joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004bc14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004bc46
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x7efc
push dword [ebp - 8]
push 0
push 0xd7f
push 0x62ec
call fcn.1004e1b6
add esp, 0x14
jmp 0x1004bc83
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1004bc75
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1004bc83
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esp, ebp
pop ebp
ret

Function at 0x1004bc9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007dc4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004bccc
push 0
call fcn.1004c5e3
pop ecx
jmp 0x1004bdcd
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004bdbf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 1
jmp 0x1004bd2c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jl 0x1004bdbd
mov dword [ebp - 0x3c], 0xe8588d0d
push 2
lea ecx, [ebp - 0x54]
call fcn.1001d86d
and dword [ebp - 4], 0
mov dword [ebp - 0x44], 0x2076acb8
mov dword [ebp - 0x38], 0
push 0
push 0x1daf
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1005a463
add esp, 0x10
push dword [ebp - 0x34]
push 0x6498
lea eax, [ebp - 0x38]
push eax
push 0x5e20
push dword [ebp - 0x14]
push 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call fcn.10049dce
add esp, 0x24
mov byte [ebp - 0xd], 0
push 0
lea eax, [ebp - 0xd]
push eax
call fcn.1005c892
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.1001d8ef
jmp 0x1004bd21
jmp 0x1004bdcd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10051813
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100518f0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100518d4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10051886
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jg 0x100518d2
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.1001d90b
mov esi, eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.1001d90b
mov ecx, dword [esi]
mov dword [eax], ecx
push 0x579f
push dword [ebp - 8]
push 0x2cc6
push dword [ebp - 0x10]
push 0
push dword [ebp - 0xc]
push 0x6f6a
call fcn.10054629
add esp, 0x1c
jmp 0x1005187b
jmp 0x100518ee
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100518ee
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x100518f8
push 0
call fcn.1004fa10
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10052720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10052744
push 1
push 0x4834
push 0x120b
call fcn.100527a4
add esp, 0xc
jmp 0x100527a0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10052780
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1005277e
push 0
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x100527a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100527a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x1005b0d9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1005b1d5
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1005b10c
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1005b1d3
mov dword [ebp - 0x14], 0x616
mov dword [ebp - 0x1c], 0x1000de34
cmp dword [ebp - 0x14], 0x94e
jle 0x1005b1b3
and dword [ebp - 4], 0
jmp 0x1005b134
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3e7d
jge 0x1005b1ad
and dword [ebp - 8], 0
jmp 0x1005b14a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x9eb
jge 0x1005b1ab
and dword [ebp - 0xc], 0
jmp 0x1005b160
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x6f6c
jge 0x1005b1a9
and dword [ebp - 0x10], 0
jmp 0x1005b176
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x317c
jge 0x1005b1a7
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
add edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
mov eax, edx
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x1005b16f
jmp 0x1005b159
jmp 0x1005b143
jmp 0x1005b12d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
cmp dword [ebp - 0x14], 0x33c
jge 0x1005b1d3
mov edx, dword [ebp - 0x1c]
mov ecx, 0x10082bb8
call fcn.100202a3
jmp 0x1005b1e7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0
call fcn.100428bb
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1005b95e
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1005b997
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
push 0x13c6
push 1
push dword [ebp - 0x1c]
push 0xde7
push dword [ebp - 0x20]
call fcn.1005baf3
add esp, 0x14
jmp 0x1005baef
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1005ba22
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 8
jmp 0x1005b9ff
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe5
jle 0x1005ba1d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1005b9f4
jmp 0x1005baef
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x17a
mov dword [ebp - 0x54], 0x1000df1c
cmp dword [ebp - 0x18], 0x3d3
jle 0x1005baa0
and dword [ebp - 0xc], 0
jmp 0x1005ba58
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7c0f
jge 0x1005ba98
and dword [ebp - 0x10], 0
jmp 0x1005ba6e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x35e1
jge 0x1005ba96
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x1005ba67
jmp 0x1005ba51
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x18], 0x12d
jge 0x1005babc
mov edx, dword [ebp - 0x54]
mov ecx, 0x10082bb8
call fcn.100202a3
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1005bad2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1005baef
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.1001d90b
mov dword [eax], 0xfffffff8
jmp 0x1005bac7
mov esp, ebp
pop ebp
ret
Function at 0x1005c452
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1005c488
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x8e9
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3431
push 1
call fcn.1005c4b6
add esp, 0x14
jmp 0x1005c4b2
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1005c4a4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1005c4b2
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov esp, ebp
pop ebp
ret

Function at 0x1005c744
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1005c864
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1005c85a
mov dword [ebp - 0x14], 0x46
mov dword [ebp - 0x20], 0x1000e050
cmp dword [ebp - 0x14], 0x2cb
jle 0x1005c82f
and dword [ebp - 0x10], 0
jmp 0x1005c792
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xa10
jge 0x1005c82f
and dword [ebp - 4], 0
jmp 0x1005c7ac
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1c31
jge 0x1005c82a
and dword [ebp - 8], 0
jmp 0x1005c7c2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x229f
jge 0x1005c825
and dword [ebp - 0xc], 0
jmp 0x1005c7d8
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7ed4
jge 0x1005c823
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
sar eax, cl
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.1001d534
jmp 0x1005c7d1
jmp 0x1005c7bb
jmp 0x1005c7a5
jmp 0x1005c78b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawStateW]
cmp dword [ebp - 0x14], 0xffffffea
jge 0x1005c858
push dword [ebp - 0x20]
call fcn.10067b63
pop ecx
jmp 0x1005c862
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1005c88e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0x1d85
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.10042b4b
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1007800f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10081750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006b228
mov dword [ebp - 0x14], eax
cmp dword [0x10083c14], esi
jne 0x10078102
push 0x800
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007808f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100781e2
push esi
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100781e2
push 0x10006774
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100781e2
push eax
call ebx
push 0x10006780
push edi
mov dword [0x10083c14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006790
push edi
mov dword [0x10083c18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067a4
push edi
mov dword [0x10083c1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10083c24], eax
test eax, eax
je 0x100780ff
push 0x100067c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10083c20], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10078127
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007811a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007813c
push 4
pop eax
jmp 0x100781e4
cmp dword [ebp - 0x14], esi
je 0x1007813c
push dword [0x10083c14]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10078121
mov eax, dword [0x10083c20]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007819a
cmp dword [0x10083c24], edi
je 0x1007819a
push eax
call ebx
push dword [0x10083c24]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007819a
test eax, eax
je 0x1007819a
call ecx
test eax, eax
je 0x1007818f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007818f
test byte [ebp - 8], 1
jne 0x1007819a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100781ca
mov eax, dword [0x10083c18]
cmp eax, edi
je 0x100781c7
push eax
call ebx
test eax, eax
je 0x100781c7
call eax
mov esi, eax
test esi, esi
je 0x100781c7
mov eax, dword [0x10083c1c]
cmp eax, edi
je 0x100781c7
push eax
call ebx
test eax, eax
je 0x100781c7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10083c14]
call ebx
test eax, eax
je 0x100781e2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100781e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006873a
mov esp, ebp
pop ebp
ret
Function at 0x100013b9
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100013c1
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 2
push 0
push dword [esp + 0x18]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 8

Function at 0x100013f2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x10001408
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteExpandString_wchar_t_const___wchar_t_const__
jmp 0x1000143b
mov eax, dword [ebp + 0xc]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1000140f
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 0xc

Function at 0x1000143f
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x100914fc
call fcn.1008f84a
mov edi, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x10001508
cmp dword [ebp - 0x10], 1
je 0x10001487
cmp dword [ebp - 0x10], 2
jne 0x10001508
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov ebx, eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax + 1]
push eax
push 0
push ebx
call sub.MSVCR90.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x100014fc
cmp dword [ebp - 0x10], 1
je 0x100014d7
cmp dword [ebp - 0x10], 2
jne 0x100014fc
push ebx
lea ecx, [ebp + 8]
call dword [0x100b6094]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push ebx
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x1000150a
xor eax, eax
call fcn.1008f922
ret 8

Function at 0x10001512
Capabilities:
Set registry value

Disassembly:
push 4
push dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x100015a3
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 0xc
Function at 0x1000174e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x10112038]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x18
mov eax, 0x1009149a
call fcn.1008f84a
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x40c]
mov esi, ecx
xor edi, edi
push 0x100be7bc
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call dword [0x100b6094]
xor eax, eax
mov dword [ebp - 4], edi
push 0x3fe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
mov dword [ebp - 0x1c], edi
push edi
push ebx
push dword [esi + 8]
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001800
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001800
mov ecx, dword [ebp - 0x20]
push 0xffffffffffffffff
push edi
call sub.mfc90u.dll_CStringArray::SetSize
xor ebx, ebx
cmp dword [ebp - 0x14], edi
jbe 0x10001856
cmp esi, edi
je 0x10001856
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001850
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_4]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push dword [ecx + 8]
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10001807
cmp dword [ebp - 0x10], edi
je 0x10001867
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x1000186e
xor edi, edi
inc edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.1008e7ae
add ebp, 0x404
leave
ret 8