joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
mov dword [esp], 8
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
pop ecx
ret

Function at 0x1001c4e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push edx
mov edx, dword [esp + 0x14]
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x1001c520
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 8
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x1001c550
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
push eax
push 0
push 0
push 0
push edi
push ecx
mov ebx, 1
call esi
test eax, eax
jne 0x1001c5ab
mov edx, dword [esp + 0x10]
add edx, 0x104
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x18]
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
push edi
push ecx
call esi
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jmp 0x1001c5ba
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
mov esi, 1
mov edx, ebp
mov dword [esp + 0x10], esi
mov al, byte [ebp]
test al, al
je 0x1001c5f6
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
lea esi, [esi + ecx + 1]
or ecx, 0xffffffff
mov dword [esp + 0x10], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
test al, al
jne 0x1001c5cc
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
dec ecx
test ebx, ebx
lea eax, [edx + ecx + 1]
mov dword [esp + 0x10], eax
je 0x1001c661
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push ebp
push 7
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1001c661
push ebp
mov esi, 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebp
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1001cc90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x108
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push 0x10042c24
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001ccc1
xor eax, eax
pop esi
add esp, 0x108
ret
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 0x104
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 4]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1001ccf9
xor eax, eax
pop esi
add esp, 0x108
ret
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x114]
not ecx
sub edi, ecx
push eax
mov edx, ecx
mov esi, edi
mov edi, dword [eax + 0x80]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1001c680
add esp, 4
pop edi
pop esi
add esp, 0x108
ret

Function at 0x1001cd40
Capabilities:
Delete registry key

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0xf003f
push 0
push 0x10042c54
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001cd8d
mov ecx, dword [esp + 8]
mov eax, dword [esp]
mov edx, dword [ecx + 0x80]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret

Function at 0x1001cde0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
mov ecx, 0xd
xor eax, eax
lea edx, [esp + 4]
push ebx
push esi
push edi
mov esi, 0x10042c84
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x128]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push edx
push reloc.WS2_32.dll_bind
call fcn.1001af10
add esp, 0x18
test eax, eax
jne 0x1001ce88
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0
push 0x10042cb8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001ce88
mov esi, 1
jmp 0x1001ce8a
xor esi, esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x1001ceb0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x108
mov ecx, 0xd
xor eax, eax
lea edx, [esp + 4]
push ebx
push esi
push edi
mov esi, 0x10042cc4
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x11c]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push edx
push reloc.WS2_32.dll_bind
call fcn.1001af10
mov esi, eax
add esp, 0x18
neg esi
sbb esi, esi
inc esi
je 0x1001cf38
mov eax, dword [esp + 0xc]
push 0x10042cf8
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret

Function at 0x1001cf50
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
mov ecx, 0xd
xor eax, eax
lea edx, [esp + 4]
push ebx
push esi
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x128]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push edx
push reloc.WS2_32.dll_bind
call fcn.1001af10
add esp, 0x18
test eax, eax
jne 0x1001cff8
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0
push str.DisplayName
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1001cff8
mov esi, 1
jmp 0x1001cffa
xor esi, esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x1001d020
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0xc]
push eax
push 0xf003f
push 0
push 0x10042d44
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 4
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001d078
lea ecx, [esp + 0xc]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x10042d74
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push esi
push 0
push 0
push 0x10042da4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001d0ad
mov ecx, dword [esp + 0xc]
push 4
push esi
push 4
push 0
push 0x10042dac
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x1001d0c0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0xf003f
push 0
push 0x10042db4
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001d105
lea ecx, [esp]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREIBMThinkPadSoftwareInstallerInstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 8]
mov eax, dword [esp]
push 4
push edx
push 4
push 0
push str.Count
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x1001d140
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
lea ecx, [esp + 4]
push eax
push 0x10042e1c
push 0x10042e50
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x128]
lea eax, [esp + 0x10]
push edx
push eax
push 0x20019
lea ecx, [esp + 0x20]
push 0
push ecx
push reloc.WS2_32.dll_bind
call fcn.1001af10
add esp, 0x28
test eax, eax
jne 0x1001d1cb
mov eax, dword [esp + 0x110]
mov ecx, dword [esp]
lea edx, [esp + 0x114]
push esi
push edx
push eax
push 0
push 0
push str.DisplayVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x108
ret
xor eax, eax
add esp, 0x108
ret
Function at 0x1001d1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x20019
push 0
push edx
push reloc.WS2_32.dll_bind
call fcn.1001af10
add esp, 0x18
test eax, eax
jne 0x1001d24b
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push esi
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d23a
mov eax, dword [esp + 8]
mov esi, 1
cmp eax, esi
je 0x1001d23c
xor esi, esi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
ret
xor eax, eax
ret

Function at 0x1001d250
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
lea ecx, [esp + 4]
push esi
mov esi, dword [esp + 0x114]
push eax
push 0x10042e68
push 0x10042e9c
push ecx
mov dword [esi + 4], 0
mov dword [esi], 0
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x128]
lea eax, [esp + 0x14]
push edx
push eax
push 0x20019
lea ecx, [esp + 0x24]
push 0
push ecx
push reloc.WS2_32.dll_bind
call fcn.1001af10
add esp, 0x28
test eax, eax
jne 0x1001d2e1
push esi
push eax
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
sbb esi, esi
push eax
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x108
ret
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x1001d2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x10042ea4
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d341
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push 0x10042ecc
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x1001d350
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push 0x10042ed8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d3ae
mov edx, dword [esp + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push str.DownloadDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ecx
ret
mov eax, esi
pop esi
pop ecx
ret
Function at 0x1001d3c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 4], 0
push eax
push 0x20019
push 0
push 0x10042f0c
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d40f
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.InternetFunction
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
setne al
add esp, 0xc
ret

Function at 0x1001d430
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push 0x10042f48
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d487
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push 0x10042f70
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d487
mov ecx, dword [esp + 4]
mov esi, 1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
xor esi, esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x1001d4a0
Capabilities:
Get proxy
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push 0x10042f7c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d4ff
mov edx, dword [esp + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push 0x10042fa4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x1001d4ff
mov edx, dword [esp + 4]
mov esi, 1
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
xor esi, esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x1001d520
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x108
push ebx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1001d542
pop ebx
add esp, 0x108
ret
push ebp
push esi
push edi
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x124]
mov esi, dword [esp + 0x120]
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x128]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x20019
push 0
push edx
push reloc.WS2_32.dll_bind
call fcn.1001af10
add esp, 0x18
test eax, eax
jne 0x1001d601
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x124]
push eax
push ebx
push 0
push 0
push str.DisplayIcon
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d601
mov eax, dword [esp + 0x124]
test eax, eax
je 0x1001d601
mov edi, 1
jmp 0x1001d603
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1001d63b
cmp byte [ebx], 0x22
jne 0x1001d628
mov eax, dword [esp + 0x124]
lea ecx, [ebx + 1]
add eax, 0xfffffffd
push eax
push ecx
jmp 0x1001d631
mov edx, dword [esp + 0x124]
push edx
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x1001d650
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push 0x10042ff4
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d6a3
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push 0x1004301c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d6a3
mov esi, 1
jmp 0x1001d6a5
xor esi, esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1001d6c5
mov eax, dword [esp + 0xc]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x14]
setne dl
mov dword [eax], edx
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x1001d750
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
mov ecx, 4
push edi
lea eax, [esi + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], eax
lea eax, [esi + 0x50c]
mov dword [esp + 0x40], eax
mov eax, 0x20
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], eax
mov ecx, 0x153
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x64]
lea edx, [esi + 0x408]
push ecx
push 0x20019
mov dword [esp + 0x3c], edx
push eax
lea edx, [esi + 0x52c]
push 0x100430e4
push reloc.WS2_32.dll_accept
mov dword [esp + 0x2c], str.HWND
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], str.FEATUREID
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x44], str.PATH
mov dword [esp + 0x4c], 0x104
mov dword [esp + 0x50], str.NOTIFY
mov dword [esp + 0x5c], str.KILL
mov dword [esp + 0x60], edx
mov dword [esp + 0x68], str.UNATTEND
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d8e1
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edi, edi
lea eax, [edi + edi*2]
lea ecx, [esp + 0x10]
shl eax, 2
push ecx
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + eax + 0x24]
mov dword [esp + 0x14], edx
mov edx, dword [esp + eax + 0x20]
mov eax, dword [esp + eax + 0x1c]
push edx
push 0
push 0
push eax
push ecx
call ebp
test eax, eax
jne 0x1001d883
mov edx, 1
mov ecx, edi
shl edx, cl
mov eax, edi
or ebx, edx
sub eax, 3
je 0x1001d87b
dec eax
je 0x1001d874
dec eax
jne 0x1001d883
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001d883
mov eax, dword [esi + 4]
or eax, 0x10000
jmp 0x1001d880
mov eax, dword [esi + 4]
or al, 2
jmp 0x1001d880
mov eax, dword [esi + 4]
or al, 1
mov dword [esi + 4], eax
inc edi
cmp edi, 6
jb 0x1001d81e
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, ebx
and ebp, 2
test bl, 4
je 0x1001d8b8
test ebp, ebp
je 0x1001d8b4
test bl, 8
je 0x1001d8b4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x50
ret
xor ebp, ebp
jmp 0x1001d8bc
test ebp, ebp
jne 0x1001d8d7
mov ecx, 0x153
xor eax, eax
mov edi, esi
push 0x10043104
rep stosd dword es:[edi], eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
Function at 0x1001d910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
xor eax, eax
push ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0xd], eax
mov word [esp + 0x11], ax
cmp ebp, 9
mov byte [esp + 0xc], 0
mov byte [esp + 0x13], al
jae 0x1001d936
pop ebp
add esp, 0x10
ret
push ebx
push esi
lea ecx, [esp + 0x10]
push edi
push ecx
push 0x20019
push 0
push 0x10043144
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 5
neg eax
sbb eax, eax
mov esi, 1
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], edi
je 0x1001d9a5
lea edx, [esp + 0x28]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0x10043178
push edx
call ebx
test eax, eax
jne 0x1001d9a5
cmp dword [esp + 0x10], esi
jne 0x1001d9a5
cmp dword [esp + 0x28], edi
jne 0x1001d9a5
mov eax, esi
jmp 0x1001d9a7
xor eax, eax
mov edi, 4
test eax, eax
mov dword [esp + 0x28], edi
je 0x1001d9e5
lea eax, [esp + 0x28]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x10043184
push eax
call ebx
test eax, eax
jne 0x1001d9e5
cmp dword [esp + 0x10], esi
jne 0x1001d9e5
cmp dword [esp + 0x28], edi
jne 0x1001d9e5
mov edi, esi
jmp 0x1001d9e7
xor edi, edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov al, byte [esp + ecx + 0x18]
cmp al, 0x30
jb 0x1001da00
cmp al, 0x39
jbe 0x1001da08
cmp al, 0x41
jb 0x1001da0e
cmp al, 0x5a
ja 0x1001da0e
inc ecx
cmp ecx, 7
jl 0x1001d9f4
test edi, edi
je 0x1001da17
cmp ecx, 7
je 0x1001da23
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
add esp, 0x10
ret
mov edx, dword [esp + 0x24]
mov ecx, ebp
mov ebx, ecx
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov cx, word [esp + 0x1c]
mov dword [edx], eax
lea eax, [edx + 5]
mov byte [edx + 4], 0x2d
mov dl, byte [esp + 0x1e]
mov word [eax], cx
mov byte [eax + 2], dl
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x10
ret