joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100449a0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121020
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov esi, dword [0x101726dc]
test esi, esi
jne 0x100449fc
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x101726c0
call edi
mov esi, dword [0x101726dc]
test esi, esi
jne 0x100449fc
push 0x101726c0
call edi
mov esi, dword [0x101726dc]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov eax, 0x400000
div esi
mov edi, eax
xor eax, eax
imul edi, esi
xor ecx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edi
lea ecx, [ecx]
xor edx, edx
cmp edx, ebx
jg 0x10044a2c
jl 0x10044a2e
cmp edi, esi
jb 0x10044a2e
mov edi, esi
push edi
push eax
push ecx
push 6
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10044b0c
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 4
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10044ad4
push edi
push eax
push dword [ebp - 0x1c]
call fcn.10107980
mov edi, dword [ebp - 0x18]
xor eax, eax
add esp, 0xc
cmp ebx, eax
jl 0x10044a82
jg 0x10044a7c
cmp esi, edi
jbe 0x10044a82
sub esi, edi
sbb ebx, eax
jmp 0x10044a90
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
add dword [ebp - 0x10], edi
push dword [ebp - 0x28]
adc dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
jl 0x10044abd
jg 0x10044ab2
test esi, esi
je 0x10044abd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
jmp 0x10044a20
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str._CopySectionContents:_Src_mapping_failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov dword [ebp - 4], 1
mov ecx, str.WinUtils
mov edx, dword [ebp - 0x1c]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
jmp 0x10044b42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push str._CopySectionContents:_Dest_mapping_failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, str.WinUtils
mov edx, dword [ebp - 0x18]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10044b5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012105e
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x1016e750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x224], 0
xor eax, eax
mov dword [ebp - 4], 0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.101078f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
mov ecx, esp
mov dword [ebp - 0x228], esp
push 0x1012ec40
call fcn.10023fc0
push ecx
mov byte [ebp - 4], 1
mov esi, esp
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov dword [ebp - 0x21c], esp
call fcn.10024750
add eax, 0x10
mov dword [esi], eax
push ecx
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
mov ecx, esp
push eax
call fcn.10023fc0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.10044c80
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
mov esi, dword [ebp + 8]
or ecx, 0xffffffff
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10044c55
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10103392
mov esp, ebp
pop ebp
ret

Function at 0x10045880
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [ebp - 4], edx
mov edi, ecx
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [edi], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0
cmp ebx, 0xffffffff
je 0x10045929
push 0
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
test eax, eax
je 0x10045926
cmp dword [ebp + 0xc], 0
je 0x100458e1
add eax, 2
push eax
call fcn.10104809
add esp, 4
mov dword [edi], eax
lea eax, [ebp - 8]
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004591d
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp - 8]
je 0x1004591d
mov eax, dword [edi]
mov byte [esi + eax], 0
mov ecx, dword [edi]
mov eax, dword [ebp - 8]
mov byte [ecx + eax + 1], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10045929
or esi, 0xffffffff
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10045946
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045950
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121230
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x1012ec60
mov ecx, ebx
mov esi, eax
call fcn.10024680
or ebx, 0xffffffff
cmp esi, ebx
jne 0x100459b7
xor esi, esi
jmp 0x10045a34
push 0
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x10045a2f
push edi
call fcn.10104809
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
push 0
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10045a28
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
push edi
call fcn.10045620
add esp, 4
mov ecx, dword [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.100244b0
mov byte [ebp - 4], 0
mov ecx, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10045a28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x10045a55
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10045a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 8], ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10045ad0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10045ac9
cmp dword [ebp - 4], edi
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
movzx esi, bl
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10045af0
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045b00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121268
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 4], 1
xor esi, esi
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x18], esi
je 0x10045b4f
call fcn.100476b0
test eax, eax
mov eax, 0x20119
jne 0x10045b54
mov eax, 0x20019
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10045c7e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x18], esi
push dword [ebp - 0x18]
call ebx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x10045c5a
jns 0x10045ba4
push 0x80070057
call fcn.100223c0
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x10045bbf
push edx
mov ecx, edi
call fcn.100249c0
lea eax, [ebp + 0x18]
push eax
push dword [edi]
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x10045c50
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x10045be4
cmp eax, 2
jne 0x10045c50
push ecx
mov ecx, edi
call fcn.10024210
cmp dword [ebp - 0x10], 2
mov esi, 1
jne 0x10045c75
cmp dword [ebp + 0x10], 0
je 0x10045c75
lea ecx, [ebp - 0x14]
call fcn.10023f70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov esi, dword [edi]
add eax, 0x208
push eax
push eax
mov dword [ebp + 0x18], eax
call fcn.10024520
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
cmp ecx, eax
push ecx
lea ecx, [ebp - 0x14]
sbb esi, esi
call fcn.10024210
neg esi
je 0x10045c46
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.100244b0
lea ecx, [ebp - 0x14]
call fcn.10024080
jmp 0x10045c75
push ecx
mov ecx, edi
call fcn.10024210
jmp 0x10045c75
cmp dword [ebp + 0x14], esi
je 0x10045c75
test eax, eax
jne 0x10045c75
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x10045c70
cmp eax, 2
jne 0x10045c75
mov esi, 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10045ca1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffff0
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x10045cc2
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101212a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov ebx, ecx
mov dword [ebp - 4], 1
xor esi, esi
mov edi, 0x20019
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], esi
je 0x10045d36
call fcn.100476b0
test eax, eax
mov ecx, 0x20119
cmovne edi, ecx
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10045d87
lea eax, [ebp - 0x14]
mov dword [ebp + 0x10], esi
push eax
push dword [ebp - 0x18]
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], 4
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10045d7e
cmp dword [ebp + 0x10], 4
mov eax, 1
cmove esi, eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10045daa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffff0
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x10045dcb
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101212d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
mov esi, 0xf003f
test edx, edx
je 0x10045e30
call fcn.100476b0
test eax, eax
mov ecx, 0xf013f
cmovne esi, ecx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0
push 0
push 0
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10045ebe
mov eax, dword [ebp + 0x10]
cmp dword [eax - 4], 1
mov esi, dword [eax - 0xc]
jle 0x10045e65
push esi
lea ecx, [ebp + 0x10]
call fcn.10024570
mov eax, dword [ebp + 0x10]
lea ecx, [esi + esi]
push ecx
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 1
mov eax, dword [ebp + 0x10]
cmove ebx, ecx
push dword [eax - 8]
push eax
call fcn.1010374b
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x10045f36
mov eax, dword [ebp + 0x10]
cmp ecx, dword [eax - 8]
jg 0x10045f36
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp + 0x10]
mov word [eax + ecx*2], dx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10045ee1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10045f01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0x10]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10045f22
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.100223c0
int3
Function at 0x10045f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121310
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], 1
mov esi, 0xf003f
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], edi
je 0x10045fa6
call fcn.100476b0
test eax, eax
mov ecx, 0xf013f
cmovne esi, ecx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0
push 0
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10045fec
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
test eax, eax
mov ecx, 1
cmove edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1004600f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffff0
lea eax, [ebx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10046030
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100460b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1016e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x218], eax
push edi
mov edi, edx
test ebx, ebx
jne 0x100460f4
test edi, edi
je 0x100460df
cmp word [edi], bx
jne 0x100460f4
pop edi
mov eax, 0x3f2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10103392
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
push ecx
push 0x10008
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10046187
push esi
nop
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x10046169
test esi, esi
jne 0x10046178
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push ebx
call fcn.100460b0
mov esi, eax
add esp, 4
test esi, esi
je 0x10046110
jmp 0x10046178
push edi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10103392
mov esp, ebp
pop ebp
ret
Function at 0x100461a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1016e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x818], edx
push ecx
push 0x80000
push 8
push edx
push eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x808], 0
mov dword [ebp - 0x810], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1004637c
push ebx
push 1
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push dword [ebp - 0x808]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call edi
test esi, esi
jne 0x1004637c
lea eax, [ebp - 0x808]
push eax
push 0x40000
push 8
push dword [ebp - 0x818]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004637e
push ebx
push 4
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push dword [ebp - 0x808]
mov esi, eax
call edi
test esi, esi
jne 0x1004637c
lea eax, [ebp - 0x808]
push eax
push 0x10009
push 8
push dword [ebp - 0x818]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004637e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x810]
push eax
push esi
push esi
push esi
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jne 0x1004637e
mov eax, dword [ebp - 0x810]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x10046327
xor edi, edi
test eax, eax
je 0x10046321
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x10046316
mov ecx, dword [ebp - 0x808]
lea edx, [ebp - 0x804]
push ebx
push dword [ebp - 0x814]
call fcn.100461a0
inc edi
mov esi, eax
cmp edi, dword [ebp - 0x810]
jb 0x100462d3
xor eax, eax
cmp esi, 0x103
cmove esi, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10046366
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0
push eax
push 0
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x80c], 6
push eax
push 0
push str.SymbolicLinkValue
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046374
push dword [ebp - 0x808]
call dword [0x101726ec]
mov esi, eax
push dword [ebp - 0x808]
call edi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10103392
mov esp, ebp
pop ebp
ret 8
Function at 0x10046580
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121340
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
lea esi, [edi + 9]
cmp dword [ebp + 0x10], edi
je 0x100465cb
mov ecx, eax
call fcn.1004a6e0
cmp dword [ebp + 0xc], edi
je 0x100465df
call fcn.100476b0
test eax, eax
mov ecx, 0x109
cmovne esi, ecx
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push dword [ebp + 8]
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or ecx, 0xffffffff
test eax, eax
jne 0x10046704
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1004661b
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 1
xor ebx, ebx
mov edi, edi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x10046654
push 0x514
lea ecx, [ebp + 0x10]
call fcn.100249c0
mov esi, dword [ebp + 0x10]
push 0x514
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push dword [esi - 8]
mov dword [ebp + 0xc], eax
push esi
call fcn.1010374b
add esp, 8
test eax, eax
js 0x10046739
cmp eax, dword [esi - 8]
jg 0x10046739
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [ebp + 0xc], ecx
jne 0x100466da
cmp dword [ebp + 0x14], ecx
je 0x100466c1
push ecx
lea ecx, [esi - 0x10]
mov edi, esp
call fcn.10024750
mov ecx, dword [ebp - 0x14]
add eax, 0x10
xor edx, edx
mov dword [edi], eax
call fcn.10047890
mov edi, dword [ebp - 0x18]
add esp, 4
inc edi
inc ebx
mov dword [ebp - 0x18], edi
jmp 0x10046630
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x10]
push eax
call fcn.10039ca0
mov esi, dword [ebp + 0x10]
inc edi
mov dword [ebp - 0x18], edi
inc ebx
jmp 0x10046630
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10046701
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10046725
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.100223c0
int3