joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010b4
Capabilities:
Read .ini file

Disassembly:
jmp 0x100045a0
sub esp, 0x134
mov eax, dword [0x10061404]
xor eax, esp
mov dword [esp + 0x130], eax
push esi
xor esi, esi
push str.LoadGroupCfgValues_Entering....
push 3
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.10001433
add esp, 8
cmp dword [0x100700b0], esi
je 0x100047bc
cmp dword [0x1006ff80], 1
jne 0x10004617
mov dword [0x100700a0], esi
pop esi
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.100140fa
add esp, 0x134
ret
push ebx
mov ebx, dword [0x10070088]
push ebp
mov ebp, dword [0x10070090]
push edi
xor edi, edi
mov dword [0x10070094], edi
mov edi, edi
mov edx, dword [ebx + 0xc]
xor eax, eax
test edx, edx
jbe 0x10004659
lea ecx, [ebp + 0x20]
lea esp, [esp]
cmp dword [ecx], esi
je 0x10004650
add eax, 1
add ecx, 0x64
cmp eax, edx
jb 0x10004640
jmp 0x10004659
add edi, 1
mov dword [0x10070094], edi
add esi, 1
cmp esi, 1
jbe 0x10004630
lea eax, [edi + edi*2]
add eax, eax
add eax, eax
add eax, eax
push eax
call fcn.10014a1c
mov ebx, dword [0x10070094]
add esp, 4
xor ecx, ecx
test ebx, ebx
mov dword [0x100700a0], eax
jbe 0x100046b8
mov edx, dword [0x10070088]
mov esi, dword [edx + 0xc]
mov edi, dword [0x10070090]
test esi, esi
jbe 0x100046b1
lea eax, [edi + 0x20]
mov edx, esi
lea esp, [esp]
cmp dword [eax], ecx
jne 0x100046a9
add dword [esp + ecx*4 + 0x20], 1
add eax, 0x64
sub edx, 1
jne 0x100046a0
add ecx, 1
cmp ecx, ebx
jb 0x10004693
xor edi, edi
test ebx, ebx
jbe 0x100047aa
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x100046d0
push edi
push str.Group
lea eax, [esp + 0x38]
push str._s_d
push eax
call fcn.100012a3
add esp, 0x10
push 0x10070538
push 0x100
lea ecx, [esp + 0x48]
push ecx
push 0x1004d83e
lea edx, [esp + 0x40]
push edx
push 0x100700d0
call ebx
mov edx, dword [0x100700a0]
lea ecx, [edi + edi*2]
lea esi, [edx + ecx*8]
mov edx, dword [esp + edi*4 + 0x20]
xor ecx, ecx
test edi, edi
setne cl
test eax, eax
mov dword [esi + 4], edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [esp + 0x14]
mov dword [esi + 0x14], edx
mov ecx, dword [0x10070098]
mov dword [esi + 8], ecx
mov edx, dword [0x1007009c]
mov dword [esi + 0xc], edx
je 0x1000479b
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x50]
push str._d___d___d___d
push ecx
call fcn.100140ba
add esp, 0x18
cmp dword [esp + 0x1c], 0
je 0x1000479b
mov edx, dword [esp + 0x18]
mov dword [esi + 4], edx
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [0x10070098]
mov dword [esi + 8], edx
mov eax, dword [0x1007009c]
mov dword [esi + 0xc], eax
add edi, 1
cmp edi, dword [0x10070094]
jb 0x100046d0
push str.LoadGroupCfgValues_Exiting....
push 3
call fcn.10001433
add esp, 8
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x134]
pop esi
xor ecx, esp
call fcn.100140fa
add esp, 0x134
ret
Function at 0x100010d2
Capabilities:
Read .ini file

Disassembly:
jmp 0x10002560
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0x10070640
push eax
push ecx
push 0
push edx
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret

Function at 0x100010dc
Capabilities:
Set registry value

Disassembly:
jmp 0x1000e2a0
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
mov dword [esi + 0x14], 0
je 0x1000e2d4
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 4]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000e2d4
mov dword [esi + 0x14], 1
pop esi
ret

Function at 0x100010ff
Capabilities:
Set registry value

Disassembly:
jmp 0x10003c00
sub esp, 0x10c
mov eax, dword [0x10061404]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x118]
push edi
push 1
lea eax, [esp + 0xc]
push 0x10070430
push eax
xor edi, edi
call fcn.10001479
add esp, 0xc
cmp eax, 1
jne 0x10003cb7
mov edx, dword [esi + 0x10]
xor ecx, ecx
cmp dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
sete cl
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 4]
push eax
movzx eax, byte [esi]
push ecx
movzx ecx, byte [esp + 0x128]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push str._d__d__d__d__d__d__d
push edx
call fcn.10001348
lea eax, [esp + 0x30]
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10003c77
mov ecx, dword [esp + 8]
sub eax, edx
push eax
lea eax, [esp + 0x10]
push eax
push 1
push 0
add esi, 0x18
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10003cb2
push str.__ERROR__unable_to_change_learned_entry_
push 3
call fcn.10001433
add esp, 8
xor edi, edi
jmp 0x10003cb7
mov edi, 1
mov edx, dword [esp + 8]
push edx
call fcn.1000113b
mov ecx, dword [esp + 0x114]
add esp, 4
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100140fa
add esp, 0x10c
ret
Function at 0x1000111d
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1000e4d0
push ecx
mov eax, dword [0x10070324]
test eax, eax
push edi
mov edi, 1
jne 0x1000e4f4
push str.RdShData:___ERROR__uanble_to_signal_MUTEX_object_
push 3
call fcn.10001433
add esp, 8
xor eax, eax
pop edi
pop ecx
ret
push ebx
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0xc]
push eax
call fcn.100013c5
mov ebx, dword [esp + 0x18]
mov esi, eax
add esp, 4
cmp esi, 1
jne 0x1000e545
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000e53a
xor edi, edi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10070324]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x1000e559
test edi, edi
jne 0x1000e57b
xor edi, edi
cmp esi, 1
mov eax, str.opening
je 0x1000e56a
mov eax, str.reading
push ebx
push eax
push str.RdShData:___ERROR__failed__s__s_in_reg_shared_data_
push 7
call fcn.10001433
add esp, 0x10
pop esi
pop ebx
mov eax, edi
pop edi
pop ecx
ret

Function at 0x10001186
Capabilities:
Read .ini file

Disassembly:
jmp 0x10002530
mov eax, dword [esp + 4]
push 0x10070538
push 0
push eax
push 0x100700d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
ret

Function at 0x1000118b
Capabilities:
Set registry value

Disassembly:
jmp 0x10001ff0
push ecx
push esi
push edi
lea eax, [esp + 8]
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000002
mov esi, ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1000203e
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
push str.Speaker_Configuration
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10002033
mov edi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 8], 0
je 0x10002057
cmp dword [esp + 0x14], 0
je 0x10002057
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.1000140b
test edi, edi
pop edi
pop esi
je 0x10002073
mov edx, dword [0x100631a0]
push 0
push 0
push edx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret 8

Function at 0x10001195
Capabilities:
Delete registry value

Disassembly:
jmp 0x1000ebd0
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
mov esi, 1
call fcn.1000123a
mov edi, dword [esp + 0x14]
add esp, 4
cmp eax, esi
jne 0x1000ec15
mov ecx, dword [esp + 8]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1000ebff
xor esi, esi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000ec2f
mov eax, str.opening
jmp 0x1000ec1e
test eax, eax
jne 0x1000ec2f
mov eax, str.deleting
push edi
push eax
push str.ReadAppPathsData:___ERROR__failed__s__s_in_reg_app_paths_
push 7
call fcn.10001433
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x10001217
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1000e2f0
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
mov dword [esp + 4], 0
mov dword [esi + 0x14], 0
je 0x1000e364
mov ecx, dword [esi + 0xc]
push edi
lea edi, [esi + 0x10]
push edi
push ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e348
mov edx, dword [edi]
mov eax, dword [esp + 8]
push edx
push eax
push str.RdShData:_After_read_dwDatType__0x_x__m_dwDataSize__0x_x
push 3
call fcn.10001433
add esp, 0x10
mov dword [esi + 0x14], 1
jmp 0x1000e363
mov ecx, dword [edi]
mov edx, dword [esp + 8]
mov eax, dword [esi + 4]
push ecx
push edx
push eax
push str.RdShData:___ERROR__Registry_Read_FAILED_for__s..dwDatType__0x_x__m_dwDataSize__0x_x
push 3
call fcn.10001433
add esp, 0x14
pop edi
cmp dword [esi + 0x14], 0
jne 0x1000e373
mov ecx, dword [esi + 0xc]
mov byte [ecx], 0
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
cmp edx, dword [esi + 8]
je 0x1000e389
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], 0
mov byte [eax], 0
pop esi
pop ecx
ret

Function at 0x10001221
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x100024d0
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
je 0x10002512
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000250a
cmp dword [esp + 4], 4
je 0x10002512
mov eax, dword [esp + 0x14]
add esp, 8
ret
mov eax, dword [esp + 0xc]
add esp, 8
ret
Function at 0x10001253
Capabilities:
Set registry value

Disassembly:
jmp 0x10004860
sub esp, 0x110
mov eax, dword [0x10061404]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
mov esi, dword [esp + 0x11c]
push edi
push 1
lea eax, [esp + 0xc]
push 0x10070430
push eax
xor edi, edi
call fcn.10001479
add esp, 0xc
cmp eax, 1
jne 0x10004972
call fcn.100013d9
push eax
push 0x1004de1c
lea edi, [esi + 0x18]
push str._s_d
push edi
mov dword [esp + 0x1c], eax
call fcn.100012a3
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp dword [esi + 0x14], 1
sete cl
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 4]
push eax
movzx eax, byte [esi]
push ecx
movzx ecx, byte [esp + 0x13c]
push edx
push eax
push ecx
lea edx, [esp + 0x3c]
push str._d__d__d__d__d__d__d
push edx
call fcn.10001348
lea eax, [esp + 0x44]
add esp, 0x34
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10004900
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0
push edi
push ecx
call esi
test eax, eax
je 0x1000493a
push str.__ERROR__unable_to_store_learned_entry_
push 3
call fcn.10001433
add esp, 8
xor edi, edi
jmp 0x10004972
mov eax, dword [esp + 8]
add dword [esp + 0xc], 1
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.LZCount
push eax
call esi
test eax, eax
je 0x1000496d
push str.__ERROR__unable_to_increment_entry_count_
push 3
call fcn.10001433
add esp, 8
xor edi, edi
jmp 0x10004972
mov edi, 1
mov ecx, dword [esp + 8]
push ecx
call fcn.1000113b
mov ecx, dword [esp + 0x118]
add esp, 4
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100140fa
add esp, 0x110
ret
Function at 0x10001262
Capabilities:
Create thread

Disassembly:
jmp 0x10007ca0
cmp dword [0x1006fda4], 0
je 0x10007e86
cmp dword [0x1006fe5c], 0
jne 0x10007e71
cmp dword [0x1006fe50], 1
je 0x10007e71
cmp dword [0x1006fdec], 1
je 0x10007e71
push 0x1006fe58
push 0
push 0x1006fda4
push 0x1000108c
push 0x3e8
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x1006fe5c], eax
je 0x10007e77
mov eax, dword [0x1006fda8]
push eax
push 1
call fcn.10001091
add esp, 8
cmp eax, 1
mov eax, str.succeeded
je 0x10007d1e
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvUnload____s
push 4
call fcn.10001433
mov ecx, dword [0x1006fdb0]
push ecx
push 3
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007d4b
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvResume____s
push 4
call fcn.10001433
mov edx, dword [0x1006fdb8]
push edx
push 5
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007d78
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvPMPolicy____s
push 4
call fcn.10001433
mov eax, dword [0x1006fdbc]
push eax
push 6
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007da4
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvPMStatus____s
push 4
call fcn.10001433
mov ecx, dword [0x1006fdc0]
push ecx
push 7
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007dd1
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvPMPower____s
push 4
call fcn.10001433
mov edx, dword [0x1006fdc4]
push edx
push 8
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007dfe
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvSense____s
push 4
call fcn.10001433
mov eax, dword [0x1006fdc8]
push eax
push 9
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007e2a
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvSpkrCfg____s
push 4
call fcn.10001433
mov ecx, dword [0x1006fdcc]
push ecx
push 0xa
call fcn.10001091
add esp, 0x14
cmp eax, 1
mov eax, str.succeeded
je 0x10007e57
mov eax, str.failed_
push eax
push str._______________SetEventHandle:_hEvSpdifCap____s
push 4
call fcn.10001433
add esp, 0xc
mov dword [0x1006fe50], 1
mov eax, 1
ret
push str.__ERROR__CreateThread_for_event_handling_failed_
push 3
call fcn.10001433
add esp, 8
xor eax, eax
ret
Function at 0x100012d0
Capabilities:
Set registry value

Disassembly:
jmp 0x1000e3f0
push ecx
mov eax, dword [0x10070324]
test eax, eax
push edi
mov edi, 1
jne 0x1000e414
push str.WrShData:___ERROR__uanble_to_signal_MUTEX_object_
push 3
call fcn.10001433
add esp, 8
xor eax, eax
pop edi
pop ecx
ret
push ebx
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0xc]
push eax
call fcn.100013c5
mov ebx, dword [esp + 0x18]
mov esi, eax
add esp, 4
cmp esi, 1
jne 0x1000e465
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1000e45a
xor edi, edi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10070324]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x1000e479
test edi, edi
jne 0x1000e49b
xor edi, edi
cmp esi, 1
mov eax, str.opening
je 0x1000e48a
mov eax, str.writing
push ebx
push eax
push str.WrShData:___ERROR__failed__s__s_in_reg_shared_data_
push 7
call fcn.10001433
add esp, 0x10
pop esi
pop ebx
mov eax, edi
pop edi
pop ecx
ret
Function at 0x100012ee
Capabilities:
Read .ini file

Disassembly:
jmp 0x10003010
push esi
xor esi, esi
cmp dword [0x100700b0], esi
je 0x1000312a
push edi
push 0x10070538
push esi
push str.FMute
push 0x100700d0
mov dword [0x1006fe0c], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, 1
cmp eax, edi
jne 0x10003129
mov eax, dword [0x10070088]
mov ecx, dword [eax + 0x160]
shr ecx, 0xa
and ecx, 7
mov dword [0x1006fddc], ecx
je 0x10003129
cmp ecx, 3
je 0x10003129
cmp ecx, 6
jae 0x10003129
mov dl, 8
push ebx
mov bl, dl
mov byte [0x1006fde1], dl
mov byte [0x1006fde0], bl
xor ecx, ecx
cmp dword [eax + 0xc], esi
jbe 0x10003128
push ebp
mov ebp, dword [eax + 0x10]
cmp dword [esi + ebp + 4], 0
jne 0x100030a7
mov bl, cl
mov byte [0x1006fde0], bl
mov ebp, dword [eax + 0x10]
cmp dword [esi + ebp + 4], edi
jne 0x100030b8
mov dl, cl
mov byte [0x1006fde1], dl
add ecx, edi
add esi, 0x64
cmp ecx, dword [eax + 0xc]
jb 0x10003095
cmp bl, 8
je 0x10003127
cmp dl, 8
je 0x10003127
cmp bl, dl
je 0x10003127
mov esi, dword [eax + 0x10]
movzx ebp, bl
movzx edi, dl
mov ecx, ebp
imul ecx, ecx, 0x64
mov ebx, dword [esi + ecx + 0xc]
mov edx, edi
imul edx, edx, 0x64
cmp ebx, dword [edx + esi + 0xc]
je 0x10003113
movzx edi, byte [edi + eax + 0x198]
cmp dword [ecx + esi + 0xc], edi
je 0x10003113
movzx eax, byte [eax + ebp + 0x198]
cmp eax, dword [edx + esi + 0xc]
mov dword [0x1006fde4], 0
jne 0x1000311d
mov dword [0x1006fde4], 1
mov dword [0x1006fe0c], 1
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x1000130c
Capabilities:
Delete registry value

Disassembly:
jmp 0x1000e180
push ecx
mov eax, dword [0x10070324]
push ebx
push esi
push edi
push 0xffffffffffffffff
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
call fcn.100013c5
mov ebx, dword [esp + 0x18]
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x1000e1cb
mov edx, dword [esp + 0xc]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1000e1c0
xor edi, edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x10070324]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x1000e1e0
test edi, edi
jne 0x1000e200
cmp esi, 1
mov eax, str.opening
je 0x1000e1ef
mov eax, str.deleting
push ebx
push eax
push str.DeleteShDataValueObject:___ERROR__failed__s__s_in_reg_shared_data_
push 7
call fcn.10001433
add esp, 0x10
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10001311
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10002430
push ecx
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
je 0x10002491
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push 0
push str.TargetDir
push eax
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002491
cmp dword [esp + 0xc], 1
je 0x10002491
push str.__ERROR__target_directory_type_must_be_REG_SZ_
push 3
call fcn.10001433
mov eax, dword [esp + 0xc]
push 0x1004d83e
push eax
push esi
call fcn.10013fad
add esp, 0x14
push esi
push str.GetSMaxTargetDirectory:_SMax_target_directory_is__s
push 9
call fcn.10001433
add esp, 0xc
pop esi
pop ecx
ret

Function at 0x10001325
Capabilities:
Delete registry value

Disassembly:
jmp 0x10003890
push ecx
push 0
lea eax, [esp + 4]
push str.SoftwareAnalog_DevicesSoundMAX
push eax
call fcn.10001479
add esp, 0xc
cmp eax, 1
jne 0x1000391d
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.IDAdoaLnU
push ecx
call esi
mov edx, dword [esp + 4]
push str.IDAdoaLeR
push edx
call esi
mov eax, dword [esp + 4]
push str.IDAemuseR
push eax
call esi
mov ecx, dword [esp + 4]
push str.IDAteSMPyciloP
push ecx
call esi
mov edx, dword [esp + 4]
push str.IDAteSMPetatS
push edx
call esi
mov eax, dword [esp + 4]
push str.IDAteSMPrewoP
push eax
call esi
mov ecx, dword [esp + 4]
push str.IDAkcaJetatS
push ecx
call esi
mov edx, dword [esp + 4]
push str.IDArkpSgifnoC
push edx
call esi
mov eax, dword [esp + 4]
push str.IDAetaRpaCfidpS
push eax
call esi
pop esi
mov ecx, dword [esp]
push ecx
call fcn.1000113b
mov eax, 1
add esp, 8
ret
Function at 0x1000132a
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x100020a0
sub esp, 0x14
push esi
lea eax, [esp + 0xc]
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000002
mov esi, ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100020fb
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Speaker_Configuration
push ecx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
cmp eax, 6
jne 0x10002113
cmp dword [esi + 4], 0
jne 0x10002113
mov eax, 5
mov dword [esp + 8], eax
cmp dword [esi + 8], 0
je 0x100021a5
mov eax, dword [esi + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jl 0x100021a1
movzx eax, byte [esp + 4]
add eax, 0xffffffff
cmp eax, 7
ja case.0x1000213e.1
jmp dword [eax*4 + 0x100021ac]
mov ecx, 2
jmp 0x1000216c
mov ecx, 4
jmp 0x1000216c
mov ecx, 5
jmp 0x1000216c
xor ecx, ecx
cmp dword [esi + 4], ecx
setne cl
add ecx, 5
jmp 0x1000216c
mov ecx, 1
mov eax, dword [esp + 8]
cmp eax, ecx
mov dword [esp + 4], ecx
je 0x100021a5
cmp ecx, 2
jne 0x10002187
cmp eax, 3
jne 0x10002193
pop esi
add esp, 0x14
ret
cmp ecx, 1
jne 0x10002193
cmp eax, 0x80000001
je 0x100021a5
push 0
mov dword [esp + 0xc], ecx
push ecx
mov ecx, esi
call fcn.1000118b
mov eax, dword [esp + 8]
pop esi
add esp, 0x14
ret
Function at 0x100013a2
Capabilities:
Write file on windows

Disassembly:
jmp 0x1000a8c0
sub esp, 0x210
mov eax, dword [0x10061404]
xor eax, esp
mov dword [esp + 0x20c], eax
mov edx, dword [esp + 0x214]
test edx, edx
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
push esi
je 0x1000a90d
mov esi, dword [0x1006fda0]
test dword [esp + 0x21c], esi
je 0x1000aa02
cmp edx, dword [0x100700c4]
ja 0x1000aa02
push ecx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.100010af
add esp, 0xc
cmp dword [0x100700bc], 0
je 0x1000aa02
mov eax, dword [0x1007021c]
test eax, eax
je 0x1000aa02
push edi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x10070850
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a9f5
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000a980
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
test edi, edi
je 0x1000a9ed
cmp edi, 0x102
mov eax, str.timed_out
je 0x1000a9b8
mov eax, str.abandoned
push eax
lea eax, [esp + 0x14]
push str._s__ERROR__LOGMUTEX__s_before_being_signaled__r_n
push eax
call fcn.100014c4
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000a9d2
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, dword [0x1007021c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.100140fa
add esp, 0x210
ret

Function at 0x100013d9
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10003d20
sub esp, 0x10
push esi
push 1
lea eax, [esp + 0x10]
xor esi, esi
push 0x10070430
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call fcn.10001479
add esp, 0xc
cmp eax, 1
jne 0x10003d94
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push str.LZCount
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10003d7a
push str.__WARNING__unable_to_read_learned_entry_count_
jmp 0x10003d86
cmp dword [esp + 0x10], 4
je 0x10003d94
push str.__ERROR__bad_learned_entry_value_type_
push 3
mov dword [esp + 0xc], esi
call fcn.10001433
add esp, 8
mov edx, dword [esp + 0xc]
push edx
call fcn.1000113b
mov eax, dword [esp + 8]
push eax
push str.GetLearnedEntryCount:_count_is__d
push 9
call fcn.10001433
mov eax, dword [esp + 0x14]
add esp, 0x10
pop esi
add esp, 0x10
ret