joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x27c5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x27c74
call fcn.00013d6c
lea eax, [ebp - 8]
mov edx, 0x1000
call fcn.000271f0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
push 0x27c88
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x27c20
mov dword [ebp - 0xc], 0x1000
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x27cb4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x27c20
cmp dword [ebp - 4], 1
jne 0x27c20
cmp dword [ebp - 0xc], 0
jbe 0x27c20
cmp dword [ebp - 0xc], 0xfff
ja 0x27c20
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00013ee0
lea eax, [ebp - 0x14]
call fcn.00027a14
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00013f70
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx]
call fcn.000140b8
je 0x27c20
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx]
mov eax, dword [ebp - 0x14]
call fcn.0001c680
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00013d6c
cmp dword [ebp - 0x10], 0
je 0x27c2f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 8]
mov edx, 0x1000
call fcn.00027218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x27c66
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x14]
call fcn.000143f0
ret
Function at 0x27e08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x27ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov word [eax], 0
mov eax, dword [ebp + 8]
mov word [eax], 0
mov eax, dword [ebp - 4]
mov word [eax], 0
mov word [edi], 0
lea eax, [ebp - 0xc]
push eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x27ed7
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.000271f0
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x27ecd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x27ef4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x27ecd
cmp dword [ebp - 0x14], 0x34
jne 0x27ecd
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
call fcn.000180e4
mov word [edi], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.000180e4
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0xc]
mov edx, dword [ebp + 8]
mov word [edx], ax
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00027218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x27eeb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x288ac
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x289f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x28a10
call fcn.00013d6c
lea eax, [ebp - 0x18]
mov edx, 0x1000
call fcn.000271f0
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
push 0x28a2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x289c0
mov dword [ebp - 8], 0x1000
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x28a70
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x289c0
cmp dword [ebp - 4], 1
jne 0x289c0
cmp dword [ebp - 8], 0
jbe 0x289c0
cmp dword [ebp - 8], 0xfff
ja 0x289c0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00014548
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0001442c
mov edx, dword [ebp - 0x10]
mov eax, 0x28a94
call fcn.0001495c
mov esi, eax
test esi, esi
jle 0x2898b
lea eax, [ebp - 0xc]
mov ecx, esi
mov edx, 1
call fcn.00014830
mov edx, dword [ebp - 0xc]
mov eax, 0x28a94
call fcn.0001495c
mov edi, eax
test esi, esi
jle 0x289c0
test edi, edi
jle 0x289c0
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + esi]
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.000147e4
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00013f70
cmp dword [ebp - 0x14], 0
je 0x289cf
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x18]
mov edx, 0x1000
call fcn.00027218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x289fe
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00014408
ret

Function at 0x28ac4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x28b43
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call fcn.000142dc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00014178
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x28b16
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.000142dc
jmp 0x28b23
lea eax, [ebp - 4]
mov edx, 0x28b58
call fcn.00013db0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00013d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x28b4a
lea eax, [ebp - 4]
call fcn.00013d18
ret

Function at 0x28b88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0001416c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x28ba1
test al, 0x10
jne 0x28ba5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x29a4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x29b99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x29b6f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x29ba4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x29b6f
cmp dword [ebp - 8], 4
jne 0x29b6f
mov eax, dword [ebp - 0xc]
mov dword [0x16a950], eax
mov eax, dword [ebp - 0xc]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00027444
mov edx, dword [ebp - 0x18]
mov eax, 0x16a960
call fcn.00013d6c
shr dword [ebp - 0xc], 8
push dword [0x16a960]
push 0x29bc0
mov eax, dword [ebp - 0xc]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00027444
push dword [ebp - 0x1c]
mov eax, 0x16a960
mov edx, 3
call fcn.00014068
shr dword [ebp - 0xc], 8
push dword [0x16a960]
push 0x29bc0
mov eax, dword [ebp - 0xc]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00027444
push dword [ebp - 0x20]
mov eax, 0x16a960
mov edx, 3
call fcn.00014068
cmp dword [ebp - 0x10], 0
je 0x29b7e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29ba0
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00013d3c
ret

Function at 0x2a83c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x2a910
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x2a928
call fcn.00013d6c
xor edx, edx
push ebp
push 0x2a8e3
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000142dc
push 0x3ff
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
push 0x2a934
call sub.kernel32.dll_GetEnvironmentVariableA
cmp eax, 3
jl 0x2a8a7
cmp eax, 0x3ff
jl 0x2a8ba
push 0x3ff
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jle 0x2a8d9
cmp eax, 0x3ff
jge 0x2a8d9
lea edx, [ebp - 8]
xchg edx, eax
call fcn.000142dc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00013d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2a8fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2a917
lea eax, [ebp - 8]
call fcn.00013d18
ret
Function at 0x2c6b4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x2c7e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2c7f8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x2c82c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2c840
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
xor eax, eax
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x2c884
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x2c898
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2c8a8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x2c8d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2c7f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2c8dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov dword [ebx], 0xffffffff
mov dword [esi], 0xffffffff
mov dword [edi], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
xor eax, eax
push ebp
push 0x2ca96
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2caac
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2cae0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2c975
cmp dword [ebp - 0x14], 4
jne 0x2c975
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2caf4
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2cb38
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2c9df
cmp dword [ebp - 0x14], 4
jne 0x2c9df
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2cb4c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2ca16
cmp dword [ebp - 0x14], 4
jne 0x2ca16
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2cb5c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2cb84
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2ca83
cmp dword [ebp - 0x14], 4
jne 0x2ca83
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2caa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2cb90
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffff4
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2cc10
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x2cbef
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x2cc4c
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
cmp dword [esp + 4], 0
je 0x2cc00
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [esp + 4], eax
mov eax, ebx
add esp, 0xc
pop ebx
ret

Function at 0x2cdac
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2cee5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.000143f0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
push 0x2cef4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2ce90
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x3ff
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2cf38
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x2ce90
cmp dword [ebp - 4], 1
jne 0x2ce90
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00014548
mov eax, dword [ebp - 0x10]
call fcn.0001b9e0
test al, al
jne 0x2ce90
lea eax, [ebp - 0x14]
mov edx, 0x800
call fcn.000271f0
push 0x3ff
mov eax, dword [ebp - 0x14]
push eax
push 0x2cf58
call sub.kernel32.dll_GetEnvironmentVariableW
cmp eax, 3
jbe 0x2ce83
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.00014548
lea eax, [ebp - 0x14]
mov edx, 0x800
call fcn.00027218
mov eax, dword [ebp - 0x10]
call fcn.0001b9e0
test al, al
jne 0x2cea4
lea eax, [ebp - 0x10]
call fcn.000278b0
cmp dword [ebp - 0x18], 0
je 0x2ceb3
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00027218
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.0001442c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ceec
lea eax, [ebp - 0x10]
call fcn.000143f0
ret
Function at 0x2d890
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x2d898
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x2da80
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00013d18
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
push 0x2da8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2da44
mov edx, 0x400
mov eax, dword [ebp - 8]
call fcn.00018100
mov dword [ebp - 0x10], 0x3ff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2dabc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2d966
cmp dword [ebp - 4], 1
jne 0x2d966
cmp dword [ebp - 0x10], 1
jbe 0x2d966
cmp dword [ebp - 0x10], 0x3ff
ja 0x2d966
push dword [ebx]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.000272e8
push dword [ebp - 0x14]
push 0x2dad0
mov eax, ebx
mov edx, 3
call fcn.00014068
mov edx, 0x400
mov eax, dword [ebp - 8]
call fcn.00018100
mov dword [ebp - 0x10], 0x3ff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2dad4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2d9db
cmp dword [ebp - 4], 1
jne 0x2d9db
cmp dword [ebp - 0x10], 1
jbe 0x2d9db
cmp dword [ebp - 0x10], 0x3ff
ja 0x2d9db
push dword [ebx]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000272e8
push dword [ebp - 0x1c]
push 0x2dad0
mov eax, ebx
mov edx, 3
call fcn.00014068
mov edx, 0x400
mov eax, dword [ebp - 8]
call fcn.00018100
mov dword [ebp - 0x10], 0x3ff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2dae8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2da44
cmp dword [ebp - 4], 1
jne 0x2da44
cmp dword [ebp - 0x10], 1
jbe 0x2da44
cmp dword [ebp - 0x10], 0x3ff
ja 0x2da44
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.000272e8
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.00013fb0
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0xc], 0
je 0x2da60
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2da87
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00013d3c
ret
Function at 0x2db98
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, ebx
call fcn.0001416c
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
cmp ebx, 0xffffffff
jne 0x2dbe0
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
jmp 0x2dc1c
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
cmp dword [esi], 0
jne 0x2dc0d
mov edx, edi
mov eax, dword [esp + 8]
call fcn.0002db5c
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x2dc1c
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x2dc30
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, ebx
call fcn.00014620
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
cmp ebx, 0xffffffff
jne 0x2dc78
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
jmp 0x2dcb4
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
cmp dword [esi], 0
jne 0x2dca5
mov edx, edi
mov eax, dword [esp + 8]
call fcn.0002db5c
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x2dcb4
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x2dfb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
xor eax, eax
push ebp
push 0x2e045
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
push 0
push 0
push 0x2e05c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e098
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2e032
cmp dword [ebp - 8], 4
jne 0x2e032
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2e04f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret