joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e780
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x101e8408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push edi
mov ax, word [esi + 2]
mov edi, ecx
mov word [esp + 0x10], ax
push 0
lea eax, [edi + 0x114]
push 0
push eax
mov dword [esp + 0x30], eax
call ebx
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1006e7cf
and word [esi + 2], 0xffdf
jmp 0x1006e7e4
test ebp, ebp
jne 0x1006e7db
and word [esi + 2], 0xffdf
jmp 0x1006e7e4
cmp ebp, 1
jne 0x1006e7e4
or byte [esi + 2], 0x20
add edi, 0x118
push 0
push 0
push edi
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1006e800
and word [esi + 2], 0xffef
jmp 0x1006e815
test ebx, ebx
jne 0x1006e80c
and word [esi + 2], 0xffef
jmp 0x1006e815
cmp ebx, 1
jne 0x1006e815
or byte [esi + 2], 0x10
mov ax, word [esi + 2]
test al, 1
jne 0x1006e822
or ah, 5
jmp 0x1006e825
or ah, 0xa
mov word [esi + 2], ax
and word [esi + 2], 0xcfff
mov esi, dword [esp + 0x24]
cmp ebp, dword [esi]
jne 0x1006e83f
cmp ebx, dword [edi]
je 0x1006e90a
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString_2
mov eax, dword [edi]
mov dword [esp + 0x1c], 0
cmp eax, 0xffffffff
jne 0x1006e85e
mov edi, 0x1026076c
jmp 0x1006e86c
test eax, eax
mov edi, 0x10260768
je 0x1006e86c
mov edi, 0x10260764
cmp ebx, 0xffffffff
jne 0x1006e878
mov edx, 0x1026076c
jmp 0x1006e886
test ebx, ebx
mov edx, 0x10260768
je 0x1006e886
mov edx, 0x10260764
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x1006e894
mov ecx, 0x1026076c
jmp 0x1006e8a2
test eax, eax
mov ecx, 0x10260768
je 0x1006e8a2
mov ecx, 0x10260764
cmp ebp, 0xffffffff
jne 0x1006e8ae
mov eax, 0x1026076c
jmp 0x1006e8bc
test ebp, ebp
mov eax, 0x10260768
je 0x1006e8bc
mov eax, 0x10260764
push edi
push edx
push ecx
push eax
lea ecx, [esp + 0x34]
push str.CSocketData::ProcessSendFlag_ZLib__s_____s___Encyrpt__s_____s___r_n
push ecx
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x18
test eax, eax
je 0x1006e8f9
mov edx, dword [esp + 0x24]
push edx
push str._IOCP___s
push str.IOCPSendProc
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov ax, word [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1006f6d0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push 4
push eax
push 0x7010
push 0xffff
push ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
neg eax
sbb eax, eax
inc eax
pop ecx
ret
Function at 0x1006fa10
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101e84c8
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x18]
push edi
test esi, esi
je 0x1006fb39
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1006fab2
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString_2
mov dword [esp + 0x10], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [esp + 0x20]
push str.PostAccept
push eax
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0xc
test eax, eax
je 0x1006fa9c
mov ecx, dword [esp + 0x1c]
push ecx
push str._IOCP___s
push str.IOCPAccept
push edi
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42u.DLL_CString::CString
jmp 0x1006fb60
mov eax, dword [0x10282758]
test eax, eax
je 0x1006fad9
push str.WSASocket__
push str._IOCP___s
push str.IOCPAccept
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea eax, [esi + 0x18]
mov dword [esi + 0x14], edi
mov dword [esi + 0x2c], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1006fb29
mov ecx, esi
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
mov edx, dword [esp + 0x20]
push edx
push esi
add esi, 0x28
push esi
push eax
mov eax, dword [esp + 0x28]
push edi
push eax
call fcn.1006f370
add esp, 0x18
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [0x10282758]
test eax, eax
je 0x1006fb60
push str.PostAccept:_AcceptEx
jmp 0x1006fb47
mov eax, dword [0x10282758]
test eax, eax
je 0x1006fb60
push str.Error:_PostAccept
push str._IOCP___s
push str.IOCPAccept
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
mov ecx, dword [esp + 8]
pop edi
mov eax, 3
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x1006fc40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x101e84f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
mov edx, esi
xor ecx, ecx
push edi
lea eax, [esi + 0x18]
mov dword [edx], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
push ecx
push esi
mov dword [edx + 0x10], ecx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x14]
push eax
mov dword [esi + 0x2c], 3
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x1006fcb8
pop edi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
cmp eax, 0xffffffff
jne 0x1006fdbf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x3e5
je 0x1006fdd5
cmp edi, 0x2733
je 0x1006fdd5
cmp edi, 0x2747
jne 0x1006fd5f
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString_2
mov ecx, dword [esi + 0x14]
push edi
push ecx
lea edx, [esp + 0x2c]
push str.WSARecv
push edx
mov dword [esp + 0x2c], 0
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x10
test eax, eax
je 0x1006fd38
mov eax, dword [esp + 0x24]
push eax
push str._IOCP___s
push str.IOCPRecv
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_2
mov ecx, dword [esi + 0x14]
push edi
push ecx
lea edx, [esp + 0x10]
push 0x10260948
push edx
mov dword [esp + 0x2c], 1
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x10
test eax, eax
je 0x1006fdae
mov eax, dword [esp + 8]
push eax
push str._IOCP___s
push str.IOCPRecv
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1006fdf0
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x101e8510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, eax
mov esi, dword [eax + 0x14]
xor edx, edx
mov dword [edi], edx
lea ecx, [eax + 0x18]
mov dword [esp + 0xc], 0
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
push edx
push eax
mov dword [edi + 0x10], edx
push edx
lea edx, [esp + 0x18]
mov dword [eax + 0x2c], 2
mov eax, dword [eax + 0x14]
push edx
push 1
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x1006fe5f
pop edi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp eax, 0xffffffff
jne 0x1006ff60
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x3e5
je 0x1006ff76
cmp edi, 0x2733
je 0x1006ff76
cmp edi, 0x2747
jne 0x1006ff03
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_2
push edi
push esi
lea ecx, [esp + 0x28]
push str.WSASend
push ecx
mov dword [esp + 0x28], 0
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x10
test eax, eax
je 0x1006fedc
mov edx, dword [esp + 0x20]
push edx
push str._IOCP___s
push str.IOCPSend
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_2
push edi
push esi
lea eax, [esp + 0x10]
push 0x102609e4
push eax
mov dword [esp + 0x28], 1
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x10
test eax, eax
je 0x1006ff4f
mov ecx, dword [esp + 8]
push ecx
push str._IOCP___s
push str.IOCPSend
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1006ff90
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x101e8528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0xc]
push 4
push eax
push 8
push 0xffff
push esi
xor ebx, ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x10070012
push ebx
lea ecx, [esp + 0x3c]
push ebx
push ecx
lea edx, [esp + 0x28]
push 0xc
push edx
lea eax, [esp + 0x24]
push 0xc
push eax
push 0x98000004
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x10070012
mov ebx, 1
lea ecx, [esp + 0x3c]
call sub.MFC42u.DLL_CString::CString_2
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push esi
lea ecx, [esp + 0x4c]
push str.EnableKeepAlive_s__lu__nInterval__lu__error_0x_x__ret__lu__n
push ecx
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x18
test eax, eax
je 0x10070066
mov edx, dword [esp + 0x3c]
push edx
push str._IOCP___s
push str.IOCPAccept
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x100767d0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10076829
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10076829
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x10076830
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x1007680d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1007682b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret
Function at 0x1007c540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1007c590
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1007c590
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x1007c595
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1007c57b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x1007c5a2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x100871e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x10087221
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10087223
mov esi, edi
test esi, esi
je 0x10087298
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1008728d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1008728d
cmp dword [esp + 0x1c], eax
jbe 0x1008725e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1008728d
cmp esi, edi
je 0x1008727f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x10087298
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x100872b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x10087315
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x10087315
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x10087315
cmp dword [esp + 0x18], eax
jbe 0x100872fb
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x10087319
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x10087530
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x100875a4
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100875a4
cmp dword [esp + 0x10], 3
jne 0x100875a4
mov edx, dword [esp + 0x18]
push edx
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 4
test edi, edi
je 0x100875a4
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1008759b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x100875b0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x101e8c5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString_2
mov ecx, dword [esp + 0x34]
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x1008761d
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1008761f
mov esi, edi
test esi, esi
je 0x100876e9
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100876de
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x10087661
cmp eax, 2
je 0x10087661
cmp eax, 6
je 0x10087661
cmp eax, 7
jne 0x100876de
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call sub.MFC42u.DLL_operatornew
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x100876c4
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::operator_1
cmp esi, dword [esp + 0x14]
je 0x100876b9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MFC42u.DLL_operatordelete
add esp, 4
jmp 0x100876fb
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x10]
push 0x102747b8
call sub.MFC42u.DLL_CString::operator_1
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x100876e9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x100876fb
push eax
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::operator_1
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.10071014
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x10087ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [ecx]
push edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call sub.MFC42u.DLL_CStringArray::SetSize
test esi, esi
je 0x10087d89
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10087d89
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x10087cfc
cmp eax, 2
je 0x10087cfc
cmp eax, 6
je 0x10087cfc
cmp eax, 7
jne 0x10087d89
mov eax, dword [esp + 0x1c]
add eax, 2
push eax
call sub.MFC42u.DLL_operatornew
mov ecx, dword [esp + 0x20]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10087d80
cmp word [ebx], ax
mov esi, ebx
je 0x10087d6a
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
mov edx, dword [ebp + 8]
push esi
push edx
mov ecx, ebp
call sub.MFC42u.DLL_CStringArray::SetAtGrow_1
push esi
call edi
lea esi, [esi + eax*2 + 2]
add esp, 4
cmp word [esi], 0
jne 0x10087d4e
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x10088340
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x1008836c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1008836c
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x10088420
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x1008845a
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x1008845a
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x10088490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101e8d28
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x100884e6
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100884eb
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x100885db
call fcn.101a7a50
test eax, eax
je 0x1008853b
mov edi, dword [ebp + 0x18]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100885d0
cmp esi, ebx
je 0x10088531
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100885dd
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10088546
xor edi, edi
jmp 0x1008857b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.100713b0
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.10072110
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100885c1
cmp esi, ebx
je 0x100885ab
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.10072920
mov eax, 1
jmp 0x100885dd
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.10072920
cmp esi, ebx
je 0x100885db
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret