joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434004]
jne 0x40100a
repz ret
jmp fcn.00401221

Function at 0x404dbc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402623
and dword [ebp - 4], 0
cmp dword [0x435bf0], 0
mov ebx, eax
jne 0x404e6d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404f1e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404f1e
push eax
call fcn.004025b1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435bf0], eax
call esi
push eax
call fcn.004025b1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435bf4], eax
call esi
push eax
call fcn.004025b1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435bf8], eax
call esi
push eax
call fcn.004025b1
pop ecx
mov dword [0x435c00], eax
test eax, eax
je 0x404e6d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025b1
pop ecx
mov dword [0x435bfc], eax
mov eax, dword [0x435bfc]
cmp eax, ebx
je 0x404ec5
cmp dword [0x435c00], ebx
je 0x404ec5
push eax
call fcn.0040262c
push dword [0x435c00]
mov esi, eax
call fcn.0040262c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404ec5
test edi, edi
je 0x404ec5
call esi
test eax, eax
je 0x404ebc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404ebc
test byte [ebp - 0xc], 1
jne 0x404ec5
or dword [ebp + 0x10], 0x200000
jmp 0x404efe
mov eax, dword [0x435bf4]
cmp eax, ebx
je 0x404efe
push eax
call fcn.0040262c
pop ecx
test eax, eax
je 0x404efe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404efe
mov eax, dword [0x435bf8]
cmp eax, ebx
je 0x404efe
push eax
call fcn.0040262c
pop ecx
test eax, eax
je 0x404efe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435bf0]
call fcn.0040262c
pop ecx
test eax, eax
je 0x404f1e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404f20
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4314b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x434004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x50e2e4]
push ebx
push esi
mov esi, dword [0x50e12c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x4314ea
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x434c70]
call fcn.004313a0
cmp dword [0x50e2e4], 0x2f
jne 0x431505
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.004313e0
add esp, 4
cmp dword [0x50e2e4], 0x568
pop esi
pop ebx
jne 0x43152e
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x1001f410
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x10084664], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x1001f454
call ebx
test eax, eax
jns 0x1001f44a
push 0x100026c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x100026b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10084660], eax
mov dword [0x10084664], 1
mov eax, dword [0x10084660]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001f470
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001f4a0
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x1001f496
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x1001f48b
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x1001f490
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x1001f49f
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x1001f7da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001f843
cmp dword [ebp + 0x10], 1
je 0x1001f81b
cmp dword [ebp + 0x10], 2
je 0x1001f81b
push 0xd
pop eax
jmp 0x1001f843
mov eax, dword [ebp - 4]
test edi, edi
je 0x1001f83d
test eax, eax
je 0x1001f838
test al, 1
jne 0x1001f816
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1001f83d
jmp 0x1001f816
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x1001f89c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
jne 0x1001f8af
push 0xd
pop eax
jmp 0x1001f8da
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1001f8b2
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10020031
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x10053430]
mov bl, 1
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002009b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x10053434]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10020092
cmp dword [ebp - 0xc], 4
jne 0x10020092
cmp dword [ebp - 0x10], eax
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x1002055c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1001e278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor edi, edi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x208], edi
call fcn.1001f7a5
mov ebx, eax
cmp ebx, edi
je 0x100205c7
lea ecx, [ebp - 0x20c]
call fcn.1001f73c
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004da5d
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100205e5
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.1002055c
cmp eax, edi
jne 0x1002062d
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], pe_nt_image_headers32
call ebx
test eax, eax
je 0x100205cf
lea ecx, [ebp - 0x20c]
call fcn.1001f73c
push dword [ebp - 0x214]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.1001f73c
mov eax, esi
jmp 0x100205b6
Function at 0x10022d9a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1001e278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x408], edi
call fcn.10020ac8
mov dword [ebp - 0x40c], eax
cmp eax, edi
jne 0x10022df2
call fcn.1001f66b
mov esi, eax
jmp 0x10022ed3
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x10022e0b
call fcn.1001f66b
jmp 0x10022ec5
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x10022e01
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x10022e70
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x10022e4d
lea ecx, [ebp - 0x408]
call fcn.1002019c
mov esi, 0x8007000e
lea ecx, [ebp - 0x410]
call fcn.100200b7
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004da5d
leave
ret 0x10
push eax
lea ecx, [ebp - 0x408]
call fcn.100211cd
cmp dword [ebp - 0x408], edi
jne 0x10022e8b
mov esi, 0x8007000e
jmp 0x10022ec7
push esi
push dword [ebp - 0x408]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x10022e01
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x418]
call fcn.1002295b
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x10022e52
lea ecx, [ebp - 0x408]
call fcn.1002019c
jmp 0x10022e52
Function at 0x10024c5d
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x10024c7e
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x10024c7e
cmp edx, eax
jb 0x10024c7e
add eax, 0x10000
cmp eax, ecx
jae 0x10024ca9
mov eax, dword [0x10053c10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.10026def
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
ret

Function at 0x10025379
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 4]
push eax
push 1
push ecx
xor esi, esi
push edx
mov dword [esp + 0x14], esi
call fcn.10036f8e
test eax, eax
jne 0x100253e3
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100253e3
cmp dword [esp + 0x10], 4
jne 0x100253e3
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x100253fa
push eax
mov dword [esp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x100257fa
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1001e278]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x414], ecx
test esi, esi
jne 0x1002583a
xor eax, eax
jmp 0x100259aa
and dword [esi], 0
push ebx
push edi
mov edi, dword [ebp + 0x20]
xor ebx, ebx
inc ebx
push ebx
push edi
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x420], ebx
call fcn.100294dd
and dword [ebp - 0x410], 0
and dword [ebp - 0x418], 0
shr edi, 0x1a
not edi
mov dword [ebp - 0x408], eax
and edi, ebx
cmp dword [ebp - 0x408], 0
je 0x1002589f
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x17
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [esi], eax
cmp dword [esi], 0
jne 0x1002593b
test edi, edi
je 0x1002593b
and dword [ebp - 0x40c], 0
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.1002939f
test eax, eax
je 0x10025921
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.10029126
cmp dword [ebp - 0x40c], 5
jne 0x10025921
cmp dword [ebp - 0x418], 0
jne 0x10025921
mov dword [ebp - 0x418], ebx
jmp 0x1002587a
cmp dword [esi], 0
je 0x1002593b
xor eax, eax
cmp dword [ebp - 0x40c], 0xb7
setne al
mov dword [ebp - 0x410], eax
mov eax, dword [esi]
xor ecx, ecx
cmp eax, ecx
je 0x10025948
cmp eax, 0xffffffff
jne 0x10025967
cmp edi, ecx
je 0x10025957
push ecx
push 0x787a6c65
call fcn.10026def
xor ecx, ecx
mov dword [esi], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x420], ecx
pop edi
pop ebx
cmp dword [ebp - 0x41c], ecx
je 0x10025992
mov eax, dword [ebp - 0x408]
cmp eax, ecx
jne 0x10025980
mov eax, 0x100031a0
push dword [ebp + 0x14]
push dword [ebp - 0x41c]
push eax
call fcn.10025786
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x100259a4
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1004da5d
leave
ret 0x1c
Function at 0x100261d0
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10089710]
sub esp, 0x18
push ebx
push esi
push edi
mov dword [0x10084738], eax
mov eax, dword [0x10084724]
xor edi, edi
cmp eax, edi
je 0x1002620c
push eax
call fcn.10025f8b
push dword [0x10089710]
mov dword [0x10084738], eax
push dword [0x10084724]
call fcn.10025b34
jmp 0x10026282
mov eax, dword [0x10084728]
cmp eax, edi
je 0x10026282
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 8]
push ecx
push 0x2001f
push eax
push Ordinal_4
mov dword [ebp - 0x18], 4
call fcn.10036f67
test eax, eax
jne 0x10026282
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov esi, 0x100031a8
push esi
push dword [ebp - 8]
call fcn.10025583
test eax, eax
jne 0x10026279
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x18]
mov dword [0x10084738], eax
mov eax, dword [0x10089710]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp - 8]
call fcn.100255a1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x10053c04], edi
je 0x1002629b
call fcn.100261af
push eax
push dword [0x10053c04]
call fcn.10025b34
call fcn.100261af
mov esi, eax
call fcn.1002618e
mov ebx, eax
cmp esi, ebx
je 0x100263b1
movzx eax, si
push eax
call fcn.1003fa97
test eax, eax
jne 0x100262cf
movzx eax, bx
push eax
call fcn.1003fa97
test eax, eax
je 0x100263b1
lea eax, [ebp - 4]
push eax
push 0x20019
push 0x10003440
call fcn.10025a66
test eax, eax
jne 0x100263b1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x100263b1
imul eax, eax, 0x104
push eax
lea eax, [ebp - 0xc]
mov esi, 0x104
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
call fcn.1002524b
test eax, eax
jne 0x10026339
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100263b1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x10026385
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x10026385
add dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
add ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x10026357
mov ebx, dword [ebp - 8]
cmp ebx, edi
jle 0x100263a0
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add edi, esi
dec ebx
jne 0x1002638c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.10025075
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10027a19
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x10027a34
mov eax, 0xa0
jmp 0x10027b0b
push edi
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jmp 0x10027ab6
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
je 0x10027a65
push eax
call fcn.10032433
mov edi, eax
cmp edi, ebx
jne 0x10027a65
push ebx
push 0x77626966
call fcn.10026def
mov dword [ebp - 0xc], 8
jmp 0x10027a7c
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x10027a71
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x10027a86
push edi
call fcn.10025075
push dword [ebp - 0xc]
call fcn.10026f88
pop ecx
test eax, eax
je 0x10027af2
push 0x796d7466
push ebx
call fcn.10026e81
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027329
lea ecx, [ebp - 4]
mov dword [ebp + 8], ebx
call fcn.10027113
lea ecx, [ebp - 4]
call fcn.100270ef
movzx eax, word [esi + 0xc]
shr eax, 1
push ebx
and eax, 0x10
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.10027387
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x10027a3d
lea ecx, [ebp - 4]
call fcn.10027113
mov eax, edi
jmp 0x10027b0a
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027254
lea ecx, [ebp - 4]
call fcn.10027113
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10027b11
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x10027b29
xor eax, eax
jmp 0x10027c1f
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x10027b39
cmp dword [0x10084718], ebx
je 0x10027b4b
mov dword [ebp - 4], ebx
call fcn.10026eef
test eax, eax
je 0x10027b52
test byte [edi + 0xc], 0x10
jne 0x10027b52
xor eax, eax
jmp 0x10027c1e
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call fcn.100270ef
movzx eax, word [edi + 0xc]
neg esi
sbb esi, esi
shr eax, 1
and esi, 2
and eax, 0x10
mov dword [ebp - 0xc], esi
or eax, esi
jmp 0x10027be1
mov eax, dword [edi]
cmp eax, ebx
je 0x10027b86
push eax
call fcn.10032433
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x10027b92
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x10027baf
push dword [ebp - 4]
call fcn.10025075
push esi
call fcn.10026f88
pop ecx
test eax, eax
je 0x10027c02
push 0x796d7468
push ebx
call fcn.10026e81
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027329
movzx eax, word [edi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebp + 8], ebx
push ebx
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [edi + 8]
call fcn.10027387
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x10027b77
jmp 0x10027c0f
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027254
lea ecx, [ebp - 0x10]
call fcn.10027113
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop edi
pop ebx
leave
ret
Function at 0x10027fec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x10028002
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
pop ebx
mov esi, eax
cmp dword [ebp - 4], ebx
jae 0x10028034
cmp dword [ebp + 0xc], 1
je 0x10028032
cmp dword [ebp + 0xc], ebx
jne 0x10028034
mov esi, ebx
push esi
call fcn.10026f88
pop ecx
test eax, eax
je 0x1002805a
push 0x796d746b
push 0
call fcn.10026e81
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027329
jmp 0x100280ba
test esi, esi
jne 0x100280ad
cmp dword [ebp + 0xc], ebx
je 0x10028069
cmp dword [ebp + 0xc], 1
jne 0x10028075
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
cmp dword [ebp + 0xc], ebx
je 0x1002807f
cmp byte [ebp + 0x1c], bl
jne 0x10028098
mov eax, dword [ebp + 0x18]
shr eax, 1
push eax
push edi
call fcn.10025a7d
pop ecx
pop ecx
test eax, eax
jne 0x10028098
mov esi, 0xea
jmp 0x100280ad
movzx eax, byte [ebp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.10026ec7
pop ecx
pop ecx
test eax, eax
jne 0x100280ad
mov esi, ebx
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027254
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100280c1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
or edi, 0xffffffff
cmp dword [ebp - 4], ebx
jne 0x100280eb
cmp dword [0x10084718], ebx
je 0x100280fa
mov dword [ebp - 0xc], 2
jmp 0x10028107
cmp dword [ebp - 4], 1
jne 0x100280fa
call fcn.10026eef
test eax, eax
je 0x10028104
test byte [esi + 0xc], 0x10
je 0x100281f7
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x18]
call fcn.100270ef
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.10027387
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x100281ed
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10028154
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.10026f88
pop ecx
test eax, eax
je 0x100281b9
push 0x796d746c
xor edi, edi
push edi
call fcn.10026e81
push ebx
mov ecx, 0x10086088
call fcn.10027329
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], edi
call fcn.10027387
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10028140
jmp 0x100281ed
push ebx
mov ecx, 0x10086088
call fcn.10027254
test edi, edi
jne 0x100281ed
movzx eax, word [esi + 0xc]
mov ecx, eax
and ecx, 0xf
cmp dword [ebp - 0x14], ecx
je 0x1002820b
cmp dword [ebp - 0x14], 3
jne 0x100281ea
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 4
jne 0x100281ea
and al, 0xf
cmp al, 4
je 0x1002820b
push 2
pop edi
lea ecx, [ebp - 0x18]
call fcn.10027113
xor ebx, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100280d2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x18]
mov dword [eax], 1
call fcn.10027113
xor eax, eax
jmp 0x10028206