joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104142f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
push esi
push esi
push 4
mov dword [ebp - 0x208], esi
call fcn.01058973
test eax, eax
je 0x10414ec
push edi
lea eax, [ebp - 0x208]
push eax
xor edi, edi
inc edi
push edi
push esi
push 0x1004820
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10414e9
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x1004804
push dword [ebp - 0x208]
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x20c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10414dd
cmp dword [ebp - 0x20c], edi
jne 0x10414dd
lea eax, [ebp - 0x204]
push 0x10047f8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10414dd
mov esi, edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret

Function at 0x10416d1
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x424
push esi
push edi
mov edi, 0x80004005
je 0x1041730
cmp dword [ebp + 8], 0x466
je 0x1041730
cmp dword [ebp + 8], 0x427
je 0x1041714
push 0x100490c
push 2
call fcn.01055c50
xor esi, esi
push esi
push esi
push esi
push 6
call fcn.01058973
neg eax
sbb eax, eax
and eax, 0x87
add eax, 0xc1
jmp 0x104175e
xor esi, esi
push esi
push esi
push 1
push 6
call fcn.01058973
test eax, eax
je 0x1041748
mov eax, 0xe2
jmp 0x104175e
push esi
push esi
push esi
push 6
call fcn.01058973
neg eax
sbb eax, eax
and eax, 0x1f
add eax, 0xc0
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push eax
push dword [0x1073960]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10417bc
push 7
lea eax, [ebp - 0x204]
push 0x10048fc
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10417bc
push 0xa
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 4
Function at 0x104192f
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0xffffffffffffffff
xor edi, edi
push 0x1004988
mov dword [ebp - 8], edi
call fcn.0106de7c
mov ebx, eax
cmp ebx, edi
jl 0x1041add
lea ecx, [ebp - 0x30]
call fcn.0106d6aa
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0x7fff
call fcn.0106d6aa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.0106de34
mov ebx, eax
cmp ebx, edi
jge 0x1041994
lea ecx, [ebp - 0x24]
call fcn.0106de2a
lea ecx, [ebp - 0x30]
call fcn.0106de2a
jmp 0x1041add
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10419c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x10419b5
push 0x57
pop eax
cmp eax, edi
jle 0x10419c1
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x104197f
push esi
push 0x44
pop esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x10419e3
mov ebx, 0x8007000e
jmp 0x1041abc
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0xc], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x14], esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
test ebx, ebx
jne 0x1041a2b
cmp eax, 0x7a
je 0x1041a2b
test eax, eax
jle 0x1041a24
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x1041abc
lea ecx, [ebp - 0x3c]
call fcn.0106d6aa
mov eax, dword [ebp - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x3c]
call fcn.0106de34
mov ebx, eax
test ebx, ebx
jl 0x1041ab4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push dword [ebp - 0x24]
push 0
call edi
mov edi, eax
call esi
test edi, edi
jne 0x1041a77
test eax, eax
jle 0x1041ab2
and eax, 0xffff
or eax, 0x80070000
jmp 0x1041ab2
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x1041a92
call esi
test eax, eax
jne 0x1041a69
push 0x57
pop eax
jmp 0x1041a67
push 0xffffffffffffffff
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.0106de7c
mov ebx, eax
test ebx, ebx
jl 0x1041ab4
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x30]
call fcn.0106e051
mov ebx, eax
lea ecx, [ebp - 0x3c]
call fcn.0106de2a
lea ecx, [ebp - 0x24]
call fcn.0106de2a
lea ecx, [ebp - 0x30]
call fcn.0106de2a
xor edi, edi
pop esi
cmp dword [ebp - 4], edi
je 0x1041add
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x1041aeb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x1041af8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 8]
push eax
push 1
xor edi, edi
push edi
push 0x1004a68
push 0x80000001
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1041b8a
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x1004a2c
push dword [ebp - 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x1041b57
cmp dword [ebp - 4], 1
jne 0x1041b57
and dword [0x1074298], 0xfffffffe
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x10049e8
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call esi
pop esi
pop ebx
test eax, eax
jne 0x1041b81
cmp dword [ebp - 4], 1
jne 0x1041b81
and dword [0x1074298], 0xfffffffd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
leave
ret
Function at 0x10451d2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp edi, ebx
jne 0x10451ec
xor eax, eax
jmp 0x1045228
push 0x3c
lea eax, [ebp - 0x3c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10456b0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x1074308], esi
jne 0x1045722
push 0x105
lea eax, [ebp - 0x210]
push eax
mov dword [0x1074308], 1
call fcn.01058169
test eax, eax
je 0x1045722
lea eax, [ebp - 0x210]
push eax
call fcn.010561eb
test eax, eax
je 0x1045722
push 0xa
lea eax, [ebp - 0x210]
push esi
cmp dword [ebp + 8], esi
je 0x1045714
push 0x1004f78
jmp 0x1045719
push 0x1004f5c
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 4
Function at 0x10466f3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1046769
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01058169
test eax, eax
je 0x1046769
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1005530
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0103592d
add esp, 0x14
test eax, eax
jl 0x1046769
lea eax, [ebp - 0x61c]
push eax
push 0x1003d0c
call fcn.0105973a
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.01047480
leave
ret

Function at 0x1046818
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x3c], eax
cmp eax, edi
je 0x1046879
lea eax, [esi + 0x40]
push eax
push edi
push esi
push 0x10467fc
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 8], eax
cmp eax, edi
je 0x1046868
cmp dword [ebp + 8], edi
jne 0x1046868
push 0x32
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1046856
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x1046879
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x1047471
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x106fb88
call fcn.01047530
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1075584
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1047228
cmp eax, esi
jne 0x104721b
xor esi, esi
inc esi
mov ebx, esi
jmp 0x104722b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1047202
xor esi, esi
inc esi
mov eax, dword [0x1075580]
cmp eax, esi
jne 0x104723e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x104726d
mov eax, dword [0x1075580]
test eax, eax
jne 0x1047267
mov dword [0x1075580], esi
push 0x100171c
push 0x1001710
call fcn.01047167
pop ecx
pop ecx
test eax, eax
je 0x104726d
jmp 0x1047395
mov dword [0x1074328], esi
mov eax, dword [0x1075580]
cmp eax, esi
jne 0x1047291
push 0x100170c
push 0x1001680
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1075580], 2
test ebx, ebx
jne 0x104729d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1075588], 0
je 0x10472c1
push 0x1075588
call fcn.010476a9
pop ecx
test eax, eax
je 0x10472c1
push 0
push 2
push 0
call dword [0x1075588]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x104731d
test al, al
je 0x10472db
cmp dword [ebp - 0x1c], 0
jne 0x104731d
mov al, byte [esi]
test al, al
je 0x10472eb
cmp al, 0x20
ja 0x10472eb
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10472db
test byte [ebp - 0x3c], 1
je 0x10472f7
movzx eax, word [ebp - 0x38]
jmp 0x10472fa
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1074324], eax
cmp dword [0x1074318], 0
jne 0x1047371
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x104732c
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x104733f
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10472c8
cmp dword [0x1074328], 0
jne 0x1047380
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1074324]
jmp 0x10473a1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01047575
ret
call fcn.01047894
jmp 0x10471c8

Function at 0x1047d2c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x118]
push eax
xor bl, bl
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x1047d78
cmp dword [ebp - 0x108], 2
jne 0x1047d76
cmp dword [ebp - 0x114], 6
jb 0x1047d76
mov bl, al
jmp 0x1047d78
xor bl, bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret
Function at 0x1047d8c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
je 0x1047dc3
mov eax, dword [ebp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1047d9d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebp
ret 0xc
Function at 0x10480dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ecx
cmp dword [eax], ecx
je 0x104820f
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x210]
push eax
mov ebx, 0x20019
push ebx
push ecx
mov edi, 0x1006190
push edi
push 0x80000002
mov dword [ebp - 0x210], ecx
call esi
test eax, eax
je 0x1048154
lea eax, [ebp - 0x210]
push eax
push ebx
push 0
push edi
push 0x80000001
call esi
test eax, eax
je 0x1048154
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0
mov edi, dword [ebp - 0x214]
je 0x10481fb
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
xor ebx, ebx
inc ebx
push ebx
push 0
push dword [edi]
push dword [ebp - 0x210]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10481e1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x100615c
push dword [ebp - 0x21c]
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10481d9
cmp dword [ebp - 0x214], ebx
jne 0x10481d9
mov dword [ebp - 0x218], ebx
push dword [ebp - 0x21c]
call esi
push dword [ebp - 0x210]
call esi
cmp dword [ebp - 0x218], 0
je 0x10481fb
push dword [edi]
push 0x1006134
jmp 0x1048202
push dword [edi]
push 0x10060f0
push 4
call fcn.01055c8a
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.01047480
leave
ret

Function at 0x104823b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
push esi
push esi
push esi
mov edi, ecx
push 6
mov dword [ebp - 0x14], edi
call fcn.01058973
test eax, eax
je 0x10482d2
push ebx
lea eax, [ebp - 4]
push eax
xor ebx, ebx
inc ebx
push ebx
push esi
push 0x1006248
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10482cd
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x1006210
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10482c4
cmp dword [ebp - 8], edi
jne 0x10482c4
cmp dword [ebp - 0xc], esi
jne 0x10482c4
push 0x10061ec
push edi
call fcn.01055c50
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 0x98]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
jmp 0x10482d8
mov eax, dword [edi + 0x98]
pop edi
pop esi
leave
ret
Function at 0x1048761
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10487f2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x186a0
div ecx
push 0x1005dc8
lea eax, [ebp - 0x414]
push edx
push eax
push 0x10063c0
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.01035968
add esp, 0x18
test eax, eax
jl 0x10487f2
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10487f2
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0105849d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
xor ecx, ebp
call fcn.01047480
leave
ret
Function at 0x1048952
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
xor ebx, ebx
mov eax, 0x80004005
mov dword [ebp - 0x214], eax
cmp ecx, ebx
je 0x1048b34
push ecx
push 0x1006530
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0103592d
add esp, 0x10
test eax, eax
jl 0x1048b2e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
mov dword [ebp - 0x210], ebx
call edi
test eax, eax
je 0x10489fd
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000001
call edi
test eax, eax
je 0x10489fd
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x210], ebx
je 0x1048b2d
push dword [esi + 0xc]
push 0x1006510
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x64]
push 0x10064f8
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x68]
push 0x10064d8
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x5c]
push 0x10064bc
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x54]
push 0x10064a0
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x50]
push 0x1006480
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x58]
push 0x1006464
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x6c]
mov edi, 0x1006444
push edi
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x70]
push edi
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x74]
push 0x1006424
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x78]
mov edi, 0x1006404
push edi
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x7c]
push edi
push dword [ebp - 0x210]
call fcn.01047d8c
push dword [esi + 0x80]
push 0x10063e4
push dword [ebp - 0x210]
call fcn.01047d8c
lea eax, [esi + 0x4c]
cmp dword [eax], ebx
je 0x1048b1b
push 4
push eax
push 4
push ebx
push 0x10063d8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret
Function at 0x104a09e
Capabilities:
Delete registry value
Set registry value

Disassembly:
cmp dword [ecx + 0x40], 0
je 0x104a0b4
call fcn.01048fa3
test eax, eax
je 0x104a0b4
mov ecx, eax
jmp fcn.01048ba8
ret

Function at 0x104a0ba
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push esi
push edi
push 0x1006acc
mov esi, ecx
push 3
mov dword [ebp - 0x220], esi
call fcn.01055c50
mov eax, dword [esi + 0x10]
test eax, eax
je 0x104a0fb
push eax
mov ecx, esi
call fcn.01049cd4
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea eax, [ebp - 0x210]
push eax
push 1
push 0
mov ebx, 0x1001b38
push ebx
push 0x80000001
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x104a241
and dword [ebp - 0x218], 0
push 4
pop eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1006a94
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x104a1d2
cmp dword [ebp - 0x218], 1
jne 0x104a1d2
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1006a60
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 0x208
call esi
test eax, eax
jne 0x104a1d2
cmp dword [ebp - 0x214], 1
jne 0x104a1d2
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.01049dcf
lea eax, [ebp - 0x20c]
push eax
push 0x1006a40
push 3
call fcn.01055c8a
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1001f20
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 0x208
call esi
test eax, eax
jne 0x104a235
cmp dword [ebp - 0x214], 1
jne 0x104a235
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.01049eb9
lea eax, [ebp - 0x20c]
push eax
push 0x1006a20
push 3
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push ebx
push 0x80000002
call edi
pop ebx
test eax, eax
jne 0x104a30d
push 4
pop edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x10069f4
push dword [ebp - 0x210]
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], 0x208
call esi
test eax, eax
jne 0x104a301
cmp dword [ebp - 0x218], 1
jne 0x104a301
mov ecx, 0x1001e44
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x104a2d0
test dx, dx
je 0x104a2cc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x104a2d0
add eax, edi
add ecx, edi
test dx, dx
jne 0x104a2ac
xor eax, eax
jmp 0x104a2d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x104a301
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.01049fb4
lea eax, [ebp - 0x20c]
push eax
push 0x10069d0
push 3
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret