joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1038ff5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
je 0x10390b4
cmp dword [esi + 4], ebx
je 0x10390b4
push edi
push esi
push 8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x1046180
call fcn.01037906
xor eax, eax
cmp dword [ebp - 0x20], ebx
push 4
sete al
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 4
push 0x102b4c4
push 0x101c6d8
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x463
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 4]
push ebx
push 0x10390c8
push 0x80000002
push eax
mov dword [esi], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x110a
push dword [esi]
mov dword [ebp - 4], eax
call edi
push eax
push ebx
push 0x1114
push dword [esi]
call edi
push 0x465
push dword [ebp + 8]
call fcn.01038925
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
setge al
jmp 0x10390c0
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x1039642
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, ecx
call fcn.01037b9f
xor edi, edi
cmp dword [ebx + 0x5c], edi
mov esi, eax
mov dword [ebp - 4], esi
jne 0x1039674
cmp esi, 0xffffffff
jne 0x103967d
push edi
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1039738
cmp esi, 0xffffffff
je 0x1039738
lea eax, [ebp - 0x34]
push eax
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x100e
push dword [ebx + 0x44]
mov dword [ebp - 0x14], edi
call esi
push edi
push edi
push 0x101f
push dword [ebx + 0x44]
call esi
lea ecx, [ebp - 0x24]
push ecx
push 1
push 0x1207
push eax
call esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea edi, [ebx + 0x48]
push edi
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x1039706
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1039738
push 5
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp - 4]
lea ecx, [ebx + 0x28]
call fcn.010393cf
push dword [eax + 0x10]
push 0x14e
push dword [ebx + 0x40]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1039b74
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
lea edi, [ecx + 0x64]
push edi
push 0x102b5c0
push 1
push 0
push 0x102b5b0
mov dword [ebp - 4], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1039ca8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x463
push ebx
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
call fcn.010384ae
mov eax, dword [edi]
mov ecx, dword [eax]
xor edi, edi
push edi
push 0x1039cb0
push 0x80000002
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x110a
push dword [ebp + 8]
call edi
push eax
push 5
push 0x110b
push dword [ebp + 8]
call edi
push 0x13
call dword [sym.imp.SHLWAPI.dll_IsOS]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
inc eax
push eax
push 0x1017ed8
call fcn.01037fee
mov edi, dword [sym.imp.USER32.dll_CheckDlgButton]
push eax
push 0x51c
push ebx
call edi
mov ecx, dword [ebp - 4]
push 1
push 0x100c6cc
call fcn.01037fee
push eax
push 0x51a
push ebx
call edi
mov ecx, dword [ebp - 4]
push 1
push 0x100ae24
call fcn.01037fee
push eax
push 0x52e
push ebx
call edi
push 0x40000003
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x1039c96
push 0
push 0x521
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x520
push ebx
call esi
push eax
call edi
push 0
push 0x51c
push ebx
call esi
push eax
call edi
push 0
push 0x51d
push ebx
call esi
push eax
call edi
push 0x51d
push ebx
call fcn.01038925
xor eax, eax
pop esi
inc eax
pop ebx
jmp 0x1039caa
xor eax, eax
pop edi
leave
ret 4

Function at 0x1039cfd
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 0x4000005a
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x1039d76
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x46c
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x46f
push dword [ebp + 8]
call esi
push eax
call edi
push 0
push 0x46b
push dword [ebp + 8]
call esi
push eax
call edi
push 1
push 0x46d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0xab
push 0x46e
push dword [ebp + 8]
call fcn.01039188
jmp 0x1039dfc
and dword [ebp - 0x20], 0
push 7
pop ecx
xor eax, eax
push eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x200000
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
and eax, 2
shr eax, 1
push eax
push 0x46c
push edi
call esi
mov eax, dword [ebp - 4]
not eax
and eax, 2
shr eax, 1
push eax
push 0x46d
push edi
call esi
mov eax, dword [ebp - 4]
not eax
and eax, 2
or eax, 0x154
shr eax, 1
push eax
push 0x46e
push edi
call fcn.01039188
mov eax, dword [ebp - 4]
not eax
and eax, 2
or eax, 0x8d4
push 0
shr eax, 1
push eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
leave
ret 4
Function at 0x103a8c8
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x1046180
call fcn.01037906
push dword [ebp - 8]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
push 0x453
push edi
call esi
push dword [ebp - 0x20]
push 0x44d
push edi
call esi
mov eax, dword [ebp - 4]
and eax, 1
push eax
push 0x44e
push edi
call esi
xor eax, eax
cmp dword [ebp - 0x18], eax
sete al
push eax
push 0x44f
push edi
call esi
push 0x40000070
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
je 0x103a94a
push 0
push 0x44f
push dword [ebp + 8]
call edi
push eax
call ebx
push 0x4000006b
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x103a968
push 0
push 0x453
push dword [ebp + 8]
call edi
push eax
call ebx
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x103a993
cmp dword [ebp - 0x10], eax
jne 0x103a993
push dword [ebp - 0xc]
push 0x3ef
push dword [ebp + 8]
call edi
push eax
call ebx
push dword [ebp - 0xc]
push 0x3e8
push dword [ebp + 8]
call esi
jmp 0x103a9bf
push eax
push 0x3e8
push dword [ebp + 8]
call edi
push eax
call ebx
push 0
push 0x3ef
push dword [ebp + 8]
call edi
push eax
call ebx
push 0
push 0x452
push dword [ebp + 8]
call edi
push eax
call ebx
call fcn.01013838
neg eax
sbb eax, eax
inc eax
push eax
push 0x451
push dword [ebp + 8]
call esi
call fcn.01013069
neg eax
sbb eax, eax
inc eax
push eax
push 0x451
push dword [ebp + 8]
call edi
push eax
call ebx
push 0x40000056
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x103aa10
push 0
push 0x450
push dword [ebp + 8]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x103aa34
push 1
push 0
push 0x10102d0
push 0x101c6d8
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
test eax, eax
je 0x103aa34
push 1
push 0x450
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call fcn.0103873a
push dword [ebp + 8]
call fcn.01039e50
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x103aa50
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push edi
push 0x44d
push dword [ebp + 8]
call esi
mov edi, 0x1046180
push eax
mov ecx, edi
call fcn.01031832
mov ebx, 0x44e
push ebx
push dword [ebp + 8]
call esi
push eax
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.010348e3
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.01037906
mov eax, dword [ebp - 4]
shr eax, 0x10
test ax, ax
jne 0x103aac7
xor eax, eax
cmp dword [ebp - 8], eax
je 0x103aac9
test byte [ebp - 0x14], 1
jne 0x103aac9
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CheckDlgButton]
push dword [ebp + 8]
call fcn.01039e50
xor eax, eax
cmp word [ebp - 4], ax
je 0x103aada
push eax
push eax
push eax
push eax
mov ecx, edi
call fcn.01002815
push 0x44f
push dword [ebp + 8]
call esi
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x28], ebx
jne 0x103ab12
cmp dword [ebp - 0x20], 0
jne 0x103ab12
push 0x3e8
push dword [ebp + 8]
call esi
cmp dword [ebp - 0x1c], eax
je 0x103ab12
push eax
mov dword [ebp - 0x1c], eax
call fcn.0103860d
push 0x453
push dword [ebp + 8]
call esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.01037971
push ebx
push 0
push 0x402
push dword [0x1046524]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.01009278
push 0x451
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
neg eax
sbb eax, eax
push 2
inc eax
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 4
push 0x101385c
mov ebx, 0x101c6d8
push ebx
call edi
push 0x450
push dword [ebp + 8]
call esi
push 2
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push 0x10102d0
push ebx
call edi
push 0
push 0x3e8
push 8
push 0x1009960
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x103beb6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp + 0xc], esi
mov dword [ebp + 8], eax
je 0x103bee9
push esi
lea ecx, [ebp + 8]
push ecx
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x103bee9
xor eax, eax
jmp 0x103bf15
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x103bf05
xor edi, edi
inc edi
cmp dword [ebp + 0xc], esi
je 0x103bf13
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x103c07f
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x1046080]
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x103c14b
push 0x103c158
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x103c14b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
xor eax, eax
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x260]
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x234], eax
mov word [ebp - 0x22e], ax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x20c]
push eax
push eax
mov dword [ebp - 0x260], 0x44
mov word [ebp - 0x230], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x103c14b
push esi
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x218]
call esi
pop esi
mov ecx, dword [ebp - 4]
call fcn.010019ca
leave
ret
Function at 0x103c2a2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [0x1046080]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x103c488
lea eax, [ebp - 0x30c]
push 0x80
xor esi, esi
push eax
mov dword [ebp - 0x728], esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push esi
lea eax, [ebp - 0x724]
push eax
push esi
push 0x20019
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyW]
test eax, eax
jne 0x103c421
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHRegQueryUSValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x103c468
push dword [ebp - 0x724]
mov dword [ebp - 0x720], 0x208
mov word [ebp - 0x20c], si
call ebx
test eax, eax
je 0x103c3f3
push edi
push esi
push esi
push esi
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x514]
push eax
push esi
push 0x103c450
push dword [ebp - 0x724]
mov edi, 0x104
mov dword [ebp - 0x720], edi
call ebx
test eax, eax
mov dword [ebp - 0x720], edi
lea eax, [ebp - 0x720]
jne 0x103c3a1
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x514]
push eax
push 2
push 0x40
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
jmp 0x103c3f2
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x514]
push eax
push esi
push 0x103c434
push dword [ebp - 0x724]
call ebx
test eax, eax
jne 0x103c3f2
push edi
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
lea eax, [ebp - 0x71c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHRunIndirectRegClientCommand]
mov word [ebp - 0x20c], si
mov dword [ebp - 0x728], 1
pop edi
cmp word [ebp - 0x20c], si
pop ebx
je 0x103c415
push 9
lea eax, [ebp - 0x20c]
push eax
call fcn.01011ece
mov dword [ebp - 0x728], 1
push dword [ebp - 0x724]
call dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x728]
pop esi
call fcn.010019ca
leave
ret 4
Function at 0x103d8b9
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jne 0x103d8e5
or eax, 0xffffffff
cmp ecx, eax
je 0x103d96a
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x103d950
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x103d926
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x20], 0x20
jne 0x103d91c
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x103d926
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call ebx
test eax, eax
jne 0x103d8f7
cmp dword [ebp + 0x10], 0xffffffff
je 0x103d94d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x103d950
mov ecx, dword [ebp - 4]
push dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
push ecx
setne bl
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
call esi
cmp eax, ebx
je 0x103d8ef
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x103debe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x103df1f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x103df16
cmp dword [ebp - 0xc], 4
je 0x103df16
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x103df62
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x103df59
cmp dword [ebp - 0xc], esi
je 0x103df59
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x103df71
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1046080]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103dfe7
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.010019ca
leave
ret 0xc

Function at 0x103e1ab
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x101c6d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103e1fd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x101466c
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x103e207
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1047a94]
cmp eax, 0xffffffff
jne 0x103e28b
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x103e29c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103e27a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x103e290
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x103e271
cmp dword [ebp - 0xc], 4
jne 0x103e271
cmp dword [ebp - 0x10], eax
je 0x103e271
mov dword [0x1047a94], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1047a94]
cmp eax, 0xffffffff
jne 0x103e28b
xor eax, eax
mov dword [0x1047a94], eax
leave
ret
Function at 0x103e82d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1046080]
mov dword [ebp - 4], eax
mov eax, ecx
cmp dword [eax], 0x10
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x440], ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x44c], ecx
jae 0x103e9a3
mov ebx, 0x104
jmp 0x103e873
mov eax, dword [ebp - 0x444]
mov esi, dword [eax]
lea ecx, [esi + 1]
mov dword [eax], ecx
mov eax, dword [ebp - 0x440]
lea edi, [eax + esi*4 + 4]
push 0x103ea58
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x103e994
cmp esi, 0x10
jae 0x103e90b
push 0x103ea28
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
jne 0x103e90b
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x448]
push eax
push 0x103ea18
push 0x103e9c8
push 0x80000002
mov dword [ebp - 0x450], 0x28
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x103e90b
cmp dword [ebp - 0x448], 1
jne 0x103e90b
push 0x103e9b8
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x103e994
mov eax, dword [ebp - 0x440]
mov eax, dword [eax]
test eax, eax
je 0x103e95a
push ebx
lea ecx, [ebp - 0x43c]
push ecx
add eax, esi
push eax
push dword [0x10466fc]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103e994
push ebx
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov esi, eax
test esi, esi
jne 0x103e97d
push ebx
lea eax, [ebp - 0x234]
push eax
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov esi, eax
test esi, esi
je 0x103e994
mov ecx, dword [ebp - 0x44c]
push esi
call fcn.0103e66e
test eax, eax
je 0x103e9a7
push esi
call dword [sym.imp.SHELL32.dll_ILFree]
mov eax, dword [ebp - 0x444]
cmp dword [eax], 0x10
jb 0x103e86d
xor eax, eax
jmp 0x103e9a9
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010019ca
leave
ret 8