joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440834
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4674d8]
cmp byte [eax + 0xc], 0
je 0x4409a1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44099a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x468afc], 0
jne 0x440888
push 0x4409a8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4409b0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468afc], eax
cmp dword [0x466c40], 0
jne 0x440983
push 0x4409c0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x466c40], eax
cmp dword [0x466c40], 0
je 0x440983
push 0x4409cc
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b00], eax
push 0x4409dc
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b04], eax
push 0x4409f0
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b08], eax
push 0x440a08
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b0c], eax
push 0x440a20
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b10], eax
push 0x440a34
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b14], eax
push 0x440a4c
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b18], eax
push 0x440a64
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b1c], eax
push 0x440a80
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b20], eax
push 0x440a8c
mov eax, dword [0x466c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b24], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4409a1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x444870
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040449c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4448bf
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040470c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c098
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c0e8]
test si, 4
je 0x44c0ac
or bl, 1
test si, 8
je 0x44c0b6
or bl, 4
test si, 1
je 0x44c0c0
or bl, 8
test si, 2
je 0x44c0ca
or bl, 0x10
test si, 0x10
je 0x44c0d4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c0e3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44c0ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c124]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c105
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c114
or bl, 4
test esi, 0x20000000
je 0x44c11f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4527e8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4527fa
add esp, 0xfffffff0
call fcn.004039c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a598
mov eax, dword [0x467164]
mov dword [eax + 4], ebx
mov dword [eax], 0x452b8c
mov eax, dword [0x467170]
mov dword [eax + 4], ebx
mov dword [eax], 0x452b98
mov eax, ebx
call fcn.00452ba4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412060]
call fcn.00403674
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412060]
call fcn.00403674
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412060]
call fcn.00403674
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412060]
call fcn.00403674
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412060]
call fcn.00403674
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44efbc
push eax
push 0
push 0
mov eax, dword [0x4672d0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41bfc8]
call fcn.0041d430
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41bfc8]
call fcn.0041d430
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41bfc8]
call fcn.0041d430
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00452ff4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452ebc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452ebc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452ebc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452937
call fcn.00403a1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x452ca0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452e4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x452e2c
mov dl, 1
mov eax, dword [0x41247c]
call fcn.00403674
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040449c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x452e1b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440b94
test al, al
je 0x452e0e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x452e5c
lea eax, [ebp - 0x254]
call fcn.004091a0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x452e0e
xor eax, eax
push ebp
push 0x452e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452e94
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x452df0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040470c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x452df0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040470c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e0e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x452d11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416194
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e52
lea eax, [ebp - 0x260]
call fcn.0040449c
ret

Function at 0x453794
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x468b48]
cmp byte [eax + 0xa5], 0
jne 0x453805
cmp dword [0x468b60], 0
jne 0x4537c6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x453750
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x468b60], eax
cmp dword [0x468b5c], 0
jne 0x4537e1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x468b5c], eax
cmp dword [0x468b64], 0
jne 0x453805
push esp
push 0
push 0
push 0x4536f4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x468b64], eax
pop edx
ret
Function at 0x453e98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x468b48]
cmp dword [eax + 0x30], 0
je 0x453f42
cmp dword [ebx + 0x94], 0
jne 0x453f3c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453e28
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x453f3c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453f02
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x453f3c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004144d8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x453f11
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454aa0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454ad5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040458c
jmp 0x454ae2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044f0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455c84
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455cc5
mov eax, esi
call fcn.0043c170
test al, al
je 0x455cc5
mov eax, dword [ebx + 0x84]
call fcn.0043be6c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455cc5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043be6c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x462618
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, 0x1505
mov eax, esi
call fcn.0040475c
test eax, eax
jle 0x46264e
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
mov edi, ebx
shl edi, 5
add ebx, edi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x462639
mov eax, ebx
and eax, 0x7fffffff
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.00408514
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100013b9
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100013c1
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 2
push 0
push dword [esp + 0x18]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 8

Function at 0x100013f2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x10001408
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.winzipsshelper.dll_public:_int___thiscall_CRegistry::WriteExpandString_wchar_t_const___wchar_t_const__
jmp 0x1000143b
mov eax, dword [ebp + 0xc]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1000140f
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 0xc

Function at 0x1000143f
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x1006d049
call fcn.1006c23a
mov edi, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x10001508
cmp dword [ebp - 0x10], 1
je 0x10001487
cmp dword [ebp - 0x10], 2
jne 0x10001508
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov ebx, eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax + 1]
push eax
push 0
push ebx
call sub.MSVCR90.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x100014fc
cmp dword [ebp - 0x10], 1
je 0x100014d7
cmp dword [ebp - 0x10], 2
jne 0x100014fc
push ebx
lea ecx, [ebp + 8]
call dword [0x10085f70]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call dword [0x10085f74]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push ebx
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x1000150a
xor eax, eax
call fcn.1006c312
ret 8

Function at 0x10001512
Capabilities:
Set registry value

Disassembly:
push 4
push dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x100015a3
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 0xc
Function at 0x1000174e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x100ce038]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x18
mov eax, 0x1006cfe7
call fcn.1006c23a
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x40c]
mov esi, ecx
xor edi, edi
push 0x10086e50
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call dword [0x10085f70]
xor eax, eax
mov dword [ebp - 4], edi
push 0x3fe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
mov dword [ebp - 0x1c], edi
push edi
push ebx
push dword [esi + 8]
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001800
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001800
mov ecx, dword [ebp - 0x20]
push 0xffffffffffffffff
push edi
call sub.mfc90u.dll_CStringArray::SetSize
xor ebx, ebx
cmp dword [ebp - 0x14], edi
jbe 0x10001856
cmp esi, edi
je 0x10001856
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001850
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_4]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push dword [ecx + 8]
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10001807
cmp dword [ebp - 0x10], edi
je 0x10001867
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x1000186e
xor edi, edi
inc edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.1006b19e
add ebp, 0x404
leave
ret 8
Function at 0x10001924
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
or dword [ebp - 8], 0xffffffff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov edi, ecx
push dword [edi + 8]
call esi
cmp dword [ebp - 4], 2
mov edx, dword [ebp + 0x10]
sete cl
mov byte [edx], cl
test eax, eax
jne 0x100019b4
cmp dword [ebp - 4], 1
je 0x1000196b
cmp dword [ebp - 4], 2
jne 0x100019b4
push dword [ebp - 8]
call sub.mfc90u.dll_new__
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp + 0x10], eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x100019a6
cmp dword [ebp - 4], 1
je 0x1000199a
cmp dword [ebp - 4], 2
jne 0x100019a6
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call dword [0x10085f1c]
push dword [ebp + 0x10]
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x100019b6
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x100019bc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006cfbd
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x100ce038]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
push 2
mov edi, 0x1000
push edi
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
push 0x10
push edi
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call sub.mfc90u.dll_CMemFile::CMemFile
xor ebx, ebx
push ebx
push edi
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0xa0], ebx
call sub.mfc90u.dll_CArchive::CArchive
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x3c]
mov byte [esp + 0x90], 1
mov eax, dword [ecx]
push edx
call dword [eax + 8]
lea ecx, [esp + 0x3c]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x14]
call sub.mfc90u.dll_CMemFile::GetLength
mov edi, eax
push edi
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CMemFile::Detach
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 3
xor esi, esi
cmp dword [esp + 0x10], esi
je 0x10001a8d
push dword [esp + 0x10]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
cmp ebx, esi
jne 0x10001a94
xor esi, esi
inc esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x90], 0
call fcn.1006a6b0
or dword [esp + 0x90], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1006a6a4
mov eax, esi
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001ad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006cf8c
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x100ce038]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, ecx
mov esi, 0x1000
push esi
call dword [sym.imp.MSVCR90.dll_malloc]
push esi
xor ebx, ebx
push ebx
push eax
mov dword [esp + 0x24], eax
call sub.MSVCR90.dll_memset
add esp, 0x10
push 0x10
push esi
push dword [esp + 0x1c]
lea ecx, [esp + 0x28]
call sub.mfc90u.dll_CMemFile::CMemFile
push ebx
push esi
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0xa8], ebx
call sub.mfc90u.dll_CArchive::CArchive
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x44]
mov byte [esp + 0x98], 1
mov eax, dword [ecx]
push edx
call dword [eax + 8]
lea ecx, [esp + 0x44]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x1c]
call sub.mfc90u.dll_CMemFile::GetLength
lea ecx, [esp + 0x1c]
mov esi, eax
call sub.mfc90u.dll_CMemFile::Detach
push esi
push eax
push 3
push ebx
push dword [ebp + 8]
mov dword [esp + 0x28], eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x18], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], 3
cmp dword [esp + 0x14], ebx
je 0x10001bb2
push dword [esp + 0x14]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
xor esi, esi
cmp dword [esp + 0x18], ebx
jne 0x10001bbb
inc esi
lea ecx, [esp + 0x44]
mov byte [esp + 0x98], bl
call fcn.1006a6b0
or dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.1006a6a4
mov eax, esi
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001bf6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006cf5b
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x100ce038]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CDWordArray::CDWordArray
push 2
xor ebx, ebx
push 0x1e
mov dword [esp + 0xb0], ebx
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
push 0xffffffffffffffff
push 5
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call sub.mfc90u.dll_CDWordArray::SetSize
cmp dword [esp + 0x20], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
jg 0x10001c6a
call fcn.1006a68c
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
cmp dword [esp + 0x20], 1
mov ecx, dword [eax + 0xc]
jle 0x10001c65
mov edx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
cmp dword [esp + 0x20], 2
mov ecx, dword [eax]
jle 0x10001c65
mov edx, dword [esp + 0x1c]
mov dword [edx + 8], ecx
cmp dword [esp + 0x20], 3
mov eax, dword [eax + 8]
jle 0x10001c65
mov ecx, dword [esp + 0x1c]
push 0x10
push 0x1e
push dword [esp + 0x1c]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x38]
call sub.mfc90u.dll_CMemFile::CMemFile
push ebx
push 0x1000
push ebx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xb8], 1
call sub.mfc90u.dll_CArchive::CArchive
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xac], 2
call sub.mfc90u.dll_CDWordArray::Serialize
lea ecx, [esp + 0x54]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x2c]
call sub.mfc90u.dll_CMemFile::GetLength
mov edi, eax
push edi
lea ecx, [esp + 0x30]
call sub.mfc90u.dll_CMemFile::Detach
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi + 0x18], edi
xor edi, edi
inc edi
cmp dword [esp + 0x14], 0
mov ebx, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
je 0x10001d34
push dword [esp + 0x14]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0xa8], 1
call fcn.1006a6b0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 0
call fcn.1006a6a4
or dword [esp + 0xa8], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.1006a6d4
test ebx, ebx
jne 0x10001d6f
mov eax, edi
jmp 0x10001d71
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8