joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100407c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x100407e2
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x44], eax
mov eax, dword [esi + 0x70]
push 1
add eax, 4
push eax
call fcn.10076dc3
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [esi + 6], cl
cmp dword [eax + 0x58], 0
je 0x10040804
push ecx
push esi
call fcn.10040940
mov eax, dword [esi + 0x10]
push esi
mov eax, dword [eax + 0x58]
call eax
add esp, 0xc
push 1
call fcn.1008af82
int3

Function at 0x10043820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.100386c0
add esp, 4
sub eax, esi
je 0x10043880
mov edi, dword [ebp + 0x10]
dec eax
push edi
push ebx
mov dword [ebp - 8], eax
call fcn.10039520
add esp, 8
cmp eax, 3
jne 0x100438a2
test esi, esi
je 0x10043876
push edi
push ebx
call fcn.10039420
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.10039690
add esp, 0x10
test eax, eax
jg 0x100438ca
xor esi, esi
mov eax, dword [ebp - 8]
inc edi
test eax, eax
jne 0x10043841
call fcn.10079997
mov edi, dword [eax]
test esi, esi
je 0x100438d1
push 1
push ebx
call fcn.10038aa0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.10039ab0
add esp, 0xc
test esi, esi
je 0x10043876
push dword [ebp + 0xc]
push dword [ebp - 4]
push 1
push eax
call fcn.1008bc9e
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x10043876
mov esi, 1
jmp 0x10043878
push ebx
call fcn.10038c20
push edi
call fcn.10089ac2
push eax
push 0x100b2908
push ebx
call fcn.10038b60
push edi
push ebx
call fcn.10038b90
add esp, 0x1c
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10043d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
mov dword [ebp - 0x218], ebx
call fcn.10039960
mov edi, dword [ebp + 0x10]
add esp, 8
mov ebx, dword [ebp - 0x214]
mov esi, 0x200
nop word [eax + eax]
lea eax, [ebp - 0x210]
push eax
call fcn.1003a6c0
cmp esi, edi
mov ecx, edi
push ebx
cmovbe ecx, esi
mov esi, ecx
push esi
push 1
push eax
call fcn.1008957a
add dword [ebp - 0x210], eax
add esp, 0x14
sub edi, eax
je 0x10043d80
cmp eax, esi
je 0x10043d50
lea eax, [ebp - 0x210]
push eax
call fcn.1003a700
mov ebx, dword [ebp - 0x218]
add esp, 4
test edi, edi
je 0x10043db9
push 0xffffffffffffffff
push ebx
call fcn.100389c0
add esp, 8
test eax, eax
jne 0x10043db9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a60c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006a60c
mov esp, ebp
pop ebp
ret
Function at 0x100515d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.10076570
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.10076570
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10051633
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x10051638
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x10051656
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x10051658
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x1005166c
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x100dd794]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1006a60c
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100560b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac78a
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 1
call fcn.10002a80
mov ecx, eax
test ecx, ecx
je 0x100561d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push 0
push eax
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 0x224], 1
call fcn.10076570
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10056193
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10056175
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10002680
mov edi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100561b2
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a60c
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10001670
int3
Function at 0x10057460
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac98e
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x100db3fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
cmp dword [esi + 4], 0
mov dword [ebp - 4], 0
je 0x100574b7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x38]
mov dword [esi + 8], 0
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
call fcn.10057210
push esi
push 0
push esi
push 0x10057700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x10057556
call fcn.1005d530
test eax, eax
je 0x1005754f
call fcn.1005d530
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x1005754f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1005d530
lea ecx, [ebp - 0xd0]
mov ebx, eax
call fcn.100064c0
mov esi, eax
push str.CWorkThread::Start__CreateThread_failed__errno
push esi
mov byte [ebp - 4], 1
call fcn.10007110
add esp, 8
mov ecx, esi
push edi
call fcn.10023360
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0xd0]
call fcn.100071d0
xor edi, edi
jmp 0x100575f2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 8], 0
mov dword [ebp - 0x10], eax
jne 0x100575ed
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jae 0x10057585
push 0xa
call ebx
cmp dword [esi + 8], 0
je 0x10057571
cmp dword [esi + 8], 0
jne 0x100575ed
call fcn.1005d530
test eax, eax
je 0x1005754f
call fcn.1005d530
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x1005754f
call fcn.1005d530
lea ecx, [ebp - 0x168]
mov edi, eax
call fcn.100064c0
mov esi, eax
push str.CWorkThread::Start__wait_thread_running_timeout_
push esi
mov byte [ebp - 4], 2
call fcn.10007110
add esp, 8
mov ecx, esi
push dword [ebp + 8]
call fcn.10019390
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x168]
call fcn.100071d0
xor edi, edi
jmp 0x100575f2
mov edi, 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1005760a
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d930
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acf0b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x1005d96b
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.100936c3
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x1005da3c
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.10076570
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.1005c700
push 0x100b7924
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push esi
push str.open
push eax
call fcn.1000d070
add esp, 8
push eax
call fcn.1000d070
add esp, 8
push eax
call fcn.1000d070
add esp, 8
mov ecx, eax
call fcn.10019390
push eax
call fcn.1000d070
add esp, 8
lea eax, [ebp - 0xc4]
lea ecx, [ebp - 0xa8]
push eax
call fcn.1005da80
cmp dword [eax + 0x14], 8
jb 0x1005da1f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xc4]
call fcn.10006cd0
lea ecx, [ebp - 0xa8]
call fcn.100071d0
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x1005da55
push 2
push 0
push eax
call fcn.10093bf1
add esp, 0xc
mov dword [edi + 4], eax
jmp 0x1005da5c
mov dword [edi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a60c
mov esp, ebp
pop ebp
ret
Function at 0x1005ddc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad008
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
cmp eax, 2
je 0x1005dfa2
cmp eax, 1
jne 0x1005dfba
cmp byte [edi + 8], 0
je 0x1005de16
call fcn.1005d930
mov byte [edi + 8], 0
cmp dword [edi + 4], 0x40000000
jle 0x1005de52
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x1005de37
push eax
call fcn.1009378d
add esp, 4
mov dword [edi + 0x24], 0xffffffff
cmp dword [edi + 0x20], 8
lea eax, [edi + 0xc]
jb 0x1005de42
mov eax, dword [eax]
push eax
call fcn.10092c78
add esp, 4
mov ecx, edi
call fcn.1005d930
cmp dword [edi + 0x28], 0
jne 0x1005deed
push 0
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.1005db40
add esp, 0xc
push 2
push 0x100b795c
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1000aac0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [edi + 0x24]
cmovae eax, dword [ebp - 0x48]
cmp ecx, 0xffffffff
je 0x1005ded2
push dword [ebp - 0x38]
push eax
push ecx
call fcn.100941c2
add esp, 0xc
jmp 0x1005ded5
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2c], eax
call fcn.10005640
lea ecx, [ebp - 0x60]
call fcn.10005640
jmp 0x1005df96
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.1005db40
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea ecx, [edi + 0x2c]
push ecx
push eax
call fcn.100692a0
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.10005640
test esi, esi
jne 0x1005df48
push 0xd
push str.write_failed.
lea ecx, [ebp - 0x28]
call fcn.10018230
push 0x100b795c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1005bfc0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x1005df68
mov eax, dword [eax]
mov ecx, dword [edi + 0x24]
cmp ecx, 0xffffffff
je 0x1005df7d
push edx
push eax
push ecx
call fcn.100941c2
add esp, 0xc
jmp 0x1005df80
or eax, 0xffffffff
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x2c], eax
call fcn.10005640
lea ecx, [ebp - 0x28]
call fcn.10005640
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x1005dfa2
add dword [edi + 4], eax
jmp 0x1005dfba
cmp dword [esi + 0x14], 8
jb 0x1005dfaa
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x100b1f00
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a60c
mov esp, ebp
pop ebp
ret 4
Function at 0x1005ea80
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x1005ec48
test eax, eax
je 0x1005ec48
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x1005ec48
push ecx
push ebx
push eax
call fcn.10076570
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x1005ec48
cmp edi, 0xffffffff
je 0x1005ec41
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10011300
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1005ec41
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x1005ebd7
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x1005ec41
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x1005ebd7
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x1005eb70
cmp edi, esi
jae 0x1005ebd7
nop
sub esi, edi
sbb ecx, eax
js 0x1005eb85
jg 0x1005eb80
cmp esi, 0x400000
jb 0x1005eb85
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x1005ebd7
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10011350
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1005ebcb
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x1005eb70
jg 0x1005ebd7
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x1005eb70
lea eax, [ebp - 0x6c]
push eax
call fcn.100111f0
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push 3
push edi
call fcn.1001d020
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x1005ebf0
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.10094788
add esp, 8
mov esi, 1
test ebx, ebx
je 0x1005ec2d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x1005ec3b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006a60c
mov esp, ebp
pop ebp
ret
Function at 0x1005f290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad19e
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
call fcn.100029d0
mov ecx, eax
test ecx, ecx
je 0x1005f4e4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 1
call fcn.10056570
add esp, 4
lea ecx, [ebp - 0x224]
mov esi, eax
push dword [esi + 0xc]
call fcn.10003600
mov dword [ebp - 4], 1
call fcn.100029d0
mov ecx, eax
test ecx, ecx
je 0x1005f4ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push str.InstallDate
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.10003540
test al, al
jne 0x1005f36c
push 0xb
push str.InstallDate
lea ecx, [ebp - 0x21c]
call fcn.10002680
cmp dword [esi], 2
mov byte [ebp - 4], 3
jne 0x1005f387
push 4
push str.Date
lea ecx, [ebp - 0x21c]
call fcn.10002680
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
push 0x20219
push dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10008890
mov esi, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x238]
test eax, eax
jne 0x1005f47e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10076570
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005f47e
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x1005f42b
cmp eax, 2
jne 0x1005f47e
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x1005f448
test al, 1
jne 0x1005f47e
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x1005f451
jmp 0x1005f47e
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005f460
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10002680
test edi, edi
je 0x1005f489
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005f4a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1005f4c6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a60c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001670
push 0x80004005
call fcn.10001670
int3
Function at 0x1005fa90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad19e
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100db3fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
call fcn.100029d0
mov ecx, eax
test ecx, ecx
je 0x1005fcc4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 1
call fcn.10056570
add esp, 4
lea ecx, [ebp - 0x224]
mov eax, dword [eax + 0xc]
push eax
call fcn.10003600
mov dword [ebp - 4], 1
call fcn.100029d0
mov ecx, eax
test ecx, ecx
je 0x1005fcce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x100b7c44
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.10003540
test al, al
jne 0x1005fb6b
push 3
push 0x100b7c44
lea ecx, [ebp - 0x21c]
call fcn.10002680
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
push 0x20219
push dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10008890
mov esi, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x238]
test eax, eax
jne 0x1005fc5e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10076570
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005fc5e
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x1005fc0f
cmp eax, 2
jne 0x1005fc5e
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x1005fc2c
test al, 1
jne 0x1005fc5e
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x1005fc35
jmp 0x1005fc5e
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005fc40
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10002680
test edi, edi
je 0x1005fc69
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005fc87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1005fca6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a60c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001670
push 0x80004005
call fcn.10001670
int3