joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe471f8
Capabilities:
Identify system language via api

Disassembly:
push 0x2c
mov eax, 0xe5608c
call fcn.00e439dd
lea ecx, [ebp - 0x34]
call fcn.00e46c55
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
push 0
call fcn.00e4758b
test eax, eax
jl 0xe4722c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00e472a7
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov eax, 0x409
mov edi, 0xe47298
cmp ax, si
jne 0xe4e4b4
and esi, 0x3ff
push esi
push edi
lea eax, [ebp - 0x30]
push 8
push eax
call fcn.00e41451
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00e4758b
mov esi, eax
test esi, esi
jl 0xe47280
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00e472a7
mov esi, eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.00e4760b
mov eax, esi
call fcn.00e42b9f
ret

Function at 0xe4791d
Capabilities:
Identify system language via api

Disassembly:
lea eax, [ebp - 0x30]
push eax
call esi
push 8
pop eax
push dword [ebp + 0x10]
mov word [ebp - 0x30], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0xe4dc4f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0x82
lea edx, [ebp - 0x30]
push edx
push 0xe47900
push eax
call dword [ecx + 0x10]
mov esi, eax
lea eax, [ebp - 0x30]
push eax
call edi
cmp esi, ebx
jl 0xe479a8
push 1
lea ecx, [ebp - 0x20]
call fcn.00e479e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x20]
push edx
push 0xe478ec
push eax
call dword [ecx + 0x10]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call edi
push eax
call fcn.00e471e0
cmp esi, ebx
jl 0xe479a8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push 3
movzx eax, ax
pop ecx
mov word [ebp - 0x20], cx
mov dword [ebp - 0x18], eax
jmp 0xe47992
push 0x24
mov eax, 0xe55c85
call fcn.00e426dd
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x20]
push eax
call esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 0x10], ebx
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp + 0xc], ebx
je 0xe47854
push 1
lea ecx, [ebp - 0x20]
call fcn.00e479e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x20]
push edx
push 0xe43984
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0xe479a6
push 3
pop eax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x18], 0x409
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x20]
push edx
push 0xe479d0
push eax
call dword [ecx + 0x10]
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00e47455
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call edi
push eax
call fcn.00e471e0
mov eax, esi
call fcn.00e41390
ret 0xc
Function at 0xe47b05
Capabilities:
Identify system language via api

Disassembly:
push 0x50
mov eax, 0xe55fc0
call fcn.00e439dd
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x5c], ecx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x54], esi
call fcn.00e47c2b
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x58]
mov ebx, eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0xe47b34
sub eax, ecx
sar eax, 1
mov edi, eax
je 0xe47b63
movzx eax, word [ebx + esi*2]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0xe47b5b
inc esi
cmp esi, edi
jb 0xe47b46
cmp esi, edi
jb 0xe47c0e
xor eax, eax
mov edx, ebx
test edi, edi
jbe 0xe47c0e
cmp word [edx], 0x30
jne 0xe47b7c
inc eax
inc edx
inc edx
cmp eax, edi
jb 0xe47b6f
cmp eax, edi
jae 0xe47c0e
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0xe47b89
sub eax, esi
sar eax, 1
cmp eax, 3
ja 0xe47c0e
push 0x10
push 0
push edx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp cx, si
jne 0xe47c03
movzx eax, ax
movzx eax, ax
push eax
push 0xe47c18
lea eax, [ebp - 0x50]
push 0x20
push eax
call fcn.00e41451
mov ecx, dword [ebp - 0x5c]
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
call fcn.00e46c60
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.00e4760b
mov eax, dword [ebp - 0x54]
call fcn.00e42b9f
ret 8
or esi, 0x400
movzx eax, si
jmp 0xe47bc6
mov dword [ebp - 0x54], 0x80041001
jmp 0xe47be9
Function at 0xe47f3e
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0xe56a7d
call fcn.00e41350
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov ebx, 0x8007000e
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], esi
je 0xe48046
push 1
call fcn.00e4227c
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0xe4803c
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00e413e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0xe47fcd
push dword [ebp - 0x18]
inc edi
push edi
push eax
call fcn.00e421cb
mov ebx, eax
test ebx, ebx
jl 0xe48024
push dword [ebp + 8]
push esi
push dword [ebp - 0x14]
call fcn.00e42436
mov ebx, eax
test ebx, ebx
jl 0xe48024
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0xe48024
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0xe47ff6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0xe4f33c
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0xe48024
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x44], eax
cmp eax, 0xffffffff
je 0xe4f353
cmp dword [ebp - 0x14], 0
je 0xe48033
push dword [ebp - 0x14]
call fcn.00e413c0
pop ecx
push dword [ebp - 0x18]
call fcn.00e413c0
pop ecx
mov eax, ebx
call fcn.00e41390
ret 4
mov ebx, 0x80070057
jmp 0xe4803c

Function at 0xe485f1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0xe5b004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
test eax, eax
je 0xe48684
cmp eax, 0xffffffff
je 0xe48684
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xe48684
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 0xc], 0
push ebx
call esi
push ebx
mov dword [ebp - 0x10], eax
call esi
lea esi, [eax + eax + 2]
mov eax, esi
call fcn.00e485b5
mov eax, esp
push esi
push ebx
push eax
call fcn.00e48692
mov esi, dword [ebp - 0x10]
mov edi, dword [edi + 0x44]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xe4f2da
cmp esi, dword [ebp - 0xc]
jne 0xe4f2f6
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00e420d4
leave
ret 4
mov dword [ebp - 8], 0x80070057
jmp 0xe4866d
Function at 0xe488ef
Capabilities:
Get geographical location

Disassembly:
push 0x210
mov eax, 0xe56be9
call fcn.00e420e6
xor eax, eax
push 0x1fe
mov word [ebp - 0x214], ax
xor ebx, ebx
lea eax, [ebp - 0x212]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
push 0x100
lea eax, [ebp - 0x214]
push eax
push 0x1001
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x214]
and esi, 0x3ff
push eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 7
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00e413e0
mov edi, eax
pop ecx
cmp edi, ebx
je 0xe48999
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x21c]
push 0xe489a4
push esi
push edi
call fcn.00e41451
add esp, 0x14
mov eax, edi
call fcn.00e42126
ret 4
Function at 0xe50d7d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [ecx + eax + 0x18]
test esi, esi
jbe 0xe50dba
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0xe50db2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0xe50dbc
inc edx
add eax, 0x28
cmp edx, esi
jb 0xe50da2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10029b7
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
je 0x1005316
cmp dword [ebp - 4], 0
je 0x1005329
lea eax, [ebp - 8]
push eax
call fcn.01003c72
pop ecx
test eax, eax
jne 0x100532d
push esi
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 4]
call esi
test eax, eax
je 0x1002a0c
mov al, 1
pop esi
leave
ret
lea eax, [ebp - 8]
push eax
call fcn.01002a34
pop ecx
test eax, eax
jne 0x1005335
push dword [ebp - 8]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1002a07
jmp 0x100533d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005538
call fcn.0100b395
pop ecx
pop ecx
xor al, al
leave
ret
push eax
push 0x10054a0
jmp 0x1005322
push eax
push 0x1005418
jmp 0x1005351
lea eax, [ebp - 8]
push eax
call fcn.01008076
pop ecx
test eax, eax
je 0x100535f
push eax
push 0x1005378
call fcn.0100b395
pop ecx
pop ecx
xor al, al
jmp 0x1002a09
push dword [ebp - 8]
push dword [ebp - 4]
call esi
test eax, eax
setne al
jmp 0x1002a09
Function at 0x10047ac
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa30], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
call fcn.010024c3
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0xa20]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0xa28], 0x401
push 0
push edi
mov dword [ebp - 0xa38], eax
call esi
test eax, eax
jne 0x100487d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa34]
push eax
push 0x20019
push 0
push dword [ebp - 0x21c]
push edi
call fcn.01002181
add esp, 0x14
mov dword [ebp - 0xa40], eax
test eax, eax
jne 0x1005772
push dword [ebp - 0xa34]
call fcn.0100466a
pop ecx
test al, al
je 0x10056ea
inc dword [ebp - 0xa30]
push dword [ebp - 0xa34]
call ebx
push dword [ebp - 0xa38]
push dword [ebp - 0x21c]
push dword [ebp - 0xa30]
push edi
call esi
test eax, eax
je 0x1004817
cmp eax, 0x103
jne 0x100576a
lea ecx, [ebp - 0xa2c]
call fcn.010048b9
cmp dword [ebp - 0x218], 0x105
jg 0x10057d2
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d20
leave
ret
push dword [ebp - 0xa34]
call ebx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xa3c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0xa3c]
push ecx
push eax
push 1
push eax
push 0x403
push eax
push 2
call fcn.010087fc
push dword [ebp - 0x21c]
push 0x1005928
push dword [ebp - 0xa28]
push dword [ebp - 0xa2c]
call fcn.01008f52
add esp, 0x30
test eax, eax
jl 0x100574b
push 0
push dword [ebp - 0xa2c]
call fcn.0100b395
pop ecx
pop ecx
push dword [ebp - 0x21c]
push edi
call fcn.0100bc93
pop ecx
pop ecx
test al, al
jne 0x100485c
push 0
push 0x10058b8
jmp 0x10057a1
push eax
push 0x1005850
jmp 0x10057a1
push dword [ebp - 0x21c]
push 0x10057e8
push dword [ebp - 0xa28]
push dword [ebp - 0xa2c]
call fcn.01008f52
add esp, 0x10
test eax, eax
jl 0x10057a8
push dword [ebp - 0xa40]
push dword [ebp - 0xa2c]
call fcn.0100b395
pop ecx
pop ecx
lea ecx, [ebp - 0xa2c]
call fcn.010048b9
cmp dword [ebp - 0x218], 0x105
jle 0x10057cb
push dword [ebp - 0x21c]
call fcn.01008876
pop ecx
xor al, al
jmp 0x10048a5
push dword [ebp - 0x21c]
call fcn.01008876
pop ecx
jmp 0x10048a3

Function at 0x1004a3c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x114
mov byte [eax], 0
lea eax, [ebp - 0x118]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1007bfc
cmp dword [ebp - 0x114], 5
jbe 0x1007bed
push 0x1004ab8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001d20
leave
ret
jne 0x1007bfc
cmp dword [ebp - 0x110], 1
jae 0x1004a9e
push 0x1004ab8
call fcn.01004371
pop ecx
jmp 0x1004aa9
Function at 0x1008891
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100fe04]
cmp eax, 0xffffffff
je 0x10088b7
test eax, eax
setne al
jmp 0x1008921
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1008918
cmp dword [ebp - 0x114], 5
jb 0x1008918
and dword [ebp - 0x11c], 0
push 0
push 4
lea eax, [ebp - 0x11c]
push eax
push 0x1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x100fe34]
test eax, eax
jl 0x1008918
cmp dword [ebp - 0x11c], 0
je 0x1008918
xor eax, eax
inc eax
mov dword [0x100fe04], eax
jmp 0x1008921
and dword [0x100fe04], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001d20
leave
ret

Function at 0x1008fd9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov byte [ebp - 0x205], 1
xor ebx, ebx
jmp 0x100909e
mov eax, dword [esi]
add esi, 4
push dword [esi]
mov dword [ebp - 0x20c], ebx
push eax
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.01008f52
add esp, 0x10
add esi, 4
test eax, eax
jl 0x10090bb
mov eax, dword [esi]
push ebx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x204]
add esi, 4
mov edi, dword [esi]
push eax
push 0x80000000
add esi, 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100908c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x210]
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1009092
mov byte [ebp - 0x205], bl
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], ebx
jne 0x1009002
mov al, byte [ebp - 0x205]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d20
leave
ret
xor al, al
jmp 0x10090ac

Function at 0x10090c4
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, 1
jmp 0x1009129
mov eax, dword [esi]
add esi, 4
push dword [esi]
push eax
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.01008f52
add esp, 0x10
test eax, eax
jl 0x100913e
lea eax, [ebp - 0x204]
push eax
push 0x80000000
add esi, 0xc
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 0x3fa
je 0x1009129
cmp eax, 2
je 0x1009129
test eax, eax
je 0x1009129
xor bl, bl
cmp dword [esi], 0
jne 0x10090e2
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d20
leave
ret
xor al, al
jmp 0x1009130
Function at 0x10096ef
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], 0x100fdf4
mov ebx, 0x10020a0
push dword [ebx]
mov esi, 0x100fcd0
push 0x1007f40
push 0x28
push 0x100f470
call fcn.01008f52
add esp, 0x10
cmp eax, edi
jl 0x100987b
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
cmp eax, edi
je 0x1009762
push eax
push 0x28
push 0x100f420
call fcn.01008e6c
cmp eax, edi
jl 0x100987b
cmp dword [0x100fcd0], edi
je 0x10097c9
lea ecx, [esi + 4]
cmp dword [ecx], edi
je 0x10097c5
cmp dword [esi + 8], edi
je 0x10097c5
mov eax, dword [esi]
mov esi, ecx
mov ecx, dword [esi]
push ecx
push eax
lea eax, [ebp - 0xa4]
push 0x50
push eax
add esi, 4
call fcn.01008f52
add esp, 0x10
cmp eax, edi
jl 0x100987b
lea eax, [ebp - 0xa4]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 0x3fa
je 0x10097c2
cmp eax, 2
je 0x10097c2
cmp eax, edi
je 0x10097c2
inc dword [ebp - 0xac]
add esi, 0xc
cmp dword [esi], edi
jne 0x100976a
add dword [ebp - 0xa8], 4
add ebx, 0x10
cmp ebx, 0x10020b0
jl 0x100971e
mov esi, 0x2001f
call fcn.01008891
movzx ebx, al
cmp ebx, edi
je 0x10097f5
mov esi, 0x2011f
lea eax, [ebp - 0xa8]
push eax
push esi
push edi
mov edi, 0x10020e0
push edi
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100983c
test ebx, ebx
jne 0x100981f
push 0x1007f1c
jmp 0x1009824
push 0x1007f04
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1009848
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
call fcn.01008932
test al, al
je 0x100985c
push 0x100fd24
call fcn.010090c4
pop ecx
call fcn.01008932
test al, al
jne 0x100986e
call fcn.01008891
test al, al
je 0x1009879
push 0x100fde0
call fcn.010090c4
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d20
leave
ret
Function at 0x1009e69
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
push 0x100f9f8
push dword [0x100e014]
xor eax, eax
mov word [0x100fbfe], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1009eab
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1009ff5
xor eax, eax
and dword [ebp - 0x80c], eax
push esi
mov word [0x100fbfe], ax
mov esi, 0x100fd48
cmp dword [0x100fd4c], eax
je 0x1009fd1
push ebx
push edi
push 4
pop ebx
mov edi, 0x401
mov eax, dword [esi]
add esi, ebx
test eax, eax
jne 0x1009fc2
mov ecx, dword [esi]
add esi, ebx
mov edx, dword [esi]
add esi, ebx
mov eax, dword [esi]
add esi, ebx
test eax, eax
je 0x1009f06
push eax
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f52
add esp, 0x14
jmp 0x1009f18
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f52
add esp, 0x10
xor ecx, ecx
cmp eax, ecx
jge 0x1009f2c
inc dword [ebp - 0x80c]
add esi, 8
jmp 0x1009fc5
push ecx
lea eax, [ebp - 0x810]
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x808]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1009f59
inc dword [ebp - 0x80c]
mov eax, dword [esi]
test eax, eax
je 0x1009fb1
add esi, ebx
push dword [esi]
push eax
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f52
add esp, 0x10
add esi, ebx
test eax, eax
jl 0x1009fa9
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x808]
push eax
push 1
push 0
push 0
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1009fb4
inc dword [ebp - 0x80c]
jmp 0x1009fb4
add esi, 8
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1009fc5
add esi, 0x14
cmp dword [esi + 4], 0
jne 0x1009ed5
pop edi
pop ebx
push 0
push 0
push 0x1000
push 0x8000000
call dword [0x100fe20]
mov eax, dword [ebp - 0x80c]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001d20
leave
ret
Function at 0x100a006
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x100fd4c
cmp dword [0x100fd4c], ebx
je 0x100a0ec
mov edi, 0x401
mov ecx, dword [esi]
add esi, 4
mov edx, dword [esi]
add esi, 4
mov eax, dword [esi]
add esi, 4
cmp eax, ebx
je 0x100a05e
push eax
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f52
add esp, 0x14
jmp 0x100a070
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f52
add esp, 0x10
cmp eax, ebx
jl 0x100a10f
lea eax, [ebp - 0x80c]
push eax
push 0x20008
push ebx
lea eax, [ebp - 0x808]
push eax
push 0x80000000
mov dword [ebp - 0x80c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a0e1
push 0x50
lea eax, [ebp - 0x808]
push eax
push ebx
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x100a0cf
push 0x1007d9c
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], ebx
add esi, 0xc
cmp dword [esi], ebx
jne 0x100a036
push ebx
push ebx
push 0x1000
push 0x8000000
call dword [0x100fe20]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d20
leave
ret
mov eax, 0x80004005
jmp 0x100a100