joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c437
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1037208]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x101c47b
call esi
test eax, eax
je 0x101c460
mov dword [0x1037208], 1
jmp 0x101c480
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x101c477
mov dword [0x1037208], 2
jmp 0x101c489
xor eax, eax
jmp 0x101c4df
cmp eax, 1
jne 0x101c484
call esi
jmp 0x101c4df
cmp eax, 2
jne 0x101c477
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 1
push 0
mov dword [ebp - 8], eax
call esi
mov edi, eax
test edi, edi
je 0x101c4dc
push 2
push edi
call fcn.01019737
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x101c4dc
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push 1
push 0
call esi
test eax, eax
je 0x101c4d3
mov eax, dword [ebp - 4]
jmp 0x101c4de
push dword [ebp - 4]
call fcn.01017bef
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1022120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1022133
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x102212f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x1022160
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x102219f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1022195
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10221a1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1022185
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1023dbe
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101ca0f
mov ebx, dword [ebp + 8]
mov esi, eax
add esi, 0x9c
test ebx, ebx
jne 0x1023de6
or dword [esi + 8], 0x104
jmp 0x1023eaa
lea eax, [ebx + 0x40]
test eax, eax
lea edi, [esi + 4]
mov dword [esi], ebx
mov dword [edi], eax
je 0x1023e09
cmp byte [eax], 0
je 0x1023e09
push edi
push 0x16
push 0x1008408
call fcn.010237a5
add esp, 0xc
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x1023e66
cmp byte [eax], 0
je 0x1023e66
mov eax, dword [edi]
test eax, eax
je 0x1023e2a
cmp byte [eax], 0
je 0x1023e2a
call fcn.01023cf9
jmp 0x1023e2f
call fcn.01023d71
cmp dword [esi + 8], 0
jne 0x1023ec0
push esi
push 0x41
push 0x10081f8
call fcn.010237a5
add esp, 0xc
test eax, eax
je 0x1023eb6
mov edi, dword [edi]
test edi, edi
je 0x1023e5f
cmp byte [edi], 0
je 0x1023e5f
call fcn.01023cf9
jmp 0x1023eb6
call fcn.01023d71
jmp 0x1023eb6
mov edi, dword [edi]
test edi, edi
je 0x1023ea3
cmp byte [edi], 0
je 0x1023ea3
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1023e76
xor ecx, ecx
sub eax, edx
cmp eax, 3
sete cl
push 1
push 0x102390f
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x1023eb6
and dword [esi + 8], 0
jmp 0x1023eb6
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], 0
je 0x1023fb4
mov eax, ebx
add ebx, 0x80
neg eax
sbb eax, eax
and eax, ebx
push eax
mov edx, esi
call fcn.0102380c
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp + 8], edi
je 0x1023fb4
cmp edi, 0xfde8
je 0x1023fb4
cmp edi, 0xfde9
je 0x1023fb4
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1023fb4
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1023fb4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1023f3b
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], di
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1023faf
cmp word [eax], 0x814
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jne 0x1023f74
push 0x10084dc
push 0x40
push ebx
call fcn.0101ec27
add esp, 0xc
test eax, eax
je 0x1023f85
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.01018710
add esp, 0x14
jmp 0x1023f85
push 0x40
push ebx
push 0x1001
push dword [esi + 0x18]
call edi
test eax, eax
je 0x1023fb4
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call edi
test eax, eax
je 0x1023fb4
push 0xa
push 0x10
add ebx, 0x80
push ebx
push dword [ebp + 8]
call fcn.01026c0a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1023fb6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1024818
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0101c791
xor ebx, ebx
cmp dword [0x1037708], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10248ef
push 0x10085dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x102485a
xor eax, eax
jmp 0x10249b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10085d0
push edi
call esi
cmp eax, ebx
je 0x1024853
push eax
call fcn.0101c726
mov dword [esp], 0x10085c0
push edi
mov dword [0x1037708], eax
call esi
push eax
call fcn.0101c726
mov dword [esp], 0x10085ac
push edi
mov dword [0x103770c], eax
call esi
push eax
call fcn.0101c726
mov dword [0x1037710], eax
lea eax, [ebp - 8]
push eax
call fcn.0101b8c2
test eax, eax
pop ecx
pop ecx
je 0x10248bd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01018710
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10248ef
push 0x1008590
push edi
call esi
push eax
call fcn.0101c726
cmp eax, ebx
pop ecx
mov dword [0x1037718], eax
je 0x10248ef
push 0x1008578
push edi
call esi
push eax
call fcn.0101c726
pop ecx
mov dword [0x1037714], eax
mov eax, dword [0x1037714]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1024968
cmp dword [0x1037718], esi
je 0x1024968
push eax
call fcn.0101c79f
pop ecx
call eax
cmp eax, ebx
je 0x1024935
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1037718]
call fcn.0101c79f
pop ecx
call eax
test eax, eax
je 0x1024935
test byte [ebp - 0x18], 1
jne 0x1024968
lea eax, [ebp - 0xc]
push eax
call fcn.0101b903
test eax, eax
pop ecx
je 0x1024950
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01018710
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x102495f
or dword [ebp + 0x10], 0x200000
jmp 0x1024999
or dword [ebp + 0x10], 0x40000
jmp 0x1024999
mov eax, dword [0x103770c]
cmp eax, esi
je 0x1024999
push eax
call fcn.0101c79f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1024999
mov eax, dword [0x1037710]
cmp eax, esi
je 0x1024999
push dword [ebp - 4]
push eax
call fcn.0101c79f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1037708]
call fcn.0101c79f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1026542
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1037768]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
xor edi, edi
cmp eax, edi
jne 0x1026596
push edi
push edi
xor ebx, ebx
inc ebx
push ebx
push edi
call esi
test eax, eax
je 0x102657c
mov dword [0x1037768], ebx
jmp 0x102659b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1026591
push 2
pop eax
mov dword [0x1037768], eax
jmp 0x1026596
mov eax, dword [0x1037768]
cmp eax, 1
jne 0x10265ae
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
jmp 0x102666d
cmp eax, 2
je 0x10265b7
cmp eax, edi
jne 0x10265e0
cmp dword [ebp + 0x1c], edi
mov dword [ebp - 8], edi
jne 0x10265ca
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0x1c], eax
push edi
push edi
push dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push dword [ebp + 0xc]
call edi
mov ebx, eax
test ebx, ebx
jne 0x10265e7
xor eax, eax
jmp 0x102666d
jle 0x102662d
push 0xffffffffffffffe0
xor edx, edx
pop eax
div ebx
cmp eax, 1
jb 0x102662d
lea eax, [ebx + 8]
cmp eax, 0x400
ja 0x1026615
call fcn.01019970
mov esi, esp
test esi, esi
je 0x10265e0
mov dword [esi], 0xcccc
add esi, 8
jmp 0x102662f
push eax
call fcn.010194d1
test eax, eax
pop ecx
je 0x1026629
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
jmp 0x102662f
xor esi, esi
test esi, esi
je 0x10265e0
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x1026663
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x102664c
push eax
push eax
jmp 0x1026652
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0xffffffffffffffff
push esi
push 1
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 8], eax
push esi
call fcn.010199fd
mov eax, dword [ebp - 8]
pop ecx
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010171cf
leave
ret
Function at 0x1027ec6
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.01025a57
mov dword [ebp - 0x18], eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x14], edx
je 0x1027f4e
push 2
push ebx
push ebx
push dword [ebp + 8]
call fcn.01025a57
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
je 0x1027f4e
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
js 0x1027fe3
jg 0x1027f27
cmp esi, ebx
jbe 0x1027fe3
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1027f5a
call fcn.0101e0e8
mov dword [eax], 0xc
call fcn.0101e0e8
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.01028081
pop ecx
pop ecx
mov dword [ebp - 8], eax
test edi, edi
jl 0x1027f7a
jg 0x1027f76
cmp esi, ebx
jb 0x1027f7a
mov eax, ebx
jmp 0x1027f7c
mov eax, esi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010203d2
add esp, 0xc
cmp eax, 0xffffffff
je 0x1027fc6
cdq
sub esi, eax
sbb edi, edx
js 0x1027f9d
jg 0x1027f6c
test esi, esi
ja 0x1027f6c
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.01028081
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x102804c
call fcn.0101e100
cmp dword [eax], 5
jne 0x1027fdb
call fcn.0101e0e8
mov dword [eax], 0xd
or esi, 0xffffffff
mov dword [ebp - 0xc], esi
jmp 0x1027fa0
cmp edi, ebx
jg 0x1028058
jl 0x1027fed
cmp esi, ebx
jae 0x1028058
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01025a57
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x1027f4e
push dword [ebp + 8]
call fcn.01025fd0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x1028058
call fcn.0101e0e8
mov dword [eax], 0xd
call fcn.0101e100
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x1027f4e
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.01025a57
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x1027f4e
xor eax, eax
jmp 0x1027f55
Function at 0x1028253
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x102829d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 3
je 0x1028336
cmp edi, 2
jne 0x1028358
jmp 0x1028336
test al, 0x10
je 0x102831c
push esi
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0100e2f6
test eax, eax
jl 0x1028358
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x224], ecx
mov word [ebp - 0x220], 0x14
mov dword [ebp - 0x21a], ecx
mov dword [ebp - 0x216], 0x10049c8
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x1028356
test al, 1
je 0x102832b
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x102833a
xor edi, edi
jmp 0x1028358
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1028350
mov edi, 0xbc2
jmp 0x1028358
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010171cf
leave
ret 4

Function at 0x102836f
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
xor ebx, ebx
push esi
lea eax, [ebp - 0x20e]
push ebx
push eax
mov word [ebp - 0x210], bx
call fcn.01017220
push esi
lea eax, [ebp - 0x41a]
push ebx
push eax
mov word [ebp - 0x41c], bx
call fcn.01017220
add esp, 0x18
push 6
pop ecx
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x43c], ebx
lea edi, [ebp - 0x438]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100e2f6
test eax, eax
jl 0x1028452
push dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0100e2f6
test eax, eax
jl 0x1028452
lea eax, [ebp - 0x210]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x43c]
push eax
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], 1
mov word [ebp - 0x42c], 0x210
mov dword [ebp - 0x426], ebx
mov dword [ebp - 0x422], 0x10049c8
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
jmp 0x1028454
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010171cf
leave
ret 8
Function at 0x10286e2
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
push 0x20019
xor edi, edi
push edi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10287ff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x10092fc
push edi
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
cmp esi, edi
jne 0x10287f3
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x1036aec
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x214], eax
call fcn.010119fb
push dword [ebp - 0x214]
lea ecx, [ebp - 0x210]
call fcn.010120bc
push dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x210]
call fcn.0102863a
push 0x10092e4
lea ecx, [ebp - 0x210]
call fcn.010286bc
call fcn.01028585
mov esi, eax
cmp esi, edi
mov edi, dword [ebp - 0x210]
jne 0x10287eb
push edi
push ebx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov esi, eax
lea ecx, [edi - 0x10]
call fcn.0100fa45
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010171cf
leave
ret 8
Function at 0x1028817
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x214]
push eax
mov esi, 0x20019
push esi
xor ebx, ebx
push ebx
push 0x1009208
push 0x80000001
call edi
cmp eax, ebx
je 0x1028864
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x1028a87
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
push esi
push ebx
push 0x10063b8
push 0x80000002
call edi
cmp eax, ebx
mov dword [ebp - 0x22c], eax
jne 0x1028a7c
push 0x100649c
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], 0x104
call fcn.010135cf
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
jmp 0x1028a30
inc dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 0x104
call fcn.010135cf
mov esi, dword [ebp - 0x228]
push dword [esi - 0xc]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x218]
call fcn.010120ef
push esi
mov esi, dword [ebp - 0x224]
push esi
call fcn.0101798c
test eax, eax
pop ecx
pop ecx
je 0x1028923
lea ecx, [esi - 0x10]
jmp 0x1028a05
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x80000003
push esi
call edi
test eax, eax
jne 0x102897b
xor esi, esi
push dword [esi + 0x1009324]
push dword [ebp - 0x210]
push dword [esi + 0x1009320]
push dword [ebp - 0x210]
call fcn.0102846a
add esi, 8
cmp esi, 0x10
jb 0x1028945
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10289fc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.010286e2
cmp eax, ebx
mov dword [ebp - 0x22c], eax
jne 0x1028a46
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x20c]
push eax
push esi
call edi
test eax, eax
jne 0x10289ee
xor esi, esi
push dword [esi + 0x1009324]
push dword [ebp - 0x210]
push dword [esi + 0x1009320]
push dword [ebp - 0x210]
call fcn.0102846a
add esi, 8
cmp esi, 0x10
jb 0x10289b8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x80000003
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0100fa45
mov ecx, dword [ebp - 0x218]
add ecx, 0xfffffff0
call fcn.0100fa45
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10288cb
jmp 0x1028a62
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0100fa45
mov ecx, dword [ebp - 0x218]
add ecx, 0xfffffff0
call fcn.0100fa45
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0100fa45
xor eax, eax
cmp dword [ebp - 0x22c], ebx
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010171cf
leave
ret
Function at 0x1029608
Capabilities:
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push 6
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x80004005
mov dword [ebp - 4], ebx
call fcn.01029473
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], eax
jne 0x1029644
mov dword [ebp - 8], ebx
jmp 0x10296bd
cmp eax, ebx
je 0x10296bd
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
je 0x10296bc
cmp dword [ebp - 0x20], 1
jne 0x1029667
mov dword [ebp - 8], ebx
jmp 0x10296bc
cmp dword [ebp - 0x20], 3
je 0x1029680
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x10296bc
push 0x1e
pop ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
push 0x3e8
rep stosd dword es:[edi], eax
dec ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
je 0x10296bc
test ebx, ebx
jle 0x10296bc
cmp dword [ebp - 0x20], 1
je 0x10296b8
cmp dword [ebp - 0x20], 3
je 0x1029683
jmp 0x10296bc
and dword [ebp - 8], 0
pop esi
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.01029555
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 4

Function at 0x10296e3
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push edi
xor eax, eax
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x7530
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov eax, 0x10049c8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
inc ebx
push 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 0x15180
mov dword [ebp - 0x10], 3
call fcn.01029473
mov edi, eax
test edi, edi
je 0x1029760
lea eax, [ebp - 0x1c]
push eax
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x1029760
mov byte [ebp - 1], bl
push dword [ebp - 8]
push edi
call fcn.01029555
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret