joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005dff7
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x101caf1a
call fcn.100931aa
mov esi, ecx
push 1
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100d53d0
and dword [ebp - 4], 0
mov ecx, esi
call fcn.1005df85
test eax, eax
je 0x1005e04a
cmp dword [ebp + 8], 0
je 0x1005e04a
and dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.100938a6
pop ecx
add eax, eax
push eax
push dword [ebp + 8]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100d5430
call fcn.10093282
ret 4

Function at 0x1005e6a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10239420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.1005df5b
test ebx, ebx
je 0x1005e7a6
push esi
push ebx
call fcn.100938a6
mov esi, eax
pop ecx
test esi, esi
jbe 0x1005e7a5
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.100932c0
push 0x5c
push ebx
call fcn.100938c0
add esp, 0x14
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x1005e736
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.100938a6
pop ecx
lea esi, [esi + eax + 2]
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005fc3e
pop ecx
mov dword [edi + 0x28], eax
test eax, eax
je 0x1005e7a5
lea ecx, [esi + esi + 2]
push ecx
push 0
push eax
call fcn.100932c0
add esp, 0xc
cmp dword [ebp - 0x210], 0
jne 0x1005e798
lea eax, [ebp - 0x20c]
push eax
push dword [edi + 0x28]
call fcn.10093811
push 0x101dad04
push dword [edi + 0x28]
call fcn.100937e3
push ebx
push dword [edi + 0x28]
call fcn.100937e3
add esp, 0x18
jmp 0x1005e7a5
push esi
push ebx
push dword [edi + 0x28]
call fcn.1009385c
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1009319b
leave
ret 4

Function at 0x100677a3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x101cbc85
call fcn.100931aa
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10060d80
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x10067805
call fcn.10064246
cmp eax, 1
jne 0x10067805
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.10066f6e
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.100636b2
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001e7c8
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001e7c8
mov eax, esi
call fcn.10093282
ret 0x10
Function at 0x1006782e
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x101cbcb0
call fcn.100931aa
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10060d80
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x10067890
call fcn.10064246
cmp eax, 1
jne 0x10067890
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.10066f6e
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.100636b2
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001e7c8
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001e7c8
mov eax, esi
call fcn.10093282
ret 0x14

Function at 0x100678bc
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x101cbcdb
call fcn.100931aa
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10060d80
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1006791e
call fcn.10064246
cmp eax, 1
jne 0x1006791e
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.10066f6e
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.100636b2
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001e7c8
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001e7c8
mov eax, esi
call fcn.10093282
ret 8

Function at 0x10075a15
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10075a5c
call fcn.10064e60
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10075a5c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10075a78
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1007558d
mov esi, eax
test edi, edi
je 0x10075a76
test ebx, ebx
je 0x10075a76
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10079807
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101cd030
call fcn.100931aa
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1007982c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10079872
lea ecx, [ebp - 0x10]
call fcn.100605b9
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1005fcc1
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001e7c8
mov eax, esi
call fcn.10093282
ret 8

Function at 0x10082ee6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x10082f0a
cmp dword [edi + 0x54], 0
jne 0x10082f0a
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10064e60
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.10082ea7
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1009319b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10239420]
jne 0x100931a5
repz ret
jmp fcn.1009d96c
Function at 0x100bb1e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1009d29d
and dword [ebp - 4], 0
cmp dword [0x1025f180], 0
mov ebx, eax
jne 0x100bb295
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100bb346
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10200e2c
push edi
call esi
test eax, eax
je 0x100bb346
push eax
call fcn.1009d22b
mov dword [esp], 0x10200e1c
push edi
mov dword [0x1025f180], eax
call esi
push eax
call fcn.1009d22b
mov dword [esp], 0x10200e08
push edi
mov dword [0x1025f184], eax
call esi
push eax
call fcn.1009d22b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1025f188], eax
call esi
push eax
call fcn.1009d22b
pop ecx
mov dword [0x1025f190], eax
test eax, eax
je 0x100bb295
push 0x10200dd4
push edi
call esi
push eax
call fcn.1009d22b
pop ecx
mov dword [0x1025f18c], eax
mov eax, dword [0x1025f18c]
cmp eax, ebx
je 0x100bb2ed
cmp dword [0x1025f190], ebx
je 0x100bb2ed
push eax
call fcn.1009d2a6
push dword [0x1025f190]
mov esi, eax
call fcn.1009d2a6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100bb2ed
test edi, edi
je 0x100bb2ed
call esi
test eax, eax
je 0x100bb2e4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100bb2e4
test byte [ebp - 0xc], 1
jne 0x100bb2ed
or dword [ebp + 0x10], 0x200000
jmp 0x100bb326
mov eax, dword [0x1025f184]
cmp eax, ebx
je 0x100bb326
push eax
call fcn.1009d2a6
pop ecx
test eax, eax
je 0x100bb326
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100bb326
mov eax, dword [0x1025f188]
cmp eax, ebx
je 0x100bb326
push eax
call fcn.1009d2a6
pop ecx
test eax, eax
je 0x100bb326
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1025f180]
call fcn.1009d2a6
pop ecx
test eax, eax
je 0x100bb346
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100bb348
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c6fb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100c6ffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100c6ffe
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x100c7003
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x100c6fe9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x100c7013
test esi, esi
jne 0x100c7031
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x100c702f
mov byte [eax + esi - 1], 0
jne 0x100c7038
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x100cc720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100cc770
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x100cc770
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x100cc775
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x100cc75b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x100cc782
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x100d6220
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100d6261
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100d6263
mov esi, edi
test esi, esi
je 0x100d62d8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100d62cd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x100d62cd
cmp dword [esp + 0x1c], eax
jbe 0x100d629e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100d62cd
cmp esi, edi
je 0x100d62bf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x100d62d8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x100d62f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x100d6355
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x100d6355
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x100d6355
cmp dword [esp + 0x18], eax
jbe 0x100d633b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x100d6359
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x100d6430
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x100d648f
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x100d648f
cmp dword [esp + 0xc], 3
jne 0x100d648f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x100d648f
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x100d648f
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x100d64a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ecx]
mov ecx, dword [esp + 0xc]
push ebp
push esi
test ecx, ecx
push edi
je 0x100d64d7
lea edx, [esp + 0x10]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x10]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100d64d9
mov esi, ebx
test esi, esi
je 0x100d6562
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d6557
cmp dword [esp + 0x1c], 3
jne 0x100d6557
mov edx, dword [esp + 0x18]
push edx
call fcn.1005fc04
mov edi, eax
add esp, 4
test edi, edi
je 0x100d6557
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d654e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
cmp esi, ebx
mov dword [ecx], edx
je 0x100d6544
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push edi
call fcn.1005fc33
add esp, 4
cmp esi, ebx
je 0x100d6562
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x100d6570
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x100d65e4
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100d65e4
cmp dword [esp + 0x10], 3
jne 0x100d65e4
mov edx, dword [esp + 0x18]
push edx
call fcn.1005fc04
mov edi, eax
add esp, 4
test edi, edi
je 0x100d65e4
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100d65db
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.1005fc33
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x100d65f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x101cef7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x10200e98]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x100d665b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100d665d
mov esi, edi
test esi, esi
je 0x100d6727
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d671c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x100d669f
cmp eax, 2
je 0x100d669f
cmp eax, 6
je 0x100d669f
cmp eax, 7
jne 0x100d671c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.1005fc04
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x100d6702
lea ecx, [esp + 0x14]
call fcn.100c8b60
cmp esi, dword [esp + 0x14]
je 0x100d66f7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.1005fc33
add esp, 4
jmp 0x100d6739
call fcn.1005fc33
add esp, 4
lea ecx, [esp + 0x10]
push 0x1025f210
call fcn.100c8b60
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x100d6727
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x100d6739
push eax
lea ecx, [esp + 0x14]
call fcn.100c8b60
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.100c7ee0
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.100c88e0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x100d7340
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x100d736c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100d736c
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x100d7420
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100d7459
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.100938a6
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x100d7459
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x100d7490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101cf048
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x100d74e6
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100d74e9
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d75dc
call fcn.100eb9b0
test eax, eax
je 0x100d7539
mov edi, dword [ebp + 0x18]
push edi
call fcn.100938a6
mov ecx, dword [ebp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100d75d0
cmp esi, dword [ebp + 8]
je 0x100d752f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100d75de
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100d7578
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10099630
mov edi, esp
test edi, edi
je 0x100d7578
mov edx, dword [ebp + 0x10]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x100d757a
xor edi, edi
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push eax
call fcn.100c2e00
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100d75c1
cmp esi, dword [ebp + 8]
je 0x100d75ab
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.100c3560
mov eax, 1
jmp 0x100d75de
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.100c3560
cmp esi, dword [ebp + 8]
je 0x100d75dc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret