joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x438
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x434], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x14], eax
cmp bx, word [0x18053420]
jne 0x18002dc3
cmp word [0x18053428], 0
je 0x18002dc3
push 0x18053428
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret
push 0x1bc
lea eax, [esp + 0x78]
push 0
mov ecx, 0x13
mov esi, str.SoftwareHNCSharedCommonResDllExt_
lea edi, [esp + 0x30]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR90.dll_memset
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x23a]
push edx
mov word [esp + 0x23c], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x104
call fcn.18002c90
cmp word [eax], 0
je 0x18002e44
mov esi, dword [sym.imp.MSVCR90.dll_wcscat_s]
push eax
lea eax, [esp + 0x2c]
push 0x104
push eax
call esi
add esp, 0xc
push 0x1804079c
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call esi
add esp, 0xc
movzx edx, bx
push edx
push 0x180407a0
lea edx, [esp + 0x238]
call fcn.180054a0
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x30]
push 0x80000002
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edi, [esp + 0x18]
mov esi, eax
call fcn.18002330
test esi, esi
jne 0x18002f40
lea ecx, [esp + 0x10]
push ecx
push esi
push esi
lea eax, [esp + 0x2c]
push esi
lea edx, [esp + 0x240]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [esp + 0x18]
mov esi, eax
call fcn.18002330
test esi, esi
jne 0x18002f35
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push esi
push 0
push 0
lea edx, [esp + 0x244]
push edx
push eax
call sym.HncBL90.dll_HncRegQueryString
test eax, eax
jne 0x18002f35
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0x104
push 0x18053428
mov word [0x18053420], bx
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1802929c
mov esp, ebp
pop ebp
ret
Function at 0x18003f80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x234
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x230], eax
push ebp
push esi
push edi
mov ebp, dword [esp + 0x244]
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebp
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 0x10]
cmp eax, esi
jbe 0x18004050
xor ecx, ecx
push 0x20e
push ecx
lea edx, [esp + 0x32]
push edx
mov word [esp + 0x34], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x18004045
cmp word [esp + 0x28], ax
je 0x18004045
mov edi, dword [sym.imp.MSVCR90.dll_wcscat_s]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x24]
push 0x104
push ebx
mov dword [esp + 0x28], edx
call edi
push 0x18040874
push 0x104
push ebx
call edi
add esp, 0x18
lea edi, [esp + 0x18]
call fcn.18002330
inc esi
cmp esi, dword [esp + 0x10]
jb 0x18003fc6
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1802929c
add esp, 0x234
ret

Function at 0x180042d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
push 0x18c
lea eax, [esp + 0x88]
push 0
mov ecx, 0x1f
mov esi, str.C:Program_FilesCommon_FilesMicrosoft_SharedinkTabTip.exe
lea edi, [esp + 0x10]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR90.dll_memset
add esp, 0xc
push 5
push 0
lea ecx, [esp + 0x10]
push ecx
mov edx, ecx
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1802929c
mov esp, ebp
pop ebp
ret
Function at 0x18004370
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x1804e020]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
push ebx
push esi
push edi
push 0x104
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x78]
push ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [0x180538b4]
test eax, eax
jne 0x180043c1
call fcn.1800e370
mov eax, dword [0x180538b4]
test eax, eax
je 0x180043d1
push 0x15
call eax
add esp, 4
test eax, eax
mov eax, str.WinHDB90b.ini
jne 0x180043d6
mov eax, str.WinHDB90.ini
push eax
lea edx, [ebp - 0x68]
push 0x104
push edx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0xc
cmp word [ebp - 0x68], 0
jne 0x180043fa
mov ebx, 0x18040a86
jmp 0x180044d5
lea eax, [ebp - 0x68]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x18004400
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [ebp - 0x68]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x18004417
sub eax, edx
sar eax, 1
lea eax, [eax*4 + 0xc]
cmp eax, 0x400
lea eax, [ebp - 0x68]
lea edx, [eax + 2]
jg 0x18004470
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x18004440
sub eax, edx
sar eax, 1
lea eax, [eax*4 + 0xc]
call fcn.18029d50
mov ebx, esp
test ebx, ebx
je 0x1800449f
mov dword [ebx], 0xcccc
add ebx, 8
jmp 0x1800449f
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x18004470
sub eax, edx
sar eax, 1
lea ecx, [eax*4 + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
test eax, eax
je 0x1800449d
mov dword [eax], 0xdddd
add eax, 8
mov ebx, eax
lea edi, [esi*4 + 4]
lea esi, [ebp - 0x80]
call fcn.180022d0
xor eax, eax
cmp edi, 1
jle 0x180044d1
lea edx, [ebp - 0x70]
push edx
push eax
push edi
push ebx
lea ecx, [ebp - 0x68]
push ecx
mov dword [ebp - 0x70], eax
push eax
or eax, 0xffffffff
xor ecx, ecx
call fcn.1801f770
add esp, 0x18
mov byte [ebx + eax], 0
push 0x18040994
lea edx, [ebp - 0x6c]
push ebx
push edx
call dword [sym.imp.MSVCR90.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x18004508
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
lea edi, [ebp - 0x80]
call fcn.18002330
mov eax, 1
jmp 0x18004512
lea edi, [ebp - 0x80]
call fcn.18002330
xor eax, eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1a0]
xor ecx, ebp
call fcn.1802929c
add ebp, 0x1a4
mov esp, ebp
pop ebp
ret
Function at 0x18005390
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x1805378c], 0
push edi
mov edi, eax
je 0x18005425
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x18053784]
je 0x18005425
cmp dword [0x18053790], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x180053cd
nop
push 0x64
call esi
cmp dword [0x18053790], 0
jne 0x180053c0
mov dword [0x18053794], edi
mov dword [0x18053790], 0x18005310
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [0x18053790], 0
mov ebx, eax
je 0x18005412
call edi
sub eax, ebx
cmp eax, 0xbb8
jbe 0x18005405
push 0x64
jmp 0x18005407
push 0
call esi
cmp dword [0x18053790], 0
jne 0x180053f6
pop esi
pop ebx
mov dword [0x18053794], 0
mov eax, 1
pop edi
ret
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
xor eax, eax
pop edi
ret

Function at 0x18005450
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
mov eax, 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x18053c30], al
jne 0x18005474
or dword [0x18053c30], eax
call esi
mov dword [0x18053c2c], eax
call esi
mov ecx, dword [0x18053c2c]
sub ecx, eax
pop esi
cmp ecx, 0x64
jbe 0x1800549c
push 0
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
mov dword [0x18053c2c], eax
call dword [sym.imp.USER32.dll_PeekMessageW]
add esp, 0x1c
ret
Function at 0x18005dc0
Capabilities:
Check if file exists
Get geographical location

Disassembly:
sub esp, 0x824
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x838]
push edi
mov edi, dword [esp + 0x838]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x632]
push ecx
mov word [esp + 0x634], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [esp + 0x844], 0
mov ebx, str._s_s_s__s_s
jne 0x18005e1a
mov ebx, str._s_s_s_s_s
push 0x104
lea edx, [esp + 0x62c]
push edx
push edi
call sym.HncBL90.dll_HncPathToAbsolute
push 0x100
lea eax, [esp + 0x24]
push eax
push 0x104
lea ecx, [esp + 0x22c]
push ecx
push 0x100
lea edx, [esp + 0x43c]
push edx
push 3
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x648]
push ecx
call dword [sym.imp.MSVCR90.dll__wsplitpath_s]
add esp, 0x24
call sym.HncBL90.dll_HncGetUserLCID
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 4
lea edx, [esp + 0x1c]
push edx
movzx eax, ax
push 3
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
call edi
add esp, 0x1c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18005fb1
push 4
lea edx, [esp + 0x1c]
push edx
push 3
push 0x400
call ebp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
call edi
add esp, 0x1c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18005fb1
push 4
lea edx, [esp + 0x1c]
push edx
push 3
push 0x409
call ebp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
call edi
add esp, 0x1c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18005fb1
cmp dword [esp + 0x844], eax
je 0x18005f74
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x430]
push ecx
lea edx, [esp + 0x1c]
push edx
push str._s_s_s_s
push esi
call edi
add esp, 0x18
jmp 0x18005faa
push 4
lea eax, [esp + 0x1c]
push eax
push 3
push 0x412
call ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x434]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push esi
call edi
add esp, 0x1c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1802929c
add esp, 0x824
ret 0x10
Function at 0x180060d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push eax
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
lea eax, [esp + 0x10]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x18006106
sub eax, edx
push esi
sar eax, 1
push edi
mov esi, eax
je 0x18006144
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call dword [sym.imp.MSVCR90.dll_wcsrchr]
lea edx, [esp + esi*2 + 0x12]
add esp, 8
cmp eax, edx
je 0x18006144
mov eax, 0x5c
xor ecx, ecx
mov word [esp + esi*2 + 0xc], ax
mov word [esp + esi*2 + 0xe], cx
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x18006150
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x18006150
sub eax, edx
sar eax, 1
cmp eax, 2
jbe 0x1800617d
cmp word [esp + 0xc], 0x5c
jne 0x1800617d
cmp word [esp + 0xe], 0x5c
jne 0x1800617d
push 0x5c
lea edx, [esp + 0x14]
push edx
jmp 0x18006184
push 0x5c
lea eax, [esp + 0x10]
push eax
mov edi, dword [sym.imp.MSVCR90.dll_wcschr]
call edi
add eax, 2
add esp, 8
test eax, eax
jne 0x180061ad
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1802929c
add esp, 0x210
ret
push ebx
push ebp
push 0x5c
push eax
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x18006211
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea esp, [esp]
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov word [esi], cx
call ebx
cmp eax, 0xffffffff
je 0x180061e6
and eax, 0x10
jne 0x180061f3
push 0
lea eax, [esp + 0x18]
push eax
call ebp
test eax, eax
je 0x1800622f
mov ecx, 0x5c
mov word [esi], cx
add esi, 2
cmp word [esi], 0
je 0x18006211
push ecx
push esi
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x180061d0
mov eax, 1
mov ecx, dword [esp + 0x21c]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.1802929c
add esp, 0x210
ret
xor eax, eax
jmp 0x18006216
Function at 0x18006a20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x220], eax
cmp dword [ebp + 0x18], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0x18]
push 0x206
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
push 0
je 0x18006aa6
lea edx, [esp + 0x2a]
xor ecx, ecx
push edx
mov word [esp + 0x2c], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
push esi
mov esi, 0x18053860
call fcn.180088c0
test eax, eax
je 0x18006aa1
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
lea ecx, [esp + 0x24]
push ecx
call fcn.18008e90
test eax, eax
je 0x18006aa1
lea edx, [esp + 0x20]
xor esi, esi
push edx
jmp 0x18006ad9
or esi, 0xffffffff
jmp 0x18006ae4
lea ecx, [esp + 0x2a]
xor eax, eax
push ecx
mov word [esp + 0x2c], ax
call sub.MSVCR90.dll_memset
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
add esp, 0xc
push edi
lea edx, [esp + 0x24]
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x18006ae4
lea ecx, [esp + 0x20]
push ecx
push edi
push ebx
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
lea edi, [esp + 0x10]
call fcn.18002330
mov ecx, dword [esp + 0x22c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x18006b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x230], eax
cmp dword [ebp + 0x28], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x28]
push 0x206
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 0
push 0
je 0x18006be0
lea eax, [esp + 0x3a]
xor edx, edx
push eax
mov word [esp + 0x3c], dx
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x30]
push esi
mov esi, 0x18053860
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
call fcn.180088c0
test eax, eax
jne 0x18006bac
xor ecx, ecx
mov dword [ebx], ecx
xor edx, edx
mov dword [edi], ecx
jmp 0x18006bb4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push edx
mov edx, dword [esp + 0x24]
push edx
push ebx
push ecx
call fcn.18007ed0
test eax, eax
je 0x18006bdb
mov ecx, dword [ebx]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x30]
xor esi, esi
push eax
inc ecx
push ecx
push edx
jmp 0x18006c29
or esi, 0xffffffff
jmp 0x18006c32
lea ecx, [esp + 0x3a]
xor eax, eax
push ecx
mov word [esp + 0x3c], ax
call sub.MSVCR90.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push edi
push edx
push eax
mov eax, dword [ebp + 0xc]
push ecx
push ebx
lea edx, [esp + 0x44]
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x18006c32
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x30]
push ecx
inc edx
push edx
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
lea edi, [esp + 0x20]
call fcn.18002330
mov ecx, dword [esp + 0x23c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret 0x24

Function at 0x18006dd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x208], eax
cmp dword [esp + 0x220], 0
push ebx
mov ebx, dword [esp + 0x220]
push ebp
mov ebp, dword [esp + 0x218]
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, dword [esp + 0x224]
je 0x18006e57
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push ebp
mov ecx, esi
mov edx, 0x18053860
call fcn.18008f70
test eax, eax
je 0x18006e52
mov eax, dword [ebx]
lea edx, [esp + 0x10]
push edx
push eax
push esi
xor edi, edi
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
mov eax, edi
jmp 0x18006e61
or eax, 0xffffffff
jmp 0x18006e61
push ebx
push esi
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1802929c
add esp, 0x20c
ret 0x14
Function at 0x18006e80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ebp + 0x20], 0
push ebx
push esi
lea eax, [esp + 0x14]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
je 0x18006ee6
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, 0x18053860
call fcn.18008fe0
lea edi, [esp + 0x10]
test eax, eax
je 0x18006ed5
call fcn.18002330
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.18002330
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [esp + 0x10]
mov esi, eax
call fcn.18002330
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x18006f20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ebp + 0x1c], 0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea ecx, [esp + 0x14]
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
je 0x18006fa1
push eax
mov esi, 0x18053860
call fcn.180088c0
test ebx, ebx
je 0x18006f6e
push ebx
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.18008ad0
test eax, eax
je 0x18006f8c
mov eax, dword [esp + 0xc]
push edi
lea ecx, [eax + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const__]
lea edi, [esp + 0x10]
call fcn.18002330
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea edi, [esp + 0x10]
call fcn.18002330
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
push edx
push edi
push ecx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea edi, [esp + 0x10]
mov esi, eax
call fcn.18002330
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x18006fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ebp + 0x20], 0
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
push ecx
je 0x18007037
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
push edx
push eax
mov ecx, 0x18053860
call fcn.18009090
lea edi, [esp + 0x10]
test eax, eax
je 0x18007026
call fcn.18002330
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.18002330
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edi, [esp + 0x10]
mov esi, eax
call fcn.18002330
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x180072b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp + 0xc]
push esi
lea eax, [esp + 0xc]
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
je 0x18007309
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x18053860
call fcn.180090f0
lea edi, [esp + 8]
test eax, eax
je 0x180072f9
call fcn.18002330
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.18002330
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edi, [esp + 8]
mov esi, eax
call fcn.18002330
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x18007330
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
push esi
lea ecx, [esp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
je 0x180073b1
push eax
mov esi, 0x18053860
call fcn.180088c0
push edi
push eax
call fcn.18008330
lea edi, [esp + 0xc]
test eax, eax
je 0x18007396
call fcn.18002330
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret 0xc
call fcn.18002330
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret 0xc
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea edi, [esp + 0xc]
mov esi, eax
call fcn.18002330
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret 0xc