joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101dcdb0
Capabilities:
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10251260
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x1037c990]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x2e0]
mov dword fs:[0], eax
test byte [0x103b6dd8], 1
mov edi, dword [esp + 0x2f0]
mov ebp, dword [esp + 0x2f4]
mov esi, ecx
jne 0x101dce3d
or dword [0x103b6dd8], 1
mov dword [esp + 0x2e8], 0
push 0x102c61dc
mov ecx, 0x103b6dbc
call fcn.10055a10
push 0x102a8fd0
call fcn.1022edce
add esp, 4
mov dword [esp + 0x2e8], 0xffffffff
mov eax, dword [edi + 0x18]
cmp dword [eax - 0xc], 0
mov eax, 0x103b6dbc
je 0x101dce4d
mov eax, edi
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.10055970
mov dword [esp + 0x2e8], 1
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x20]
call fcn.101daa80
mov byte [esp + 0x2e8], 2
push 0x24c
lea edx, [esp + 0x94]
push 0
push edx
mov dword [esp + 0x98], 0
call fcn.10232610
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
xor bl, bl
call fcn.101dc200
mov byte [esp + 0x2e8], 3
mov eax, dword [eax]
lea ecx, [esp + 0x8c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x2e8], 5
lea ecx, [esp + 0x18]
call fcn.10004720
cmp esi, 0xffffffff
jne 0x101dcf08
mov byte [esp + 0x2e8], 1
lea ecx, [esp + 0x38]
call fcn.10056b10
mov dword [esp + 0x2e8], esi
lea ecx, [esp + 0x1c]
call fcn.10056b10
xor al, al
jmp 0x101dd02c
mov edi, dword [esp + 0x2fc]
nop
mov eax, dword [esp + 0x8c]
cmp eax, 0xffffffff
je 0x101dcfc3
mov ecx, dword [esp + 0x2f8]
mov edx, eax
xor edx, edi
test ecx, edx
jne 0x101dcfc3
test al, 0x10
je 0x101dcf60
cmp word [esp + 0xb8], 0x2e
jne 0x101dcf60
mov ax, word [esp + 0xba]
cmp ax, 0x2e
jne 0x101dcf5b
cmp word [esp + 0xbc], 0
jmp 0x101dcf5e
test ax, ax
je 0x101dcfc3
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x58]
mov bl, 1
call fcn.10055a10
mov byte [esp + 0x2e8], 6
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x78]
call fcn.10055970
mov byte [esp + 0x2e8], 7
mov edx, dword [ebp]
push eax
mov eax, dword [edx + 0x10]
mov ecx, ebp
call eax
mov byte [esp + 0x2e8], 6
lea ecx, [esp + 0x70]
call fcn.10056b10
mov byte [esp + 0x2e8], 5
lea ecx, [esp + 0x54]
call fcn.10056b10
lea ecx, [esp + 0x8c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101dcf10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x101dcff4
push 0x367
push str..FilePath.cpp
call fcn.100563c0
mov byte [esp + 0x2e8], 2
lea ecx, [esp + 0x14]
call fcn.101da4a0
mov byte [esp + 0x2e8], 1
lea ecx, [esp + 0x38]
call fcn.10056b10
mov dword [esp + 0x2e8], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10056b10
mov al, bl
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c8]
xor ecx, esp
call fcn.1022e78c
add esp, 0x2d8
ret 0x10
Function at 0x101dd3f0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10251378
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, ecx
mov ebx, dword [esp + 0x24]
test ebx, 0xffffced8
je 0x101dd438
push 0
push 0x533
push str..FilePath.cpp
push 0x80070057
call fcn.100048f0
mov eax, dword [esp + 0x28]
mov esi, ebx
not esi
test eax, esi
je 0x101dd45a
push 0
push 0x534
push str..FilePath.cpp
push 0x80070057
call fcn.100048f0
mov edi, 0x80
call fcn.101dc650
cmp ebx, edi
je 0x101dd470
and esi, eax
or esi, dword [esp + 0x28]
mov edi, esi
cmp edi, eax
je 0x101dd4b8
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebp
call fcn.101dc200
mov dword [esp + 0x1c], 0
mov eax, dword [eax]
push 0x54a
push str..FilePath.cpp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call fcn.100556a0
add esp, 0xc
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.10004720
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x101dd890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10250f11
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.101dbb40
add esp, 4
mov dword [esp + 0x30], 1
mov esi, dword [esp + 0x38]
push str.drivers
push esi
lea ecx, [esp + 0x14]
call fcn.10055a70
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
lea ecx, [esp + 0xc]
call fcn.10056b10
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x101dd910
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1025145c
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x1037c990]
xor eax, esp
mov dword [esp + 0x290], eax
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x2a4]
mov dword fs:[0], eax
mov esi, ecx
call fcn.101dc6d0
test al, al
je 0x101dda94
push 0x102c61dc
lea ecx, [esp + 0x38]
call fcn.10055a10
xor edi, edi
mov dword [esp + 0x2ac], edi
lea eax, [esp + 0x34]
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.10055970
mov byte [esp + 0x2ac], 2
lea ecx, [esp + 0x34]
call fcn.10056b10
push 0x24c
lea ecx, [esp + 0x58]
push edi
push ecx
mov dword [esp + 0x5c], edi
call fcn.10232610
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
call fcn.101dc200
mov byte [esp + 0x2ac], 3
mov eax, dword [eax]
lea ecx, [esp + 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x10], esi
mov byte [esp + 0x2ac], 5
lea ecx, [esp + 0x14]
call fcn.10004720
cmp esi, 0xffffffff
jne 0x101dd9ee
push edi
push edi
call fcn.100563c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ebx, [ebx]
lea edx, [esp + 0x7c]
push edx
push 0x102b2868
call edi
test eax, eax
je 0x101dda20
lea eax, [esp + 0x7c]
push eax
push 0x102abd94
call edi
test eax, eax
jne 0x101dda46
lea ecx, [esp + 0x50]
push ecx
push esi
call ebp
test eax, eax
jne 0x101dda00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x101dda6f
push 0xab8
push str..FilePath.cpp
call fcn.100563c0
mov byte [esp + 0x2ac], 2
lea ecx, [esp + 0x10]
call fcn.101da4a0
mov dword [esp + 0x2ac], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10056b10
xor al, al
jmp 0x101dda96
mov byte [esp + 0x2ac], 2
lea ecx, [esp + 0x10]
call fcn.101da4a0
mov dword [esp + 0x2ac], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10056b10
mov al, 1
mov ecx, dword [esp + 0x2a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.1022e78c
add esp, 0x2a0
ret
Function at 0x101de3d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x10251620
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x5c]
xor ebp, ebp
cmp esi, ebp
je 0x101de40a
mov ecx, esi
call fcn.10091d30
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x54], ebp
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.101de260
test al, al
jne 0x101de477
mov ecx, edi
call fcn.101dc650
shr eax, 4
not al
test al, 1
je 0x101de45f
push ebp
push 0x31e
push str..FilePath.cpp
push 0x8007010b
call fcn.100048f0
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10091d30
xor al, al
jmp 0x101de569
cmp dword [esp + 0x20], ebp
je 0x101de556
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100d90c0
mov byte [esp + 0x54], 1
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x34]
call fcn.101dc200
mov byte [esp + 0x54], 2
mov eax, dword [eax]
push ebp
push eax
call edi
test eax, eax
sete bl
mov byte [esp + 0x54], 1
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101de4dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x101de57f
cmp esi, ebp
je 0x101de50a
mov ecx, dword [esi + 4]
push ebp
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.10055450
mov ecx, dword [esi + 4]
cmp ecx, ebp
je 0x101de505
mov dword [ecx], eax
jmp 0x101de507
mov dword [esi], eax
mov dword [esi + 4], eax
mov byte [esp + 0x54], 4
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
mov byte [esp + 0x54], 4
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101de53c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [esp + 0x20], ebp
jne 0x101de487
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10091d30
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 4
push ebp
push ebp
call fcn.100563c0
int3
Function at 0x101de8b0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10251718
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call fcn.101dd850
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x101de907
mov ecx, esi
call fcn.101dc650
shr eax, 4
test al, 1
je 0x101de955
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.101dc200
mov dword [ebp - 4], 2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.10004720
test edi, edi
je 0x101de972
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.101dc200
mov dword [ebp - 4], 3
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x101de930
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.101dc200
mov dword [ebp - 4], 4
mov eax, dword [eax]
push 0x51e
push str..FilePath.cpp
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call fcn.100556a0
add esp, 0xc
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.10004720
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101decd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102517c0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], 0xa
mov byte [esp + 0x60], 1
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.100047f0
mov byte [esp + 0x64], 2
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x68], 1
call fcn.101da320
add esp, 8
mov byte [esp + 0x60], 3
push eax
lea ecx, [esp + 0x40]
call fcn.10056360
mov byte [esp + 0x60], 4
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x44]
push eax
mov ecx, esi
mov dword [esp + 0x20], vtable.CAtlListBuilder_class_CFilePath__class_ATL::CElementTraits_class_CFilePath___class_ATL::CAtlList_class_CFilePath__class_ATL::CElementTraits_class_CFilePath___.0
mov dword [esp + 0x24], ebx
call fcn.101de590
mov byte [esp + 0x60], 3
lea ecx, [esp + 0x3c]
call fcn.10056b10
mov byte [esp + 0x60], 1
lea ecx, [esp + 0xc]
call fcn.10004720
mov ecx, dword [esp + 0x6c]
push ecx
lea edx, [esp + 0x28]
push edx
push ecx
lea eax, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
call fcn.100047f0
mov byte [esp + 0x6c], 5
mov byte [esp + 0x6c], 1
call fcn.101dd060
add esp, 0xc
mov byte [esp + 0x70], al
mov byte [esp + 0x60], bl
lea ecx, [esp + 0x24]
call fcn.10091d30
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x68]
call fcn.10004720
mov al, byte [esp + 0x70]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x58
ret 0xc
Function at 0x101e0a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10251d80
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.101dec00
test al, al
jne 0x101e0aa6
push 0
push 0xc1c
push str..FilePath.cpp
push 0x80070057
call fcn.100048f0
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.10055790
mov dword [esp + 0x54], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
lea ecx, [esp + 0x10]
call fcn.10055ee0
mov byte [esp + 0x54], 1
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x28]
call fcn.10055ce0
mov byte [esp + 0x54], 2
lea ecx, [esp + 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.10055f50
mov byte [esp + 0x54], 4
lea ecx, [esp + 0x24]
call fcn.100560b0
mov byte [esp + 0x54], 5
lea ecx, [esp + 0xc]
call fcn.100560b0
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x1c]
call fcn.101e4e30
test eax, eax
setne bl
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x18]
call fcn.100560b0
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.10056b10
mov al, bl
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x101e2430
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov ecx, 0x20
mov eax, dword [esi]
sub eax, 0x10
mov dword [esp + 0x10], ecx
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, ecx
or edx, eax
mov ebx, ecx
jge 0x101e2466
push ecx
mov ecx, esi
call fcn.100042e0
mov edi, dword [esi]
push ebx
mov ecx, esi
call fcn.10004360
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx]
push 0
test eax, eax
je 0x101e24ef
mov edx, dword [eax + 4]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x101e24a8
push ecx
push eax
call fcn.102318e6
add esp, 8
push eax
mov ecx, esi
call fcn.10004360
cmp edi, 0xea
jne 0x101e2503
mov eax, dword [ebx]
push 0
test eax, eax
je 0x101e24ef
mov edx, dword [eax + 4]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x101e2505
mov ecx, dword [esp + 0x10]
inc ecx
jmp 0x101e2442
push 0x187
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincRefCounted.h
push 0x80004003
call fcn.100048f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x101e3f60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x102524e9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x101e3fcb
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.100047f0
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
jne 0x101e4006
push esi
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.100047f0
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.101e2e80
add esp, 8
mov dword [esp + 0x18], 1
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.101d9e30
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.101e2f30
add esp, 8
mov byte [esp + 0x18], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.10054e60
mov byte [esp + 0x18], 1
lea ecx, [esp + 0xc]
call fcn.10004720
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.100047f0
mov dword [esp + 8], 1
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x28]
call fcn.10004720
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x101e4a80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10252740
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x34]
xor ebx, ebx
cmp esi, ebx
jne 0x101e4ac7
push ebx
push 0x63a
push str..Registry.cpp
push 0x80004003
call fcn.100048f0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
push ebx
push 2
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call fcn.101e4990
mov byte [esp + 0x28], 1
mov edx, dword [esp + 0x14]
cmp edx, 0xffffffff
jbe 0x101e4b1b
push ebx
push 0x291
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincNVI2Defns.h
push 0x80070057
call fcn.100048f0
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x34]
mov esi, dword [esi + 4]
cmp ecx, ebx
jne 0x101e4b41
push ebx
push 0x181
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincRefCounted.h
push 0x80004003
call fcn.100048f0
push edx
mov edx, dword [esp + 0x14]
push edx
push esi
push ebx
push eax
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x101e4b75
jle 0x101e4b64
and eax, 0xffff
or eax, 0x80070000
push ebx
push 0x644
push str..Registry.cpp
push eax
call fcn.100048f0
mov byte [esp + 0x28], bl
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
je 0x101e4b8a
mov dword [esp + 0x34], ebx
call fcn.10056280
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x101e4ba3
push eax
call fcn.1022f576
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x101e4ed0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102527e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov ebx, 1
mov byte [ebp - 4], bl
push edi
push 2
lea eax, [ebp - 0x18]
push eax
call fcn.101e4990
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10056030
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.100562d0
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov esi, dword [ebp - 0x14]
cmp esi, edi
jne 0x101e4f56
push edi
push 0x181
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincRefCounted.h
push 0x80004003
call fcn.100048f0
push eax
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x101e4fa0
cmp eax, ebx
jle 0x101e4f81
cmp eax, 3
jg 0x101e4f81
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.10056280
jmp 0x101e4fff
cmp eax, edi
jle 0x101e4f8f
and eax, 0xffff
or eax, 0x80070000
push edi
push 0x7ea
push str..Registry.cpp
push eax
call fcn.100048f0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.10056280
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101e5590
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x102529b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor ebp, ebp
push ebp
push 1
lea eax, [esp + 0x28]
push eax
call fcn.101e4990
mov dword [esp + 0x2c], ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov byte [esp + 0x17], 0
jmp 0x101e55e0
push 0x103b7524
lea ecx, [esp + 0x1c]
call fcn.10003eb0
mov byte [esp + 0x2c], 2
mov edx, 0x20
mov esi, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
mov edi, edx
jge 0x101e5621
push edx
lea ecx, [esp + 0x1c]
call fcn.100042e0
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x1c]
call fcn.10004360
mov eax, dword [esp + 0x20]
push 0
test eax, eax
je 0x101e56e7
mov edx, dword [eax + 4]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push esi
push ebp
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.102318e6
add esp, 8
push eax
lea ecx, [esp + 0x1c]
call fcn.10004360
cmp esi, 0xea
jne 0x101e56ae
mov eax, dword [esp + 0x20]
push 0
test eax, eax
je 0x101e56e7
mov edx, dword [eax + 4]
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x101e579f
mov edx, dword [esp + 0x1c]
inc edx
jmp 0x101e55f8
cmp esi, 0x103
je 0x101e56fb
test esi, esi
jne 0x101e577f
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov edx, dword [esp + 0x18]
mov eax, dword [eax + 0x10]
push edx
call eax
mov byte [esp + 0x17], 1
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0x18]
call fcn.10004720
inc ebp
jmp 0x101e55e0
push 0x181
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincRefCounted.h
push 0x80004003
call fcn.100048f0
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101e5720
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], 0xffffffff
mov esi, dword [esp + 0x20]
test esi, esi
je 0x101e5765
lea ecx, [esi + 8]
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jge 0x101e5759
push 0
push 0x6e
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincRefCounted.h
push 0xe0e00000
call fcn.100048f0
jne 0x101e5765
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
jle 0x101e578d
and esi, 0xffff
or esi, 0x80070000
push 0
push 0x95a
push str..Registry.cpp
push esi
call fcn.100048f0
jle 0x101e57ab
and eax, 0xffff
or eax, 0x80070000
push 0
push 0x946
push str..Registry.cpp
push eax
call fcn.100048f0
int3