joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107df67
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
mov ebx, 0x1007800
je 0x107dfa1
test byte [eax + 0x1c], 1
je 0x107dfa1
cmp byte [eax + 0x19], 5
jb 0x107dfa1
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
push esi
push edi
mov esi, 0x80
xor edi, edi
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call fcn.0107aa60
add esp, 0xc
mov dword [ebp - 8], edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], 4
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x107dff7
test byte [eax + 0x1c], 2
je 0x107dff7
cmp byte [eax + 0x19], 5
jb 0x107dff7
push dword [ebp + 8]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c2b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 8]
call dword [0x1001484]
mov edi, eax
xor edx, edx
cmp edi, edx
je 0x107e080
jg 0x107e019
mov dword [ebp - 4], edi
jmp 0x107e02a
mov ecx, edi
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], edx
jl 0x107e036
mov dword [ebp - 4], 0x80004005
mov ecx, dword [0x10b30cc]
cmp ecx, 0x10b30cc
je 0x107e0f9
test byte [ecx + 0x1c], 2
je 0x107e0f9
movzx eax, byte [ecx + 0x19]
xor edx, edx
cmp dword [ebp - 4], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x107e0f9
push edi
push dword [ebp - 4]
push ebx
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104cb2f
jmp 0x107e0f9
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
cmp ecx, esi
jbe 0x107e0bd
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x107e0b4
test byte [eax + 0x1c], 2
je 0x107e0b4
cmp byte [eax + 0x19], 2
jb 0x107e0b4
push edx
push esi
push edx
push ecx
push ebx
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0107df35
mov dword [ebp - 4], 0x80004005
jmp 0x107e0f9
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x107e0e5
test byte [eax + 0x1c], 2
je 0x107e0e5
cmp byte [eax + 0x19], 5
jb 0x107e0e5
push edx
push ecx
push ebx
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104d9bc
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
push dword [eax + 0x18]
push dword [ebp + 0xc]
call fcn.0107a61e
add esp, 0xc
push dword [ebp - 8]
call dword [0x100148c]
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
pop edi
pop esi
je 0x107e14f
test byte [eax + 0x1c], 1
je 0x107e14f
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp dword [ebp - 4], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x107e14f
cmp dword [ebp - 4], 0
jl 0x107e13a
mov ecx, dword [ebp + 0xc]
movsx ecx, word [ecx]
jmp 0x107e13d
or ecx, 0xffffffff
push ecx
push dword [ebp - 4]
push ebx
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01056e4a
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8
Function at 0x107e233
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10b3818]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x40c], eax
mov ecx, dword [0x10b30cc]
mov ebx, 0x10b30cc
cmp ecx, ebx
je 0x107e28e
test byte [ecx + 0x1c], 1
je 0x107e28e
cmp byte [ecx + 0x19], 5
jb 0x107e28e
push dword [ebp + 0xc]
push esi
push 0x1007800
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104cb2f
mov ecx, dword [0x10b30cc]
movzx eax, word [esi]
xor edi, edi
cmp ax, 2
je 0x107e2a9
cmp ax, 0x17
je 0x107e2a9
mov edi, 0x80070057
jmp 0x107e370
push 2
push edi
push edi
push 0x401
lea eax, [ebp - 0x408]
push eax
push 0x80
push esi
call dword [0x1001488]
test eax, eax
je 0x107e319
call dword [0x1001494]
test eax, eax
mov edi, eax
jle 0x107e2e1
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x107e2ea
mov edi, 0x80004005
mov ecx, dword [0x10b30cc]
cmp ecx, ebx
je 0x107e3aa
test byte [ecx + 0x1c], 2
je 0x107e370
cmp byte [ecx + 0x19], 2
jb 0x107e370
push eax
push 0x1007800
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01028164
jmp 0x107e36a
cmp dword [ebp + 0xc], edi
je 0x107e358
cmp word [esi], 0x17
jne 0x107e358
lea eax, [ebp - 0x408]
push 0x25
push eax
call dword [0x1001570]
test eax, eax
pop ecx
pop ecx
je 0x107e33c
mov byte [eax], 0
lea eax, [ebp - 0x408]
push eax
push 0x10078a0
push dword [ebp - 0x40c]
call fcn.010292b1
add esp, 0xc
jmp 0x107e36a
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
call fcn.01040cdf
mov ecx, dword [0x10b30cc]
cmp ecx, ebx
je 0x107e3aa
test byte [ecx + 0x1c], 1
je 0x107e3aa
movzx eax, byte [ecx + 0x19]
xor edx, edx
test edi, edi
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x107e3aa
mov eax, dword [ebp - 0x40c]
push dword [eax]
push edi
push 0x1007800
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104cb61
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0107a6bf
leave
ret 0xc
Function at 0x107fcf2
Capabilities:
Delete registry value

Disassembly:
push 8
mov eax, 0x10a8978
call fcn.0107a6db
mov ebx, ecx
mov eax, dword [0x10b30cc]
mov esi, 0x10b30cc
cmp eax, esi
mov edi, 0x1007980
je 0x107fd33
test byte [eax + 0x1c], 1
je 0x107fd33
cmp byte [eax + 0x19], 5
jb 0x107fd33
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x69
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ab68
and dword [ebp - 0x14], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.01027916
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.01040d30
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0107e843
mov ebx, eax
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x107fd8b
test byte [eax + 0x1c], 2
je 0x107fd8b
cmp byte [eax + 0x19], 4
jb 0x107fd8b
push ebx
push edi
push 0x6a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov eax, dword [0x10b30cc]
test ebx, ebx
jne 0x107fde8
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x107fdc9
test byte [eax + 0x1c], 2
je 0x107fdc9
cmp byte [eax + 0x19], 4
jb 0x107fdc9
push ebx
push dword [ebp + 0xc]
push edi
push 0x6b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
mov eax, dword [0x10b30cc]
cmp ebx, 2
jne 0x107fe15
mov ebx, 0x490
cmp eax, esi
je 0x107fe42
test byte [eax + 0x1c], 2
je 0x107fe15
cmp byte [eax + 0x19], 4
jb 0x107fe15
push edi
push 0x6c
jmp 0x107fe05
cmp ebx, 2
jne 0x107fe15
mov ebx, 0x490
cmp eax, esi
je 0x107fe42
test byte [eax + 0x1c], 2
je 0x107fe15
cmp byte [eax + 0x19], 4
jb 0x107fe15
push edi
push 0x6d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x107fe42
test byte [eax + 0x1c], 1
je 0x107fe42
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x107fe42
push ebx
push edi
push 0x6e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01026e74
lea ecx, [ebp - 0x14]
call fcn.01027fe2
mov eax, ebx
call fcn.0107a7c7
ret 8

Function at 0x1083999
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x30]
xor ebx, ebx
push edi
inc ebx
call dword [fcn.010011c4]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x10839d0
cmp dword [eax + 0xc], 0
je 0x10839d0
cmp dword [eax], 0
je 0x10839d0
push dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push dword [ebp + 0xc]
call dword [eax + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1083a02
mov eax, dword [eax]
test eax, eax
je 0x1083a02
cmp dword [ebp + 0xc], 0
jl 0x1083a02
cmp dword [ebp + 8], 0xc8
je 0x10839f5
cmp dword [ebp + 8], 0x193
jne 0x1083a02
cmp dword [esi + 8], 0
jne 0x1083a02
push eax
call dword [0x1001178]
push edi
call dword [fcn.010011c0]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x1083b5e
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
xor ebx, ebx
inc ebx
push ebx
push 0x80010000
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], edi
call dword [0x1001154]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x1083cb1
push edi
push eax
call dword [0x10012a8]
cmp eax, 0x78
mov dword [esi + 0x10], eax
jb 0x1083c7d
push eax
call fcn.0107a4e3
cmp eax, edi
pop ecx
mov dword [esi + 0xc], eax
je 0x1083c55
push edi
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0x10]
push eax
push dword [ebp - 8]
call dword [0x10012ac]
test eax, eax
jne 0x1083bf4
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1083ca3
test byte [eax + 0x1c], bl
je 0x1083ca3
push 0x1007c60
push 0x1c
jmp 0x1083c43
mov eax, dword [esi + 0x10]
cmp dword [ebp + 8], eax
je 0x1083c1e
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1083ca3
test byte [eax + 0x1c], bl
je 0x1083ca3
push 0x1007c60
push 0x1d
jmp 0x1083c43
push eax
push dword [esi + 0xc]
call fcn.01086366
test eax, eax
jne 0x1083c50
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1083ca3
test byte [eax + 0x1c], bl
je 0x1083ca3
push 0x1007c60
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
jmp 0x1083ca3
mov dword [ebp - 4], ebx
jmp 0x1083ca3
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1083ca3
test byte [eax + 0x1c], bl
je 0x1083ca3
push dword [esi + 0x10]
push 0x1007c60
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
jmp 0x1083ca3
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1083ca3
test byte [eax + 0x1c], bl
je 0x1083ca3
push dword [ebp + 8]
push 0x1007c60
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c2b
push dword [ebp - 8]
call dword [fcn.010011f8]
cmp dword [ebp - 4], edi
jne 0x1083cc5
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x1083cc5
push eax
call fcn.0107a4d2
pop ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1085c9f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
add eax, eax
push ebx
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp + 0x18], ebx
je 0x1085db2
cmp word [eax], bx
je 0x1085db2
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1085d97
cmp word [edi], bx
je 0x1085d97
cmp dword [ebp + 0x14], ebx
jne 0x1085d0b
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085dd6
test byte [eax + 0x1c], 1
je 0x1085dd6
push 0x1007eac
push 0xc
jmp 0x1085dcb
push esi
lea ecx, [ebp + 0x18]
push ecx
mov ecx, dword [0x10b7f20]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x1085d84
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
jne 0x1085d84
cmp dword [ebp - 4], 1
je 0x1085d84
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
push 0xd
pop esi
je 0x1085d84
test byte [eax + 0x1c], 1
je 0x1085d84
push dword [ebp - 4]
push edi
push 0x1007eac
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
cmp dword [ebp + 0x18], ebx
je 0x1085d92
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x1085dd9
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085dd6
test byte [eax + 0x1c], 1
je 0x1085dd6
push 0x1007eac
push 0xb
jmp 0x1085dcb
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085dd6
test byte [eax + 0x1c], 1
je 0x1085dd6
push 0x1007eac
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x14
Function at 0x1085de4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], edi
je 0x1085ef8
cmp word [eax], di
je 0x1085ef8
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x1085edd
cmp word [ebx], di
je 0x1085edd
cmp dword [ebp + 0x14], edi
jne 0x1085e50
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085f1c
test byte [eax + 0x1c], 1
je 0x1085f1c
push 0x1007eac
push 0x16
jmp 0x1085f11
push esi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10b7f20]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x1085eca
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x1085eca
cmp dword [ebp - 8], 4
je 0x1085eca
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085ec7
test byte [eax + 0x1c], 1
je 0x1085ec7
push dword [ebp - 8]
push ebx
push 0x1007eac
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
push 0xd
pop esi
cmp dword [ebp - 4], edi
je 0x1085ed8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x1085f1f
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085f1c
test byte [eax + 0x1c], 1
je 0x1085f1c
push 0x1007eac
push 0x15
jmp 0x1085f11
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1085f1c
test byte [eax + 0x1c], 1
je 0x1085f1c
push 0x1007eac
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x1085f2a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 8
mov dword [ebp - 4], edi
je 0x108603e
cmp word [eax], di
je 0x108603e
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x1086023
cmp word [ebx], di
je 0x1086023
cmp dword [ebp + 0x14], edi
jne 0x1085f96
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086062
test byte [eax + 0x1c], 1
je 0x1086062
push 0x1007eac
push 0x1e
jmp 0x1086057
push esi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10b7f20]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x1086010
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x1086010
cmp dword [ebp - 8], 0xb
je 0x1086010
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x108600d
test byte [eax + 0x1c], 1
je 0x108600d
push dword [ebp - 8]
push ebx
push 0x1007eac
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
push 0xd
pop esi
cmp dword [ebp - 4], edi
je 0x108601e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x1086065
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086062
test byte [eax + 0x1c], 1
je 0x1086062
push 0x1007eac
push 0x1d
jmp 0x1086057
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086062
test byte [eax + 0x1c], 1
je 0x1086062
push 0x1007eac
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x1086070
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x1086164
cmp word [eax], di
je 0x1086164
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
je 0x1086149
cmp word [ebx], di
je 0x1086149
push esi
push edi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10b7f20]
push dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20006
push ecx
push edi
push edi
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
je 0x10860f7
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086136
test byte [eax + 0x1c], 1
je 0x1086136
push esi
push dword [ebp + 0xc]
push 0x1007eac
push 0x22
jmp 0x108612b
push 8
lea eax, [ebp + 0x18]
push eax
push 0xb
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x1086136
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086136
test byte [eax + 0x1c], 1
je 0x1086136
push esi
push ebx
push 0x1007eac
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
cmp dword [ebp - 4], edi
je 0x1086144
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x108618b
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086188
test byte [eax + 0x1c], 1
je 0x1086188
push 0x1007eac
push 0x21
jmp 0x108617d
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086188
test byte [eax + 0x1c], 1
je 0x1086188
push 0x1007eac
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x18

Function at 0x1086196
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x1086222
cmp word [eax], di
je 0x1086222
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x1086207
cmp word [esi], di
je 0x1086207
push ebx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10b7f20]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20006
push ecx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x10861f4
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp dword [ebp - 4], edi
je 0x1086202
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
jmp 0x1086249
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086246
test byte [eax + 0x1c], 1
je 0x1086246
push 0x1007eac
push 0x25
jmp 0x108623b
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1086246
test byte [eax + 0x1c], 1
je 0x1086246
push 0x1007eac
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0x57
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x1086818
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x1086982
cmp word [esi], bx
je 0x1086982
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x1086967
cmp word [eax], bx
je 0x1086967
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x108694c
cmp word [edi], bx
je 0x108694c
lea eax, [ebp - 8]
push eax
push 0x104
push edi
call fcn.0104399b
cmp eax, ebx
jge 0x10868a8
mov ecx, dword [0x10b30cc]
cmp ecx, 0x10b30cc
je 0x10868a0
test byte [ecx + 0x1c], 1
je 0x10868a0
push eax
push 0x1007eac
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01028164
push 0x57
pop esi
jmp 0x108693a
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x10b7f20]
push dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push ebx
push ebx
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x10868f6
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x108693a
test byte [eax + 0x1c], 1
je 0x108693a
push esi
push dword [ebp + 0xc]
push 0x1007eac
push 0x12
jmp 0x108692f
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x108693a
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x108693a
test byte [eax + 0x1c], 1
je 0x108693a
push esi
push edi
push 0x1007eac
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105f560
cmp dword [ebp - 4], ebx
je 0x1086948
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10869a9
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10869a6
test byte [eax + 0x1c], 1
je 0x10869a6
push 0x1007eac
push 0x10
jmp 0x108699b
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10869a6
test byte [eax + 0x1c], 1
je 0x10869a6
push 0x1007eac
push 0xf
jmp 0x108699b
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10869a6
test byte [eax + 0x1c], 1
je 0x10869a6
push 0x1007eac
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0x57
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10872ff
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, 0x80070057
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
jne 0x108734a
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1087516
test byte [eax + 0x1c], 1
je 0x1087516
push 0x1007eac
push 0x54
jmp 0x108740c
cmp dword [ebp + 0xc], esi
jne 0x1087375
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1087516
test byte [eax + 0x1c], 1
je 0x1087516
push 0x1007eac
push 0x55
jmp 0x108740c
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
neg eax
sbb eax, eax
push esi
and eax, 0x8000
push esi
add eax, 0x23
push eax
push esi
call dword [0x10013d4]
mov edi, eax
cmp edi, esi
jge 0x10873cc
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1087508
test byte [eax + 0x1c], 1
je 0x1087508
push edi
push 0x1007eac
push 0x56
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
jmp 0x1087508
cmp dword [ebp + 0x10], esi
je 0x10874d1
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
mov edi, 0x8007000c
push esi
call fcn.010870d3
test eax, eax
jne 0x108741c
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1087508
test byte [eax + 0x1c], 1
je 0x1087508
push 0x1007eac
push 0x57
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
jmp 0x1087508
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x10874d5
cmp dword [ebp - 8], esi
je 0x10874d5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
jne 0x108748c
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1087508
test byte [eax + 0x1c], 1
je 0x1087508
call dword [fcn.010011dc]
push eax
mov eax, dword [0x10b30cc]
push 0x1007eac
push 0x59
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x10874ca
push esi
push dword [ebp - 0x10]
push esi
push dword [ebp - 0x14]
push 0x80000005
push 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
cmp eax, esi
je 0x10874d1
mov ecx, dword [0x10b30cc]
cmp ecx, 0x10b30cc
je 0x1087508
test byte [ecx + 0x1c], 1
je 0x1087508
push eax
push 0x1007eac
push 0x5a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01028164
jmp 0x1087508
xor edi, edi
jmp 0x1087508
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x1087508
test byte [eax + 0x1c], 1
je 0x1087508
call dword [fcn.010011dc]
push eax
push dword [ebp - 8]
mov eax, dword [0x10b30cc]
push 0x1007eac
push 0x58
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104cb2f
cmp dword [ebp - 4], esi
je 0x1087516
push dword [ebp - 4]
call dword [fcn.01001348]
mov eax, edi
pop edi
pop esi
leave
ret 0x10