joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105aaf2
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0xc]
push 1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
push 0x7a
push 0x100f8c8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x34], eax
call fcn.01055826
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
xor esi, esi
stosw word es:[edi], ax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x60], 0x10
mov dword [ebp - 0x28], esi
mov eax, 0x83
cmp ebx, esi
jne 0x105ab65
mov dword [ebp - 0x58], 0x80070057
mov word [ebp - 0x52], ax
jmp 0x105ac19
mov word [ebp - 0x54], ax
mov eax, 0x84
cmp dword [ebp - 0x30], esi
je 0x105ab55
mov word [ebp - 0x54], ax
cmp dword [ebp - 0x34], esi
jne 0x105ab7f
inc eax
jmp 0x105ab55
mov eax, 0x86
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x2c]
push eax
push 0x100f8b8
push esi
push 0x100d7d4
push esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
mov dword [ebp - 0x58], eax
cmp eax, esi
mov eax, 0x88
jl 0x105ab5c
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x105abd2
call fcn.0105d3b8
mov dword [ebp - 0x58], eax
mov eax, 0x8a
jmp 0x105ab5c
lea edx, [ebp - 0x28]
push edx
push 0x20000002
push dword [ebp - 0x5c]
mov eax, 0x8a
mov word [ebp - 0x54], ax
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x58], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x105ac50
mov edx, dword [ebp - 0x28]
mov ecx, ebx
call fcn.0106470b
mov dword [ebp - 0x58], eax
cmp eax, esi
mov eax, 0x90
jl 0x105ab5c
mov word [ebp - 0x54], ax
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x28], esi
cmp eax, esi
je 0x105ac35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x58]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0x10
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
mov ecx, ebx
test eax, eax
je 0x105ac84
mov edx, dword [ebp - 0x30]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x34]
call fcn.01064650
mov dword [ebp - 0x58], eax
cmp eax, esi
mov eax, 0x97
jmp 0x105ac0f
mov edx, dword [ebp - 0x34]
call fcn.0106470b
mov dword [ebp - 0x58], eax
cmp eax, esi
mov eax, 0x9b
jmp 0x105ac0f
Function at 0x105bdc5
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 1
push 0x24f
push 0x100f930
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x210], eax
call fcn.01055826
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
mov dword [ebp - 0x214], 0x104
cmp eax, ebx
je 0x105be3c
push 0x20
pop ecx
mov byte [eax], bl
inc eax
dec ecx
jne 0x105be36
mov eax, 0x257
cmp dword [ebp - 0x210], ebx
jne 0x105be5f
mov dword [ebp - 0x238], 0x80070057
mov word [ebp - 0x232], ax
jmp 0x105bf3a
mov word [ebp - 0x234], ax
cmp esi, ebx
jne 0x105be71
mov eax, 0x258
jmp 0x105be49
mov eax, 0x259
mov dword [ebp - 0x238], ebx
mov word [ebp - 0x234], ax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [esi]
mov dword [ebp - 0x214], 0x104
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [esi]
cmp eax, 0x103
je 0x105bf5e
cmp eax, ebx
jle 0x105bec8
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x238], eax
cmp eax, ebx
mov eax, 0x268
jl 0x105be53
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.0105b1d8
mov dword [ebp - 0x238], eax
cmp eax, ebx
mov eax, 0x26c
jl 0x105be53
cmp dword [ebp - 0x238], 1
mov word [ebp - 0x234], ax
je 0x105be83
mov dword [ebp - 0x238], ebx
add eax, 4
mov word [ebp - 0x234], ax
mov esi, dword [ebp - 0x238]
lea ecx, [ebp - 0x238]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0xc
mov dword [ebp - 0x238], 1
mov eax, 0x266
jmp 0x105bf33
Function at 0x105c122
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push 0x3b2
push 0x100f9ac
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x238], edi
call fcn.01055826
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
xor ebx, ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], esi
cmp edi, esi
je 0x105c20f
mov ecx, edi
call fcn.010635d7
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, 0x3bb
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x62
mov dword [ebp - 0x234], esi
call edi
cmp eax, esi
jge 0x105c1ec
cmp eax, 0xc0000023
je 0x105c1ec
cmp eax, 0x80000005
je 0x105c1ec
cmp eax, 0xc0000004
je 0x105c1ec
mov ecx, eax
call fcn.0105d4af
mov dword [ebp - 0x234], eax
cmp eax, esi
mov eax, 0x3c7
jl 0x105c21e
mov word [ebp - 0x230], ax
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ebx, eax
mov eax, 0x3d0
cmp ebx, esi
jne 0x105c22a
mov dword [ebp - 0x234], 0x8007000e
jmp 0x105c21e
mov dword [ebp - 0x234], 0x80070057
mov eax, 0x3bb
mov word [ebp - 0x22e], ax
jmp 0x105c303
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x234], esi
push ebx
push 0x62
call edi
mov ecx, eax
call fcn.0105d4af
mov dword [ebp - 0x234], eax
cmp eax, esi
mov eax, 0x3d5
jl 0x105c21e
mov word [ebp - 0x230], ax
movzx eax, word [ebx]
inc eax
inc eax
cmp eax, 0x208
jbe 0x105c292
mov ecx, 0xc0000023
call fcn.0105d4af
mov dword [ebp - 0x234], eax
cmp eax, esi
mov eax, 0x3d9
jl 0x105c21e
mov word [ebp - 0x230], ax
movzx eax, word [ebx]
shr eax, 1
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0105598d
mov dword [ebp - 0x234], eax
cmp eax, esi
mov eax, 0x3de
jl 0x105c21e
mov ecx, dword [ebp - 0x238]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov word [ebp - 0x230], ax
push 0x1001814
lea eax, [ebp - 0x20c]
push eax
mov edx, 0x100f4e0
call fcn.01064650
mov dword [ebp - 0x234], eax
cmp eax, esi
mov eax, 0x3e5
jl 0x105c21e
mov word [ebp - 0x230], ax
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 4
Function at 0x105c333
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x1075318]
mov esi, 0x1075318
cmp eax, esi
je 0x105c36f
test dword [eax + 0x1c], 0x20000000
je 0x105c36f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100f984
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105bf74
push 1
push 0x35
push 0x100fa08
lea ecx, [ebp - 0x2c]
call fcn.01055826
xor edi, edi
push 0x40
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
pop eax
cmp dword [ebp + 8], edi
jne 0x105c3a0
mov dword [ebp - 0x2c], 0x80070057
mov word [ebp - 0x26], ax
jmp 0x105c517
mov word [ebp - 0x28], ax
mov eax, dword [ebp + 0xc]
push 0x41
cmp eax, edi
jne 0x105c3b0
pop eax
jmp 0x105c390
pop ecx
mov word [ebp - 0x28], cx
push 0x42
cmp dword [ebp + 0x10], edi
jbe 0x105c3ad
pop ecx
mov word [ebp - 0x28], cx
xor ecx, ecx
mov dword [ebp - 0x2c], edi
mov word [eax], cx
mov dword [ebp - 4], 0x105
push ebx
mov eax, dword [ebp - 4]
add eax, eax
push eax
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov ebx, eax
push 0x4d
mov dword [ebp - 8], ebx
pop eax
cmp ebx, edi
je 0x105c440
mov word [ebp - 0x28], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x2c], edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp eax, edi
jne 0x105c48e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x105c41e
cmp eax, 0xea
jne 0x105c420
xor eax, eax
cmp eax, edi
jle 0x105c42e
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, edi
push 0x57
mov dword [ebp - 0x2c], ecx
pop eax
jl 0x105c450
mov word [ebp - 0x28], ax
jmp 0x105c3d1
mov dword [ebp - 0x2c], 0x8007000e
mov word [ebp - 0x26], ax
jmp 0x105c516
mov word [ebp - 0x26], ax
mov eax, dword [0x1075318]
cmp eax, esi
je 0x105c516
test dword [eax + 0x1c], 0x2000000
je 0x105c516
push ecx
push dword [ebp + 8]
push 0x100f6e4
push 0x100f984
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101707f
jmp 0x105c516
or edi, 0xffffffff
cmp word [ebx], 0
mov ecx, ebx
je 0x105c4c3
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x105c49e
sub eax, esi
sar eax, 1
cmp eax, edi
jae 0x105c4b4
mov edi, eax
mov ebx, ecx
lea ecx, [ecx + eax*2 + 2]
cmp word [ecx], 0
jne 0x105c499
mov esi, 0x1075318
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01017627
push 0x70
mov dword [ebp - 0x2c], eax
test eax, eax
pop eax
jge 0x105c512
mov word [ebp - 0x26], ax
mov eax, dword [0x1075318]
cmp eax, esi
je 0x105c516
test dword [eax + 0x1c], 0x2000000
je 0x105c516
push dword [ebp - 0x2c]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push 0x100f9c8
push 0x100f984
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105c01f
jmp 0x105c516
mov word [ebp - 0x28], ax
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x105c538
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 1
push 0xa7
push 0x100fa24
lea ecx, [ebp - 0x30]
call fcn.01055826
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xc], 0x1010420
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x105c56f
mov dword [edi], ebx
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x105c578
mov dword [esi], ebx
mov edx, dword [ebp + 8]
mov eax, 0xad
cmp edx, ebx
jne 0x105c594
mov dword [ebp - 0x30], 0x80070057
mov word [ebp - 0x2a], ax
jmp 0x105c61e
mov word [ebp - 0x2c], ax
mov eax, 0xae
cmp edi, ebx
je 0x105c584
mov word [ebp - 0x2c], ax
inc eax
cmp esi, ebx
je 0x105c584
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2c], ax
call fcn.0106470b
mov dword [ebp - 0x30], eax
cmp eax, ebx
mov eax, 0xb1
jl 0x105c58b
push 0x5c
pop edx
lea ecx, [ebp - 0xc]
mov word [ebp - 0x2c], ax
call fcn.0106469a
mov dword [ebp - 0x30], eax
cmp eax, ebx
mov eax, 0xb2
jl 0x105c58b
push dword [ebp - 0xc]
mov word [ebp - 0x2c], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x105c601
call fcn.0105d3b8
mov dword [ebp - 0x30], eax
mov eax, 0xb5
jmp 0x105c58b
mov ecx, 0xb5
mov word [ebp - 0x2c], cx
mov ecx, eax
and ecx, 0x800
and eax, 0x4000
mov dword [edi], ecx
mov dword [ebp - 0x30], ebx
mov dword [esi], eax
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0xc]
call fcn.010635b3
lea ecx, [ebp - 0x30]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x105cc81
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105ccc5
test dword [eax + 0x1c], 0x20000000
je 0x105ccc5
push dword [ebp + 0xc]
push esi
push 0x100f984
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105bfed
push 1
push 0x371
push 0x100fb64
lea ecx, [ebp - 0x234]
call fcn.01055826
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x376
test esi, esi
jne 0x105cd19
mov dword [ebp - 0x234], 0x80070057
mov word [ebp - 0x22e], ax
jmp 0x105cdca
cmp dword [ebp + 0xc], 0
mov word [ebp - 0x230], ax
mov eax, 0x377
jbe 0x105cd03
and dword [ebp - 0x234], 0
push edi
mov word [ebp - 0x230], ax
xor eax, eax
mov word [esi], ax
mov edi, 0x105
push edi
lea eax, [ebp - 0x210]
push eax
push 0x100fb44
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x105cd6d
call fcn.0105d3b8
mov dword [ebp - 0x234], eax
mov eax, 0x382
jmp 0x105cdb9
mov ecx, 0x382
cmp eax, edi
mov word [ebp - 0x230], cx
lea eax, [ecx + 1]
jbe 0x105cd8c
mov dword [ebp - 0x234], 0x8007007a
jmp 0x105cdb9
push dword [ebp + 0xc]
and dword [ebp - 0x234], 0
mov word [ebp - 0x230], ax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0105c63f
mov dword [ebp - 0x234], eax
test eax, eax
mov eax, 0x385
jge 0x105cdc2
mov word [ebp - 0x22e], ax
jmp 0x105cdc9
mov word [ebp - 0x230], ax
pop edi
mov esi, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01054fa7
leave
ret 8
Function at 0x105cdf1
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 1
push 0x710
push 0x100fb74
lea ecx, [ebp - 0x48]
call fcn.01055826
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
lea edi, [ebp - 4]
mov dword [ebp - 8], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0x1010420
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x105ce42
mov dword [eax], esi
mov dword [eax + 4], esi
mov ebx, dword [ebp + 0x14]
cmp ebx, esi
je 0x105ce4e
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x105ce5a
mov dword [edi], esi
mov dword [edi + 4], esi
mov edx, dword [ebp + 8]
mov eax, 0x71a
cmp edx, esi
jne 0x105ce76
mov dword [ebp - 0x48], 0x80070057
mov word [ebp - 0x42], ax
jmp 0x105cf14
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x48], esi
mov word [ebp - 0x44], ax
call fcn.0106470b
mov dword [ebp - 0x48], eax
cmp eax, esi
mov eax, 0x71c
jl 0x105ce6d
push 0x5c
pop edx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x44], ax
call fcn.0106469a
mov dword [ebp - 0x48], eax
cmp eax, esi
mov eax, 0x71d
jl 0x105ce6d
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x105ced8
call fcn.0105d3b8
mov dword [ebp - 0x48], eax
mov eax, 0x71f
jmp 0x105ce6d
mov eax, 0x71f
mov dword [ebp - 0x48], esi
mov word [ebp - 0x44], ax
cmp edi, esi
je 0x105cef3
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x105cf05
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
cmp ebx, esi
je 0x105cf14
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x24]
call fcn.010635b3
lea ecx, [ebp - 0x48]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x105d768
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105d797
test dword [eax + 0x1c], 0x20000000
je 0x105d797
push 0x100fbec
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016edb
push 1
push 0x5d0
push 0x100fc2c
lea ecx, [ebp - 0x24]
call fcn.01055826
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x105d7d1
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x5db
mov word [ebp - 0x1e], ax
jmp 0x105d7f3
cmp eax, dword [ebp + 0x10]
mov ecx, 0x5db
mov word [ebp - 0x20], cx
lea eax, [ecx + 1]
jbe 0x105d7eb
mov dword [ebp - 0x24], 0x8007007a
jmp 0x105d7cb
and dword [ebp - 0x24], 0
mov word [ebp - 0x20], ax
push esi
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x105d92e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push 2
push 0x21
push 0x100fca8
lea ecx, [ebp - 0x30]
call fcn.01055826
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x105d95d
mov dword [ebx], esi
push 0x2a
pop eax
cmp dword [ebp + 0xc], esi
jne 0x105d975
mov dword [ebp - 0x30], 0x80070057
mov word [ebp - 0x2a], ax
jmp 0x105da22
push 0x2b
mov word [ebp - 0x2c], ax
pop eax
cmp ebx, esi
je 0x105d965
mov word [ebp - 0x2c], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], esi
je 0x105d9bc
cmp eax, 2
jne 0x105d9bc
mov dword [ebp - 0x30], 1
push 0x31
jmp 0x105da1d
cmp eax, esi
jle 0x105d9ca
and eax, 0xffff
or eax, 0x80070000
push 0x34
mov dword [ebp - 0x30], eax
cmp eax, esi
pop eax
jge 0x105d9e1
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x28], 1
jmp 0x105da22
cmp dword [ebp - 8], 4
push 0x36
mov word [ebp - 0x2c], ax
pop eax
je 0x105d9fa
mov dword [ebp - 0x30], 0x8007065d
jmp 0x105d96c
cmp dword [ebp - 4], 4
mov word [ebp - 0x2c], ax
je 0x105da13
push 0x37
mov dword [ebp - 0x30], 0x80004005
pop eax
jmp 0x105d96c
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0x30], esi
push 0x3b
pop eax
mov word [ebp - 0x2c], ax
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.01055a3c
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x105da3a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
push 2
push 0x76
push 0x100fcb8
lea ecx, [ebp - 0x34]
call fcn.01055826
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 8
cmp esi, edi
je 0x105da77
mov dword [esi], edi
mov dword [esi + 4], edi
push 0x7f
pop eax
cmp dword [ebp + 8], edi
jne 0x105da8f
mov dword [ebp - 0x34], 0x80070057
mov word [ebp - 0x2e], ax
jmp 0x105db3b
mov word [ebp - 0x30], ax
mov eax, 0x80
cmp esi, edi
je 0x105da7f
mov word [ebp - 0x30], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], edi
je 0x105dad8
cmp eax, 2
jne 0x105dad8
mov eax, 0x85
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], ax
jmp 0x105db3b
cmp eax, edi
jle 0x105dae6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x34], eax
cmp eax, edi
mov eax, 0x88
jge 0x105daff
mov word [ebp - 0x2e], ax
mov dword [ebp - 0x2c], 1
jmp 0x105db3b
cmp dword [ebp - 4], 0xb
mov word [ebp - 0x30], ax
mov eax, 0x8a
je 0x105db1a
mov dword [ebp - 0x34], 0x8000ffff
jmp 0x105da86
cmp dword [ebp - 8], 8
mov word [ebp - 0x30], ax
mov eax, 0x8b
jne 0x105db0e
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], edi
mov dword [esi + 4], eax
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x105db53
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push 2
push 0x150
push 0x100fccc
lea ecx, [ebp - 0x24]
call fcn.01055826
xor esi, esi
mov eax, 0x152
cmp dword [ebp + 8], esi
jne 0x105db89
mov dword [ebp - 0x24], 0x80070057
mov word [ebp - 0x1e], ax
jmp 0x105dbd1
mov word [ebp - 0x20], ax
mov eax, 0x153
cmp dword [ebp + 0xc], esi
je 0x105db7c
push 4
mov word [ebp - 0x20], ax
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
jle 0x105dbc1
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x24], eax
cmp eax, esi
mov eax, 0x155
jl 0x105db83
mov word [ebp - 0x20], ax
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x105dbe8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push 2
push 0x164
push 0x100fcdc
lea ecx, [ebp - 0x24]
call fcn.01055826
xor esi, esi
mov eax, 0x166
cmp dword [ebp + 8], esi
jne 0x105dc1e
mov dword [ebp - 0x24], 0x80070057
mov word [ebp - 0x1e], ax
jmp 0x105dc66
mov word [ebp - 0x20], ax
mov eax, 0x167
cmp dword [ebp + 0xc], esi
je 0x105dc11
push 8
mov word [ebp - 0x20], ax
lea eax, [ebp + 0x10]
push eax
push 0xb
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
jle 0x105dc56
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x24], eax
cmp eax, esi
mov eax, 0x169
jl 0x105dc18
mov word [ebp - 0x20], ax
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x105de13
Capabilities:
Get session information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105de42
test dword [eax + 0x1c], 0x20000000
je 0x105de42
push 0x100fd04
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016edb
push esi
push edi
push 1
push 0x28
push 0x100fd14
lea ecx, [ebp - 0x30]
call fcn.01055826
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 4
push 0xffffffffffffffff
push esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x105deaf
cmp dword [ebp - 0xc], 4
push 0x3a
pop eax
jae 0x105de94
mov dword [ebp - 0x30], 0x8000ffff
mov word [ebp - 0x2a], ax
jmp 0x105dedf
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], esi
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jne 0x105ded1
mov dword [ebp - 0x30], esi
push 0x45
jmp 0x105deda
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x105dea3
call fcn.0105d3b8
push 0x40
mov dword [ebp - 0x30], eax
pop eax
jmp 0x105de8e
mov dword [ebp - 0x30], 1
push 0x48
pop eax
mov word [ebp - 0x2c], ax
cmp dword [ebp - 4], esi
je 0x105deec
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
leave
ret