joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017a98
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 8
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x10017ba9
cmp word [ecx], bx
je 0x10017ba9
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10017b8e
cmp word [esi], bx
je 0x10017b8e
cmp dword [ebp + 0x14], ebx
jne 0x10017b04
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017bcd
test byte [eax + 0x1c], 1
je 0x10017bcd
push 0x1000bcb8
push UnregisterTraceGuids
jmp 0x10017bc2
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003247c]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
push eax
push ebx
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10017b7b
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x10017b7b
cmp dword [ebp - 8], 0xb
je 0x10017b7b
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017b78
test byte [eax + 0x1c], 1
je 0x10017b78
push dword [ebp - 8]
push esi
push 0x1000bcb8
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001fe35
push 0xd
pop edi
cmp dword [ebp - 4], ebx
je 0x10017b89
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
jmp 0x10017bd0
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017bcd
test byte [eax + 0x1c], 1
je 0x10017bcd
push 0x1000bcb8
push 0x1d
jmp 0x10017bc2
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017bcd
test byte [eax + 0x1c], 1
je 0x10017bcd
push 0x1000bcb8
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
push reloc.KERNEL32.dll_VerSetConditionMask
pop eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x10017bdb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
je 0x10017ccc
cmp word [edi], cx
je 0x10017ccc
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x10017cb1
cmp word [ebx], cx
je 0x10017cb1
push esi
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003247c]
push dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push ecx
push ecx
push ecx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x10017c5d
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017c9d
test byte [eax + 0x1c], 1
je 0x10017c9d
push esi
push edi
push 0x1000bcb8
push 0x1a
jmp 0x10017c92
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push 0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x10017c9d
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017c9d
test byte [eax + 0x1c], 1
je 0x10017c9d
push esi
push ebx
push 0x1000bcb8
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001fe35
cmp dword [ebp - 4], 0
je 0x10017cac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10017cf3
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017cf0
test byte [eax + 0x1c], 1
je 0x10017cf0
push 0x1000bcb8
push 0x19
jmp 0x10017ce5
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017cf0
test byte [eax + 0x1c], 1
je 0x10017cf0
push 0x1000bcb8
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
push reloc.KERNEL32.dll_VerSetConditionMask
pop eax
pop edi
pop ebx
leave
ret 0x14
Function at 0x10017cfe
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
je 0x10017def
cmp word [edi], cx
je 0x10017def
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x10017dd4
cmp word [ebx], cx
je 0x10017dd4
push esi
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003247c]
push dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push ecx
push ecx
push ecx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x10017d80
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017dc0
test byte [eax + 0x1c], 1
je 0x10017dc0
push esi
push edi
push 0x1000bcb8
push reloc.ADVAPI32.dll_GetTraceEnableLevel
jmp 0x10017db5
push 8
lea eax, [ebp + 0x18]
push eax
push 0xb
push 0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x10017dc0
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017dc0
test byte [eax + 0x1c], 1
je 0x10017dc0
push esi
push ebx
push 0x1000bcb8
push reloc.ADVAPI32.dll_GetTraceLoggerHandle
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001fe35
cmp dword [ebp - 4], 0
je 0x10017dcf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10017e16
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017e13
test byte [eax + 0x1c], 1
je 0x10017e13
push 0x1000bcb8
push reloc.ADVAPI32.dll_GetTraceEnableFlags
jmp 0x10017e08
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017e13
test byte [eax + 0x1c], 1
je 0x10017e13
push 0x1000bcb8
push reloc.ADVAPI32.dll_RegisterTraceGuidsW
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
push reloc.KERNEL32.dll_VerSetConditionMask
pop eax
pop edi
pop ebx
leave
ret 0x18
Function at 0x1001a0ba
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10032138]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push 0x40
lea eax, [ebp - 0x84]
mov esi, ecx
push eax
je 0x1001a0e8
call sub.KERNEL32.dll_GetSystemWow64DirectoryW
jmp 0x1001a0ed
call sub.KERNEL32.dll_GetSystemDirectoryW
test eax, eax
je 0x1001a11c
cmp eax, 0x40
ja 0x1001a11c
lea eax, [ebp - 0x84]
push eax
mov ecx, esi
call fcn.1000503e
test eax, eax
js 0x1001a127
cmp dword [ebp + 0xc], 0
jne 0x1001a127
push 0x100030b4
mov ecx, esi
call fcn.10019dee
jmp 0x1001a127
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.100033fb
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100024c8
leave
ret 8

Function at 0x1001a6fd
Capabilities:
Query environment variable

Disassembly:
push 0xc
mov eax, 0x1002f459
call fcn.100036bc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001a7ec
cmp dword [ebp + 0xc], 0
je 0x1001a7ec
xor esi, esi
push esi
push esi
push ebx
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.1000150e
pop ecx
mov edi, eax
jmp 0x1001a754
test edi, edi
jne 0x1001a786
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a77f
test byte [eax + 0x1c], 1
je 0x1001a77f
push dword [ebp - 0x14]
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
mov esi, 0x8007000e
jmp 0x1001a7e8
push dword [ebp - 0x14]
push edi
push ebx
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
test eax, eax
jne 0x1001a7d2
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a7c3
test byte [eax + 0x1c], 1
je 0x1001a7c3
call sub.KERNEL32.dll_GetLastError
push eax
mov eax, dword [0x100320c8]
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.100033fb
mov esi, eax
jmp 0x1001a7dd
mov ecx, dword [ebp + 0xc]
push edi
call fcn.1001a05c
mov edi, esi
test edi, edi
je 0x1001a7e8
push edi
call fcn.10001485
pop ecx
mov eax, esi
jmp 0x1001a815
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a810
test byte [eax + 0x1c], 1
je 0x1001a810
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
mov eax, 0x80070057
call fcn.10005952
ret 8

Function at 0x1001a822
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x1001a838
xor eax, eax
jmp 0x1001a83b
and eax, 0x10
pop ebp
ret 4
Function at 0x1001a844
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10032138]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x1001a9b4
cmp dword [ebp + 0xc], eax
je 0x1001a9b4
push ebx
push esi
push dword [ebp + 0xc]
mov word [esi], ax
call sub.KERNEL32.dll_GetTempPathW
test eax, eax
je 0x1001a973
xor ebx, ebx
cmp word [esi], bx
je 0x1001a973
push esi
call fcn.1001a822
test eax, eax
jne 0x1001a8db
push ebx
push esi
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
jne 0x1001a8db
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a8d1
test byte [eax + 0x1c], 1
je 0x1001a8d1
push esi
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10013378
xor eax, eax
mov word [esi], ax
jmp 0x1001a9a2
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call sub.KERNEL32.dll_GetLongPathNameW
test eax, eax
je 0x1001a93d
cmp eax, 0x104
jae 0x1001a93d
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp + 0xc]
push esi
call fcn.10001075
mov esi, eax
test esi, esi
jns 0x1001a96f
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a9af
test byte [eax + 0x1c], 1
je 0x1001a9af
push esi
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
jmp 0x1001a9af
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.100033fb
mov ecx, dword [0x100320c8]
cmp ecx, 0x100320c8
je 0x1001a96f
test byte [ecx + 0x1c], 2
je 0x1001a96f
push eax
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.1001334b
mov esi, ebx
jmp 0x1001a9af
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a9a2
test byte [eax + 0x1c], 1
je 0x1001a9a2
call sub.KERNEL32.dll_GetLastError
push eax
mov eax, dword [0x100320c8]
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.100033fb
mov esi, eax
mov eax, esi
pop ebx
jmp 0x1001a9dd
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a9d8
test byte [eax + 0x1c], 1
je 0x1001a9d8
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100024c8
leave
ret 8
Function at 0x1001aefd
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10032138]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x114
call sub.KERNEL32.dll_GetVersionExW
test eax, eax
jne 0x1001af75
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001af71
test byte [eax + 0x1c], 1
je 0x1001af71
call sub.KERNEL32.dll_GetLastError
push eax
mov eax, dword [0x100320c8]
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
xor eax, eax
jmp 0x1001af7f
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100024c8
leave
ret

Function at 0x1001afaf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 4
mov dword [ebp + 0x14], eax
mov dword [ebp - 8], ebx
test esi, esi
je 0x1001afdb
mov dword [esi], ebx
cmp dword [ebp + 0xc], ebx
jne 0x1001afe5
cmp dword [ebp + 0x1c], ebx
je 0x1001b002
lea eax, [ebp + 0x14]
push eax
push 0x101
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b01d
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001b025
push eax
call fcn.100033fb
jmp 0x1001b036
cmp dword [ebp - 8], 4
jne 0x1001b031
cmp dword [ebp - 0xc], 4
je 0x1001b047
mov eax, 0x8007065d
test eax, eax
jns 0x1001b047
mov dword [ebp - 4], edi
test esi, esi
je 0x1001b047
mov dword [esi], 1
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1001b05d
cmp eax, dword [ebp + 8]
je 0x1001b05d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
leave
ret 0x18
Function at 0x1001b069
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, 0x80004005
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
test edi, edi
jne 0x1001b098
mov eax, 0x80070057
jmp 0x1001b254
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0xc], ebx
jne 0x1001b0a4
test eax, eax
je 0x1001b105
neg eax
sbb eax, eax
lea ecx, [ebp - 8]
push ecx
and eax, 0x100
or eax, 1
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001b102
push eax
call fcn.100033fb
mov esi, eax
mov ecx, dword [0x100320c8]
cmp ecx, 0x100320c8
je 0x1001b23f
test byte [ecx + 0x1c], 1
je 0x1001b23f
push esi
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x41
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.1001334b
jmp 0x1001b23f
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001b149
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x1001b141
cmp dword [ebp + 0x1c], ebx
je 0x1001b137
push edi
push ecx
call fcn.1001a6fd
mov esi, eax
jmp 0x1001b23f
push ecx
mov ecx, edi
call fcn.1000503e
jmp 0x1001b130
push eax
call fcn.100033fb
jmp 0x1001b130
cmp dword [ebp - 4], 1
push 2
pop edx
je 0x1001b161
cmp dword [ebp - 4], edx
je 0x1001b161
mov esi, 0x8007065d
jmp 0x1001b23f
mov eax, dword [ebp - 0xc]
xor ecx, ecx
shr eax, 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000150e
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1001b1af
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001b23f
test byte [eax + 0x1c], 1
je 0x1001b23f
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
jmp 0x1001b23f
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001b1ee
push eax
call fcn.100033fb
mov esi, eax
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001b238
test byte [eax + 0x1c], 1
je 0x1001b238
push esi
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x43
jmp 0x1001b229
cmp dword [ebp - 4], 1
je 0x1001b201
cmp dword [ebp - 4], 2
je 0x1001b201
mov esi, 0x8007065d
jmp 0x1001b238
push ebx
mov ecx, edi
call fcn.1000503e
mov esi, eax
test esi, esi
jns 0x1001b236
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001b238
test byte [eax + 0x1c], 1
je 0x1001b238
push esi
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
jmp 0x1001b238
xor esi, esi
push ebx
call fcn.10001485
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x1001b252
cmp eax, dword [ebp + 8]
je 0x1001b252
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x1001b260
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 8
mov dword [ebp + 0x18], eax
mov dword [ebp - 4], ecx
test esi, esi
je 0x1001b292
mov dword [esi], ecx
cmp dword [ebp + 0xc], ecx
jne 0x1001b29c
cmp dword [ebp + 0x20], ecx
je 0x1001b2b9
lea eax, [ebp + 0x18]
push eax
push 0x101
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b2d5
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001b2dd
push eax
call fcn.100033fb
jmp 0x1001b2ee
cmp dword [ebp - 4], 0xb
jne 0x1001b2e9
cmp dword [ebp - 8], 8
je 0x1001b302
mov eax, 0x8007065d
test eax, eax
jns 0x1001b302
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
test esi, esi
je 0x1001b302
mov dword [esi], 1
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1001b318
cmp eax, dword [ebp + 8]
je 0x1001b318
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
leave
ret 0x1c
Function at 0x10020e2b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10032138]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x22c], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call sub.msvcrt.dll_memset
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
xor eax, eax
lea edi, reloc.ADVAPI32.dll_TraceMessage
push 0x1000c038
stosd dword es:[edi], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x104
push eax
call fcn.100010fa
mov esi, eax
add esp, 0x1c
test esi, esi
jns 0x10020ed8
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10020fdd
test byte [eax + 0x1c], 1
je 0x10020fdd
push esi
push 0x1000bea8
push reloc.ADVAPI32.dll_GetTraceEnableLevel
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x10020fd8
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push 0x1000c0a8
push 0x10
push eax
call fcn.100010fa
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x10020f18
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10020fdd
test byte [eax + 0x1c], 1
je 0x10020fdd
push esi
push 0x1000bea8
push reloc.ADVAPI32.dll_GetTraceLoggerHandle
jmp 0x10020ecd
xor edi, edi
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x20006
push edi
push edi
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
test ebx, ebx
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10020fac
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test ecx, ecx
je 0x10020fb6
mov eax, dword [ebp + 0x10]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp + 0x14]
push 8
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xb
push edi
lea eax, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10020fa8
jle 0x10020f8a
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [0x100320c8]
cmp ecx, 0x100320c8
je 0x10020fdd
test byte [ecx + 0x1c], 1
je 0x10020fdd
push eax
push 0x1000bea8
push 0x25
jmp 0x10020fd2
mov esi, edi
jmp 0x10020fdd
jle 0x10020fb6
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [0x100320c8]
cmp ecx, 0x100320c8
je 0x10020fdd
test byte [ecx + 0x1c], 1
je 0x10020fdd
push eax
push 0x1000bea8
push 0x24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.1001334b
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test ecx, ecx
je 0x10020fee
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100024c8
leave
ret 0x14
Function at 0x10022fac
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x80070057
test edi, edi
jne 0x10022fe2
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x100230b4
test byte [eax + 0x1c], 1
je 0x100230b4
push 0x1000bea8
push 0xc
jmp 0x10023009
cmp dword [ebp + 0xc], 0
jne 0x10023019
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x100230b4
test byte [eax + 0x1c], 1
je 0x100230b4
push 0x1000bea8
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
jmp 0x100230b4
push ebx
push 0x100030b4
mov ebx, 0x104
push ebx
push edi
call fcn.100065d4
mov esi, eax
test esi, esi
jns 0x1002304d
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x100230b3
test byte [eax + 0x1c], 1
je 0x100230b3
push esi
push 0x1000bea8
push 0xe
jmp 0x10023077
push dword [ebp + 0xc]
push ebx
push edi
call fcn.100065d4
mov esi, eax
test esi, esi
jns 0x10023084
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x100230b3
test byte [eax + 0x1c], 1
je 0x100230b3
push esi
push 0x1000bea8
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001334b
jmp 0x100230b3
push 0
push edi
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
jne 0x100230b1
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp esi, 0xb7
je 0x100230b1
test esi, esi
jle 0x100230b3
invalid
out 0xff, al
inc dword [eax]