joyce8/EMBER2024-capa huggingface dataset:
Function at 0x791fc
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.000142a8
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x400
call fcn.0007b580
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x7930a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0xf63d0]
add eax, 0x20019
push eax
push 0
push 0x79318
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x792ca
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x7935c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0007ac5c
test eax, eax
jne 0x792ca
cmp dword [ebp - 0x10], 1
jne 0x792ca
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0007ac20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0006b29c
test al, al
jne 0x792ca
mov eax, dword [ebp - 0x14]
call fcn.0007abc8
mov eax, dword [ebp - 0x14]
call fcn.0007ac04
push eax
mov eax, dword [ebp - 0x14]
call fcn.0007ac40
push eax
push 0x7937c
call sub.kernel32.dll_GetEnvironmentVariableW
cmp eax, 3
jbe 0x792ca
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0007ac20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0006b29c
test al, al
jne 0x792e0
mov eax, dword [ebp - 4]
call fcn.00076a80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79311
cmp dword [ebp - 0xc], 0
je 0x792fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
call fcn.0007b5a4
ret

Function at 0x7939c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.000142a8
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x800
call fcn.0007b580
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x79452
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0xf63d0]
add eax, 0x20019
push eax
push 0
push 0x79460
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x79428
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x794a4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0007ac5c
test eax, eax
jne 0x79428
cmp dword [ebp - 0x10], 1
jne 0x79428
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0007ac20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79459
cmp dword [ebp - 0x14], 0
je 0x79444
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
call fcn.0007b5a4
ret
Function at 0x79b04
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebp
push 0x79bdd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.000144cc
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x18], eax
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp - 8]
mov dword [edx], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x79b76
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
jmp 0x79bb9
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0x1c], eax
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x79bab
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.00079ac4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x79bb9
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79be4
cmp dword [ebp - 0x18], 0xffffffff
je 0x79bd5
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0x18], 0xffffffff
ret

Function at 0x79bf0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x79bf8
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x79dfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.000142a8
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x79dbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x400
call fcn.0007b580
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x79cc4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0xf63d0]
add eax, 0x20019
push eax
push 0
push 0x79e0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x79ca2
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x79e50
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0007ac5c
test eax, eax
jne 0x79ca2
cmp dword [ebp - 8], 1
jne 0x79ca2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0007ac20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79ccb
cmp dword [ebp - 0xc], 0
je 0x79cbe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x79ed8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x79f09
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x79f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x79f43
mov dword [ebp - 0x10], 0xffffffff
jmp 0x79f55
cmp byte [0xf6424], 0
je 0x79f55
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FlushFileBuffers
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x7a018
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetEndOfFile_1
test eax, eax
jne 0x7a03b
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x7a044
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x7a0c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0xf63d0]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x7a0d4
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7a0a1
push 0x7a118
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a0ca
cmp dword [ebp - 0xc], 0
je 0x7a0bd
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x7a124
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x7a221
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xea60
mov dword [ebp - 4], 0xea60
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x7a204
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0xf63d0]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x20]
call fcn.00075e10
mov eax, dword [ebp - 0x20]
call fcn.000140bc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x7a1e2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x7a230
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x7a1e2
cmp dword [ebp - 0x10], 4
jne 0x7a1e2
cmp dword [ebp - 0x14], 0x1388
jb 0x7a1e2
cmp dword [ebp - 0x14], 0x1d4c0
ja 0x7a1e2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a20b
cmp dword [ebp - 0x18], 0
je 0x7a1fe
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret

Function at 0x7aaa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 4]
jbe 0x7aad0
mov dword [ebp - 0x10], 8
jmp 0x7ab13
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x7aaea
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
call fcn.0007aa10
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x7ac5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 8]
jbe 0x7ac88
mov dword [ebp - 0x10], 8
jmp 0x7accb
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x7aca2
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dword [eax], edx
mov eax, dword [ebp - 4]
call fcn.0007abc8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x7acd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 6
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 8]
jbe 0x7acfe
mov dword [ebp - 0x10], 8
jmp 0x7ad1f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x7d6d4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7d80a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x400
call fcn.0007b580
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x7d7e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.0007ac04
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x2800
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 0x2800
call fcn.00017ea4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0007ac40
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
call fcn.000144cc
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x7d7ca
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2c]
mov eax, 0x7d818
call fcn.0007a2b0
push dword [ebp - 0x2c]
push dword [ebp - 0xc]
lea edx, [ebp - 0x30]
mov eax, 0x7d820
call fcn.0007a2b0
push dword [ebp - 0x30]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.000766dc
push dword [ebp - 0x34]
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00013fb8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00014458
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
call fcn.0007b7c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d7e7
lea eax, [ebp - 0x18]
call fcn.0007b5a4
ret
Function at 0x83e5c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x83fd4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00013d10
mov eax, dword [ebp - 0x10]
call fcn.00083b00
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
jne 0x83eaf
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00014140
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.000843f4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x83f8e
xor eax, eax
push ebp
push 0x83f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00083d08
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00084014
test al, al
je 0x83f65
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 0x18]
xor edx, edx
call fcn.00013d60
mov eax, dword [ebp - 0x44]
dec eax
cmp eax, 0
jl 0x83f65
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x83f5c
mov eax, dword [ebp - 0x18]
call fcn.000140bc
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00013e30
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00083e5c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffff
jne 0x83f12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83f8e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00083d08
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.000140bc
push eax
mov dl, byte [ebp - 0x1d]
mov eax, dword [ebp - 4]
call fcn.00083cd0
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83fdb
lea eax, [ebp - 0x48]
call fcn.00013c78
lea eax, [ebp - 0x18]
call fcn.00013c78
lea eax, [ebp - 0x10]
call fcn.00013c78
ret

Function at 0x83fe4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.000140bc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x84014
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x1c
call fcn.00012b38
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov eax, dword [ebp - 8]
add eax, 0x10
push eax
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
push 0
mov eax, dword [ebp - 8]
add eax, 4
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete byte [ebp - 9]
push 0x2a
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x84095
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 8]
add dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
add dword [edx + 0xc], eax
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x8409c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x8416f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x84151
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00084014
test al, al
je 0x84151
mov ecx, dword [ebp - 0x30]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00013d60
mov eax, dword [ebp - 0x34]
dec eax
test eax, eax
jl 0x84151
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.000140bc
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.00013e30
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x84100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84176
lea eax, [ebp - 0x38]
call fcn.00013c78
lea eax, [ebp - 0xc]
call fcn.00013c78
ret
Function at 0x8417c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x84245
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00084014
test al, al
je 0x84227
mov ecx, dword [ebp - 0x28]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00013d60
mov eax, dword [ebp - 0x2c]
dec eax
test eax, eax
jl 0x84227
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.000140bc
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.000140bc
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.00013e30
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x841d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8424c
lea eax, [ebp - 0x38]
call fcn.00013c78
lea eax, [ebp - 0xc]
call fcn.00013c78
ret

Function at 0x84250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00012b38
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.000140bc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
mov eax, dword [ebp - 0x14]
call fcn.00083b28
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x8436c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.000140bc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.00083b28
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x8ac14
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x8acec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0xfe084], 0
jne 0x8acd0
lea eax, [ebp - 4]
mov edx, 0x8ad04
call fcn.00013d10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.000140bc
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x8acd0
mov eax, ebx
call fcn.0001270c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x8acc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x8acb3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x8ad14
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x8acb3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0xfe084], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8acd0
mov eax, dword [ebp - 0xc]
call fcn.00012724
ret
mov ebx, dword [0xfe084]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8acf3
lea eax, [ebp - 4]
call fcn.00013c78
ret

Function at 0x9b214
Capabilities:
Set global application hook

Disassembly:
cmp dword [0xfe0a8], 0
jne 0x9b237
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x9b198
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0xfe0a8], eax
ret