joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b824
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x100b8d3
cmp dword [ebp + 0xc], ebx
je 0x100b8d3
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.0100b46f
mov esi, eax
mov dword [ebp + 8], esi
cmp esi, ebx
je 0x100b893
push ebx
push dword [ebp + 0xc]
call fcn.0100b46f
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x100b893
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100b890
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 8], 1
test eax, eax
jne 0x100b893
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp esi, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp + 0xc], eax
je 0x100b8b5
push dword [ebp + 8]
push ebx
call edi
push eax
call esi
cmp dword [ebp - 4], ebx
je 0x100b8c3
push dword [ebp - 4]
push ebx
call edi
push eax
call esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp 0x100b8dd
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
leave
ret 8

Function at 0x100bd39
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0100b46f
mov ebx, eax
cmp ebx, edi
je 0x100be1a
push esi
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x100bde6
mov eax, dword [ebp + 0xc]
and al, 1
movsx eax, al
push edi
push 0x2200000
neg eax
push 3
sbb eax, eax
push edi
and eax, 0xfffffff9
add eax, 7
push eax
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100bdd5
push 0xd
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
cmp eax, edi
jge 0x100bdc5
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 4], eax
jmp 0x100bdcc
mov dword [ebp - 8], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100be0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1002f98
jmp 0x100bdf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1002f10
push 0x3000000
push 0x1016414
mov dword [ebp - 4], eax
call fcn.0100b1ab
add esp, 0x14
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 8
Function at 0x100be31
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x100bf11
xor eax, eax
cmp ax, word [esi]
je 0x100bf11
push ebx
push edi
push esi
call fcn.0100b46f
mov dword [ebp + 8], eax
cmp eax, edi
je 0x100bec8
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x3000000
mov edi, 0x1016414
test eax, eax
jne 0x100be9f
call esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x10030f0
push ebx
push edi
call fcn.0100b1ab
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100beea
cmp dword [ebp - 4], eax
jne 0x100beb9
call esi
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp + 8]
push 0x1003070
push ebx
push edi
jmp 0x100bee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1002ff8
push 0x3000000
mov dword [ebp - 4], eax
push 0x1016414
call fcn.0100b1ab
add esp, 0x14
cmp dword [ebp + 8], 0
pop ebx
je 0x100bf03
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
jmp 0x100bf1b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x100bf26
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp eax, esi
je 0x100bf97
xor ecx, ecx
cmp cx, word [eax]
je 0x100bf97
push edi
push esi
push eax
call fcn.0100b46f
mov edi, eax
cmp edi, esi
je 0x100bf92
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100bf60
test al, 0x10
je 0x100bf60
inc ebx
jmp 0x100bf7b
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x100bf73
mov esi, 0x10b
cmp esi, 2
jne 0x100bf7b
push 3
pop esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop edi
jmp 0x100bfa1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100bfac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100c00a
xor ecx, ecx
cmp cx, word [eax]
je 0x100c00a
push esi
push ebx
push eax
call fcn.0100b46f
mov esi, eax
cmp esi, ebx
je 0x100c005
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100bfe4
test eax, 0x400
je 0x100bfe4
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, ebx
pop esi
jmp 0x100c014
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x100c12f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp eax, edi
je 0x100c19e
xor ecx, ecx
cmp cx, word [eax]
je 0x100c19e
push esi
push edi
push eax
call fcn.0100b46f
mov esi, eax
test esi, esi
je 0x100c18a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100c170
test al, 0x10
je 0x100c16b
push 2
pop edi
jmp 0x100c178
xor ebx, ebx
inc ebx
jmp 0x100c178
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100c192
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop esi
jmp 0x100c1a8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
pop ebp
ret 4
Function at 0x100c280
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x1016034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 0x24c
lea eax, [ebp - 0x250]
push edi
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x254], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x258], edi
cmp ebx, edi
je 0x100c3f8
xor eax, eax
cmp ax, word [ebx]
je 0x100c3f8
push ebx
call fcn.0100bf26
test eax, eax
je 0x100c3f8
cmp esi, edi
je 0x100c3f8
push esi
push ebx
call fcn.0100d51b
mov dword [ebp - 0x268], eax
cmp eax, edi
je 0x100c3f0
push edi
push eax
call fcn.0100b46f
mov dword [ebp - 0x264], eax
cmp eax, edi
je 0x100c3f0
lea ecx, [ebp - 0x254]
push ecx
push eax
mov dword [ebp - 0x258], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x100c3d6
test byte [ebp - 0x254], 0x10
jne 0x100c3a0
lea eax, [ebp - 0x228]
push eax
push ebx
call fcn.0100d51b
mov ebx, eax
test ebx, ebx
je 0x100c37e
push ebx
call fcn.0100c268
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x100c37e
mov dword [ebp - 0x258], ecx
jmp 0x100c385
and dword [ebp - 0x258], 0
test ebx, ebx
je 0x100c391
push ebx
push 0
call edi
push eax
call esi
cmp dword [ebp - 0x258], 1
jne 0x100c3ca
mov ebx, dword [ebp - 0x260]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x100c34d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100c3ca
and dword [ebp - 0x258], 0
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x268]
push 0
call edi
push eax
call esi
push dword [ebp - 0x264]
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 0x258]
jmp 0x100c402
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100a4c9
leave
ret 8
Function at 0x100c418
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
test dword [ebp + 0x1c], 0xfffffff8
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
je 0x100c441
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100c59f
xor eax, eax
inc eax
test dword [ebp + 0x1c], eax
je 0x100c44c
mov dword [ebp - 0x10], eax
push ebx
push dword [ebp + 8]
call fcn.0100b46f
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x100c59c
push esi
push edi
push ebx
push dword [ebp + 0xc]
call fcn.0100b46f
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x100c577
mov dword [ebp - 0xc], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x1016414
push dword [ebp - 0x10]
and dword [ebp - 4], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100c4fc
test dword [ebp + 0x1c], 2
je 0x100c4f6
call ebx
inc dword [ebp - 0xc]
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 0xc]
call fcn.0100bcdb
test eax, eax
je 0x100c4f6
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1003280
push 0x4000000
push edi
call fcn.0100b1ab
add esp, 0x1c
cmp dword [ebp - 4], 0
jbe 0x100c484
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100c484
cmp dword [ebp - 8], 0
je 0x100c575
test dword [ebp + 0x1c], 4
je 0x100c575
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100c575
call ebx
mov dword [ebp + 0x1c], 0x1f
test eax, eax
je 0x100c52a
mov dword [ebp + 0x1c], eax
push dword [ebp + 0x1c]
mov esi, 0x2000000
push dword [ebp + 0xc]
push 0x10031e0
push esi
push edi
call fcn.0100b1ab
add esp, 0x14
push dword [ebp + 0xc]
call fcn.0100c268
test eax, eax
jne 0x100c56c
call ebx
test eax, eax
jne 0x100c559
push 0x1f
pop eax
push eax
push dword [ebp + 0xc]
push 0x1003180
push esi
push edi
call fcn.0100b1ab
add esp, 0x14
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
cmp dword [ebp - 0x14], ebx
je 0x100c59a
push dword [ebp - 0x14]
push ebx
call esi
push eax
call edi
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
leave
ret 0x18
Function at 0x100c5a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x100c661
cmp dword [ebp + 0xc], ebx
je 0x100c661
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.0100b46f
mov esi, eax
mov dword [ebp + 8], esi
cmp esi, ebx
je 0x100c621
push ebx
push dword [ebp + 0xc]
call fcn.0100b46f
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x100c621
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100c603
push dword [ebp - 4]
call fcn.0100c268
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 2
push eax
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push esi
call fcn.0100c418
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp esi, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp + 0xc], eax
je 0x100c643
push dword [ebp + 8]
push ebx
call edi
push eax
call esi
cmp dword [ebp - 4], ebx
je 0x100c651
push dword [ebp - 4]
push ebx
call edi
push eax
call esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp 0x100c66b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
leave
ret 0x14
Function at 0x100ce05
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1016034]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x220]
push eax
push 0x100c707
push 0x100cd48
xor edi, edi
push ebx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], ecx
call fcn.0100c9a5
push esi
push ebx
mov dword [ebp - 0x224], eax
call fcn.0100c6cd
test eax, eax
jne 0x100ce8b
inc dword [ebp - 0x21c]
cmp dword [ebp - 0x220], edi
jne 0x100ce8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x21c], edi
jbe 0x100cf38
push 0x204
lea eax, [ebp - 0x208]
push edi
push eax
mov dword [ebp - 0x20c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x100cecf
mov word [ebp - 0x20c], ax
xor eax, eax
lea ecx, [ebp - 0x20c]
cmp ax, word [ebp - 0x20c]
jne 0x100cee5
mov ecx, 0x1003a30
cmp dword [ebp - 0x21c], 1
mov eax, 0x1003a2c
jne 0x100cef8
mov eax, 0x1003178
push ecx
push dword [ebp - 0x220]
push ebx
push eax
push dword [ebp - 0x21c]
push 0x1003968
push 0x4000000
push 0x1016414
call fcn.0100b1ab
add esp, 0x20
cmp dword [ebp - 0x220], edi
je 0x100cf32
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x224], edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
xor ecx, ebp
pop edi
call fcn.0100a4c9
leave
ret

Function at 0x100d624
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x100d6bb
cmp dword [ebp + 0x18], esi
je 0x100d6bb
push edi
cmp dword [ebp + 0xc], esi
je 0x100d692
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push 0x100414c
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100d6aa
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100d6aa
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp edi, esi
sete al
pop edi
jmp 0x100d6c5
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
leave
ret 0x18
Function at 0x100d6cf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x100d6f1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 0xc
push esi
cmp dword [ebp + 0xc], edi
je 0x100d722
lea ecx, [ebp - 4]
push ecx
push 0x20019
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d714
cmp dword [ebp - 4], edi
jne 0x100d725
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
jmp 0x100d6ec
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], edi
je 0x100d743
push edi
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x100d746
xor esi, esi
inc esi
cmp dword [ebp + 0xc], edi
je 0x100d716
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100d716
Function at 0x100d75b
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
cmp eax, edi
jne 0x100d788
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 0x10
cmp dword [ebp + 0xc], edi
je 0x100d7ba
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x100d7ad
cmp dword [ebp - 0xc], edi
jne 0x100d7bd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x100d783
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call ebx
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x100d90e
cmp dword [ebp - 8], 1
je 0x100d7f9
cmp dword [ebp - 8], 2
je 0x100d7f9
mov dword [ebp + 8], 0xd
jmp 0x100d90e
push esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100d904
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call ebx
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x100d842
cmp dword [ebp - 8], 1
je 0x100d857
cmp dword [ebp - 8], 2
je 0x100d857
mov dword [ebp + 8], 0xd
push dword [ebp - 4]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], edi
jmp 0x100d90d
cmp dword [ebp + 0x14], 1
jne 0x100d90d
cmp dword [ebp - 8], 2
jne 0x100d90d
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
push edi
push dword [ebp - 4]
call ebx
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x100d8e5
add eax, eax
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0x10], eax
cmp eax, edi
je 0x100d8b6
push dword [ebp - 0x10]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x100d8b6
push dword [ebp - 4]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x100d90d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov dword [ebp + 8], eax
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
cmp dword [ebp + 0x10], edi
je 0x100d84f
push dword [ebp + 0x10]
push edi
call esi
push eax
call ebx
jmp 0x100d84f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov dword [ebp + 8], eax
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x100d90d
jmp 0x100d84f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
pop esi
pop ebx
cmp dword [ebp + 0xc], edi
je 0x100d91d
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 4]
jmp 0x100d7ad
Function at 0x100d948
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
cmp eax, esi
jne 0x100d976
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100d9e3
cmp dword [ebp + 0xc], esi
je 0x100d99b
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100d998
cmp dword [ebp - 4], esi
jne 0x100d99e
push eax
jmp 0x100d96c
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x100d9c7
cmp dword [ebp - 0xc], 4
je 0x100d9ca
push 0xd
pop edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
je 0x100d9d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x100da40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1016034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x228], 0x105
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], 1
cmp eax, esi
je 0x100dc0d
cmp edi, esi
je 0x100dc0d
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp ecx, esi
je 0x100dae9
push esi
push ecx
push edi
call fcn.0100d6cf
test eax, eax
je 0x100db8b
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp - 0x224]
push edi
call ebx
mov edi, eax
cmp edi, esi
jne 0x100db8e
cmp dword [ebp - 0x218], esi
je 0x100db8e
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, 0x103
je 0x100dbe7
cmp edi, esi
je 0x100db2b
mov dword [ebp - 0x214], esi
cmp dword [ebp - 0x214], esi
je 0x100db96
push esi
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x210]
push dword [ebp + 0x10]
push esi
push esi
push eax
push dword [ebp - 0x218]
call ebx
mov edi, eax
cmp edi, esi
jne 0x100db96
push dword [ebp + 0x1c]
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x220]
call dword [ebp - 0x22c]
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x220]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100db9c
push 3
pop edi
mov dword [ebp - 0x214], esi
jmp 0x100dbfd
mov dword [ebp - 0x214], esi
cmp dword [ebp - 0x214], esi
je 0x100dbc9
cmp dword [ebp + 0x20], 1
jne 0x100dbc9
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp edi, esi
je 0x100dbc9
mov dword [ebp - 0x214], esi
inc dword [ebp - 0x21c]
mov dword [ebp - 0x228], 0x105
cmp dword [ebp - 0x214], esi
jne 0x100dae9
jmp 0x100dbe9
xor edi, edi
cmp dword [ebp - 0x224], esi
je 0x100dbfd
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x214]
pop ebx
jmp 0x100dc17
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100a4c9
leave
ret 0x1c