp + 8]
push eax
push 1
push ebx
push str.SoftwareWinRARPaths
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x10021a33
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push str.AppData
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], bx
je 0x10021a42
push esi
call fcn.1001ff84
test al, al
jne 0x10021a5f
push dword [ebp + 0x10]
push edi
push esi
call fcn.1002194d
test al, al
jne 0x10021a5f
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.1002191e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002252e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1008], eax
cmp word [esi], ax
jne 0x10022561
xor al, al
jmp 0x100226e2
push ebx
push esi
call fcn.100217ce
mov ebx, esi
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x1002256f
sub ebx, ecx
push esi
sar ebx, 1
call fcn.100220ed
test al, al
je 0x10022604
push esi
call fcn.100217ce
test al, al
je 0x100225b4
lea eax, [ebx + 4]
cmp dword [ebp + 0x10], eax
jbe 0x100226df
push dword [ebp + 0x10]
push 0x100493e0
push edi
call fcn.100261b9
push dword [ebp + 0x10]
jmp 0x100226d4
push 0x5c
pop ecx
cmp word [esi], cx
jne 0x100226df
lea eax, [esi + 2]
mov dword [ebp - 0x1008], eax
cmp word [eax], cx
jne 0x100226df
mov esi, dword [ebp + 0x10]
lea eax, [ebx + 6]
cmp esi, eax
jbe 0x100226df
push esi
push 0x100493e0
push edi
call fcn.100261b9
push esi
push 0x100493ec
push edi
call fcn.1002621f
push esi
push dword [ebp - 0x1008]
jmp 0x100226d5
lea eax, [ebp - 0x1004]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x100226df
cmp eax, 0x7ff
ja 0x100226df
movzx eax, word [esi]
push eax
call fcn.100217a6
test al, al
je 0x10022669
lea eax, [ebx + 6]
mov ebx, dword [ebp + 0x10]
cmp ebx, eax
jbe 0x100226df
push ebx
push 0x100493e0
push edi
call fcn.100261b9
xor eax, eax
mov word [ebp - 0x1000], ax
lea eax, [ebp - 0x1004]
push ebx
push eax
push edi
call fcn.1002621f
jmp 0x100226d3
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.10021827
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1008]
jne 0x10022683
sub ecx, edx
lea eax, [ebx + 4]
mov ebx, dword [ebp + 0x10]
sar ecx, 1
add eax, ecx
cmp ebx, eax
jbe 0x100226df
push ebx
push 0x100493e0
push edi
call fcn.100261b9
push ebx
lea eax, [ebp - 0x1004]
push eax
push edi
call fcn.1002621f
cmp word [esi], 0x2e
jne 0x100226d3
movzx eax, word [esi + 2]
push eax
call fcn.100217a6
test al, al
je 0x100226d3
add esi, 4
push ebx
push esi
push edi
call fcn.1002621f
mov al, 1
jmp 0x100226e1
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002f614
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10024373
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 5
push eax
push dword [0x10058760]
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x420], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x10058760]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x10058760]
mov dword [ebp - 0x408], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
call fcn.10035426
mov esi, eax
pop ecx
test esi, esi
jne 0x100243e8
and dword [ebx], eax
jmp 0x10024530
push edi
push dword [ebp - 0x408]
push esi
call fcn.10032480
mov ecx, dword [ebp - 0x41c]
xor eax, eax
movzx edi, word [esi + 2]
add esp, 0xc
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x418]
call fcn.100242d9
mov dword [ebp - 0x414], 0x64
mov ebx, 0xffff
test al, al
je 0x10024477
mov ecx, esi
cmp edi, ebx
jne 0x1002444b
lea ecx, [esi + 8]
movsx eax, word [ecx + 0xe]
imul eax, dword [ebp - 0x40c]
cdq
idiv dword [ebp - 0x414]
mov word [ecx + 0xe], ax
movsx eax, word [ecx + 0x10]
imul eax, dword [ebp - 0x410]
cdq
idiv dword [ebp - 0x414]
mov word [ecx + 0x10], ax
xor ecx, ecx
cmp edi, ebx
push 2
sete cl
pop edi
lea ecx, [ecx*8 + 0x12]
add ecx, esi
cmp word [ecx], bx
jne 0x10024493
mov edx, edi
jmp 0x100244ab
mov edx, ecx
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, edi
cmp ax, word [ebp - 0x408]
jne 0x10024498
sub edx, ebx
sar edx, 1
inc edx
lea ebx, [ecx + edx*2]
mov eax, 0xffff
cmp word [ebx], ax
je 0x100244d2
mov edx, ebx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, edi
cmp ax, word [ebp - 0x408]
jne 0x100244bd
sub edx, ecx
sar edx, 1
lea edi, [edx + 1]
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x404]
push 0x200
push eax
push str.CAPTION
push dword [ebp - 0x418]
call fcn.1002426e
test al, al
lea eax, [ebp - 0x404]
jne 0x10024501
lea eax, [ebx + edi*2]
push eax
call fcn.1003543c
pop ecx
mov ecx, dword [ebp - 0x420]
push 0x64
mov dword [ecx], eax
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x1002452e
cmp dword [ebp - 0x410], eax
jne 0x1002452e
push esi
call fcn.10035421
xor eax, eax
pop ecx
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 8
Function at 0x100253db
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x10025409
push dword [ebp + 0x10]
push esi
push edi
call fcn.100261b9
lea eax, [ebp - 0x2008]
xor ebx, ebx
push eax
push 1
push ebx
push str.SoftwareWinRARGeneral
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100254e9
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10025432
sub ecx, edx
mov eax, 0x7ff
sar ecx, 1
sub eax, ecx
add eax, eax
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push str.LanguageFolder
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100254dd
mov word [ebp - 0x1004], ax
mov ebx, 0x800
push ebx
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
lea eax, [ebp - 0x1004]
push eax
call fcn.10021827
push ebx
push esi
call fcn.1002148a
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.1002621f
lea eax, [ebp - 0x1004]
push eax
call fcn.1001ff84
test al, al
je 0x100254dd
push dword [ebp + 0x10]
lea eax, [ebp - 0x1004]
push eax
push edi
call fcn.100261b9
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10025785
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1005cce0]
test eax, eax
jne 0x100257a0
mov ecx, 0x1005ccd8
call fcn.1002584b
mov eax, dword [0x1005cce0]
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ecx, esi
and ecx, 0xfffffff0
cmp byte [ebp + 0x14], dl
setne dl
cmp byte [ebp + 0x10], 0
je 0x100257ea
test eax, eax
je 0x10025805
push edx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x1002582a
push str.CryptProtectMemory_failed
mov esi, 0x100587e8
push esi
call fcn.1001ecbc
pop ecx
pop ecx
mov ecx, esi
call fcn.1001eef8
push 2
mov ecx, esi
call fcn.1001ee60
jmp 0x1002582a
mov eax, dword [0x1005cce4]
test eax, eax
je 0x10025805
push edx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x1002582a
push str.CryptUnprotectMemory_failed
jmp 0x100257cb
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ebx, eax
test esi, esi
je 0x10025829
push edi
mov edi, dword [ebp + 8]
add bl, 0x4b
lea ecx, [edx + edi]
lea eax, [edx + ebx]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x1002581b
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x10025889
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret 4
Function at 0x10025a03
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x128], edi
lea edx, [edi + 0x28]
mov eax, dword [edx]
lea edx, [edx + 4]
bswap eax
mov dword [ebp + ecx*4 - 0x104], eax
inc ecx
cmp ecx, 0x10
jb 0x10025a27
push 0x30
lea ebx, [ebp - 0xcc]
pop edi
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x10025a44
mov edi, dword [ebp - 0x128]
xor ebx, ebx
mov eax, dword [edi]
mov edx, eax
mov ecx, dword [edi + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x108], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x1c]
mov edi, dword [ebp - 0x120]
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x124], eax
mov esi, edi
ror edx, 0xd
ror esi, 0xb
mov eax, edi
rol eax, 7
mov ecx, edi
xor esi, eax
not ecx
and ecx, dword [ebp - 0x118]
mov eax, edi
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 0x114]
and eax, edi
xor ecx, eax
mov eax, dword [ebp - 0x118]
add esi, ecx
add esi, dword [ebx + 0x10049608]
add esi, dword [ebp + ebx - 0x104]
add ebx, 4
add esi, dword [ebp - 0x124]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x10c]
rol eax, 0xa
xor edx, eax
mov dword [ebp - 0x114], edi
mov eax, dword [ebp - 0x10c]
mov edi, dword [ebp - 0x11c]
ror eax, 2
add edi, esi
xor edx, eax
mov eax, dword [ebp - 0x110]
mov ecx, eax
and eax, dword [ebp - 0x108]
xor ecx, dword [ebp - 0x108]
and ecx, dword [ebp - 0x10c]
xor ecx, eax
mov eax, dword [ebp - 0x108]
add edx, ecx
mov ecx, dword [ebp - 0x110]
add edx, esi
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x10c], edx
cmp ebx, 0x100
jb 0x10025adb
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x120], edi
add eax, edx
mov edi, dword [ebp - 0x128]
add dword [edi + 4], ecx
mov ecx, dword [ebp - 0x110]
add dword [edi + 8], ecx
mov ecx, dword [ebp - 0x11c]
add dword [edi + 0xc], ecx
mov ecx, dword [ebp - 0x114]
add dword [edi + 0x14], ecx
mov ecx, dword [ebp - 0x118]
add dword [edi + 0x18], ecx
mov ecx, dword [ebp - 0x124]
add dword [edi + 0x1c], ecx
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
mov eax, dword [ebp - 0x120]
add dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 4
Function at 0x10027ddb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x804]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x400
push ecx
push eax
push edi
push esi
mov dword [ebp - 0x808], eax
call fcn.1002985a
test al, al
jne 0x10027e26
cmp byte [0x10054b95], al
sete al
jmp 0x10027e37
push 1
push ebx
lea eax, [ebp - 0x804]
push eax
call fcn.10028d81
mov al, 1
test al, al
je 0x10027e3f
xor eax, eax
jmp 0x10027e94
lea eax, [ebp - 0x80c]
push eax
push edi
push esi
call fcn.10029d4f
mov edi, eax
test edi, edi
je 0x10027e8c
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10027e5a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push esi
push dword [ebp - 0x808]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.10028d28
jmp 0x10027e92
mov esi, dword [ebp - 0x80c]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100281b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100294d4
test al, al
je 0x100281dd
mov eax, dword [ebp - 4]
jmp 0x1002822d
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002a029
mov edi, eax
mov dword [ebp + 0x14], 4
test edi, edi
je 0x1002822a
push ebx
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
neg ebx
push edi
sbb bl, bl
call fcn.10028d28
add bl, 1
pop ebx
je 0x1002822a
cmp dword [ebp + 0x14], 0
je 0x1002822a
mov esi, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10028254
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 0x1c]
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x18]
mov dword [ebp + 0x1c], edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100294ff
test al, al
je 0x10028281
mov eax, dword [ebp + 0x1c]
jmp 0x100282e7
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002a029
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x100282c4
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
mov esi, eax
call fcn.10028d28
test esi, esi
pop esi
jne 0x100282c4
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100282e7
cmp dword [ebp + 0x18], 0
push edi
je 0x100282d8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10032480
jmp 0x100282e2
push 0
push dword [ebp + 0x14]
call fcn.10032a00
add esp, 0xc
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1002838a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
push eax
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100295b2
test al, al
je 0x100283b8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
jmp 0x1002840e
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002a029
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x18], 8
test eax, eax
je 0x1002840a
push ebx
lea ecx, [ebp + 0x18]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
mov ebx, eax
neg ebx
sbb bl, bl
call fcn.10028d28
add bl, 1
pop ebx
je 0x1002840a
cmp dword [ebp + 0x18], 0
je 0x1002840a
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100284a3
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push ebx
push esi
call fcn.10028f44
test al, al
jne 0x1002851d
push 0x200
lea eax, [ebp - 0x404]
push eax
push ebx
push esi
call fcn.10029fc6
test al, al
je 0x1002851d
lea eax, [ebp - 0x408]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002851d
push edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x408]
call fcn.10028d28
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 0xc