joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cd3f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
mov esi, 0x105de20
push esi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x100
call edi
test eax, eax
jne 0x100ce1f
inc dword [ebp - 4]
cmp dword [ebp - 8], 1
je 0x100cd9e
cmp dword [ebp - 8], 2
je 0x100cd9e
cmp dword [ebp - 8], 7
je 0x100cd9e
xor eax, eax
jmp 0x100cda1
push 2
pop eax
mov ecx, dword [ebp - 0x10]
add eax, ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x100cdf1
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.01003313
test eax, eax
jne 0x100cde3
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push dword [ebp - 8]
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100cde6
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100cdf4
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 0x100
push dword [ebp + 8]
call edi
test eax, eax
je 0x100cd85
cmp dword [ebp - 0xc], ebx
je 0x100ce9b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov esi, 0x105dc20
push 0x100
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc dword [ebp - 4]
test eax, eax
jne 0x100ce9b
lea eax, [ebp - 0x1c]
push eax
push 9
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ce96
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100ce91
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0100cc81
push dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0100cd3f
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x1c]
call edi
cmp dword [ebp - 0xc], ebx
jne 0x100ce2d
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100d5c4
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [0x101d090]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x101d068], 0x88
cmp dword [ebp + 0xc], ebx
je 0x100d617
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.010086ed
push eax
call fcn.01002732
test eax, eax
je 0x100d617
mov dword [0x101d068], 0x89
jmp 0x100d677
push esi
push edi
push 1
mov edi, 0x100d67c
push edi
call fcn.0100cc01
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
cmp eax, ebx
je 0x100d66e
cmp eax, 6
je 0x100d65f
xor ecx, ecx
cmp eax, 0x522
sete cl
add ecx, 0x8d
mov dword [0x101d068], ecx
jmp 0x100d669
mov dword [0x101d068], 0x8f
push dword [ebp + 8]
call esi
push ebx
push edi
call fcn.0100cc01
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100d6a5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x105d104]
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x100d730
cmp dword [0x101d0ec], 4
jne 0x100d6fd
push esi
push edi
push edi
push 0x20000
mov esi, 0x101d100
push esi
push eax
push 0x103d100
push edi
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [0x105d100]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
je 0x100d726
cmp ebx, dword [ebp - 4]
jmp 0x100d724
push edi
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push 0x103d100
push dword [0x105d100]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100d726
mov eax, dword [0x105d104]
add eax, eax
cmp eax, dword [ebp - 4]
je 0x100d730
mov dword [0x101d068], 0x8d
mov dword [0x105d104], edi
pop edi
pop ebx
leave
ret
Function at 0x100dd21
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x24
push 0x100df78
call fcn.01004000
push 0x5b
call fcn.0100d78a
push dword [ebp + 0xc]
call fcn.0100dabc
push 0x100df6c
call fcn.0100dabc
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, 0x105de20
mov dword [ebp - 0x2c], 0x100
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
push ecx
push esi
lea ecx, [ebp - 0x24]
push ecx
push esi
lea ecx, [ebp - 0x2c]
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, esi
je 0x100de8e
push 0xa
call fcn.0100d78a
cmp edi, 0x103
je 0x100dd99
mov dword [0x101d068], 0x8c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea edi, [ebx + 0x100]
mov dword [ebp - 4], esi
lea eax, [edi + edi]
call fcn.01004057
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 0xfffffffe
push dword [ebp + 0xc]
push edi
push esi
call fcn.01002d3f
lea esi, [esi + ebx*2]
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
xor eax, eax
mov word [esi], ax
mov dword [ebp - 0x20], 1
mov ebx, 0xff
push ebx
push esi
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x100de43
lea eax, [ebp - 0x30]
push eax
push 9
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100de30
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call fcn.0100dd21
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x101d068], 0x8d
jne 0x100de3a
jmp 0x100df61
mov dword [0x101d068], 0x8b
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push ebx
push esi
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x100ddf5
cmp eax, 0x103
je 0x100df61
mov dword [0x101d068], 0x8c
jmp 0x100df61
cmp dword [ebp - 0x24], 1
je 0x100dea4
cmp dword [ebp - 0x24], 2
je 0x100dea4
cmp dword [ebp - 0x24], 7
je 0x100dea4
xor eax, eax
jmp 0x100dea7
push 2
pop eax
mov ecx, dword [ebp - 0x28]
add eax, ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x100df47
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push dword [ebp + 8]
call fcn.01003313
test eax, eax
je 0x100dee2
mov dword [0x101d068], 0x8d
jmp 0x100df3e
cmp dword [ebp - 0x2c], esi
je 0x100deef
push ebx
call fcn.0100dae4
jmp 0x100def6
push 0x40
call fcn.0100d78a
push 0x3d
call fcn.0100d78a
mov eax, dword [ebp - 0x24]
dec eax
je 0x100df31
sub eax, 3
jne 0x100df23
cmp dword [ebp - 0x28], 4
jne 0x100df23
push 0x1001f10
call fcn.0100dabc
push 1
push dword [edi]
call fcn.0100db5f
jmp 0x100df37
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push edi
call fcn.0100dc43
jmp 0x100df37
push edi
call fcn.0100dae4
push 0xa
call fcn.0100d78a
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100df51
mov dword [0x101d068], 0x8d
cmp dword [0x101d068], 0x8d
jne 0x100dd50
lea esp, [ebp - 0x44]
call fcn.01004048
ret 8
Function at 0x100df99
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 9
push 0x110a
push dword [0x101d090]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x258], eax
mov dword [0x101d068], 0x88
cmp ebx, esi
je 0x100e009
push esi
push ebx
lea ecx, [ebp - 0x25c]
push ecx
push eax
call fcn.010086ed
push eax
call fcn.01002732
test eax, eax
je 0x100e009
mov dword [0x101d068], 0x89
jmp 0x100e135
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x105d100], eax
cmp eax, 0xffffffff
je 0x100e11b
push esi
lea ecx, [ebp - 0x260]
push ecx
push 2
push 0x100e148
push eax
mov dword [0x105d104], esi
mov dword [0x105d108], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1001ed0
call fcn.0100dabc
push 0x1005540
call fcn.0100dabc
push 0x100e150
call fcn.0100dabc
push 0x100e15c
call fcn.0100dabc
cmp ebx, esi
je 0x100e09c
push ebx
push 0x128
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
jmp 0x100e103
push dword [ebp - 0x258]
call fcn.010086ed
push 0x1001654
mov dword [ebp - 0x258], eax
mov edi, 0x128
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push eax
push dword [ebp - 0x258]
call fcn.010027cc
push eax
call fcn.0100dd21
push 0x100163c
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push eax
push dword [ebp - 0x258]
call fcn.010027cc
push eax
call fcn.0100dd21
call fcn.0100d6a5
push dword [0x105d100]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100e125
mov dword [0x101d068], 0x8a
cmp ebx, esi
je 0x100e135
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x100f081
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], ebx
cmp dword [0x105dbe0], ebx
je 0x100f201
push esi
mov esi, 0x105de20
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x208]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x20c]
mov edi, 0x100
push dword [ebp - 0x214]
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x20c]
test eax, eax
jne 0x100f1ff
push 0x1fa8
call fcn.0100e7b8
mov eax, dword [ebp - 0x20c]
dec eax
push eax
push 0x1005678
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.010062be
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.0100e774
call fcn.0100e7a7
push 0x1fa9
call fcn.0100e7b8
cmp dword [ebp - 0x218], ebx
je 0x100f150
push esi
call fcn.0100e774
jmp 0x100f15a
push 0x1fad
call fcn.0100e7b8
call fcn.0100e7a7
push dword [ebp - 0x208]
call fcn.0100e7e4
cmp dword [ebp - 0x208], 1
je 0x100f189
cmp dword [ebp - 0x208], 2
je 0x100f189
cmp dword [ebp - 0x208], 7
je 0x100f189
xor eax, eax
jmp 0x100f18c
push 2
pop eax
mov ecx, dword [ebp - 0x210]
add eax, ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x100f1f5
lea eax, [ebp - 0x210]
push eax
push edi
lea eax, [ebp - 0x208]
push eax
push ebx
push esi
push dword [ebp - 0x214]
call fcn.01003313
test eax, eax
jne 0x100f1d7
push dword [ebp - 0x208]
push dword [ebp - 0x210]
push edi
call fcn.0100ee2d
jmp 0x100f1e1
mov dword [0x105dbe4], 0x92
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x105dbe0], ebx
je 0x100f1ff
jmp 0x100f0bb
mov dword [0x105dbe4], 0x90
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4
Function at 0x100f24a
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x18
push 0x100f348
call fcn.01004000
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100f215
push dword [ebp + 8]
call fcn.0100f081
xor ebx, ebx
cmp dword [0x105dbe4], ebx
jne 0x100f336
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edi, [esi + 0x100]
mov dword [ebp - 4], ebx
lea eax, [edi + edi]
call fcn.01004057
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
push dword [ebp + 0xc]
push edi
push ebx
call fcn.01002d3f
lea esi, [ebx + esi*2]
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
xor eax, eax
mov word [esi], ax
call fcn.0100e7a7
xor edi, edi
jmp 0x100f309
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push 0xff
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x100f336
lea eax, [ebp - 0x24]
push eax
push 9
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f309
push ebx
push dword [ebp - 0x24]
call fcn.0100f24a
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x105dbe0], edi
je 0x100f336
jmp 0x100f2c8
lea esp, [ebp - 0x38]
call fcn.01004048
ret 8

Function at 0x100f91d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor esi, esi
mov dword [0x105dc0c], eax
cmp eax, esi
je 0x100f9de
mov ecx, 0xfeff
mov word [eax], cx
xor eax, eax
inc eax
push edi
mov dword [0x105dc10], 0x2000
mov dword [0x105dc14], eax
mov dword [0x105dbe0], eax
mov dword [0x105dbe4], esi
mov dword [0x105dc18], 0x100f9f0
call fcn.0100f369
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100f9c7
push esi
lea eax, [ebp + 8]
push eax
mov eax, dword [0x105dc14]
add eax, eax
push eax
push dword [0x105dc0c]
mov dword [ebp + 8], esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100f9be
mov dword [0x105dbe4], 0x8d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100f9d1
mov dword [0x105dbe4], 0x8a
push dword [0x105dc0c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
push dword [0x105dbe4]
call fcn.0100e47c
pop esi
pop ebp
ret 8
Function at 0x100fb8e
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [0x105d4d4], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x208], ebx
cmp dword [esi + 0x20], edi
je 0x100fd5e
lea eax, [ebp - 0x204]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x258]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x250], edi
push 0x1073
push dword [0x101d094]
mov dword [ebp - 0x240], 0x100
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x20]
cmp word [eax], di
jne 0x100fc20
mov dword [ebp - 0x210], 0x4b
mov dword [ebp - 0x208], edi
jmp 0x100fd37
lea ecx, [ebp - 0x218]
push ecx
push edi
push ecx
push edi
push eax
push dword [0x101d0a8]
call fcn.01003313
mov dword [ebp - 0x208], edi
cmp eax, 2
je 0x100fc50
mov dword [ebp - 0x210], 0x4a
jmp 0x100fd37
lea eax, [ebp - 0x214]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call fcn.01003313
cmp dword [ebp - 0x20c], ebx
je 0x100fc90
cmp dword [ebp - 0x20c], 2
je 0x100fc90
cmp dword [ebp - 0x20c], 7
je 0x100fc90
xor eax, eax
jmp 0x100fc93
push 2
pop eax
mov ecx, dword [ebp - 0x214]
add eax, ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x100fd25
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
mov dword [ebp - 0x210], 0x49
call fcn.01003313
test eax, eax
jne 0x100fd1c
push dword [ebp - 0x214]
push ebx
push dword [ebp - 0x20c]
push edi
push dword [esi + 0x20]
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100fd1c
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x100fd1c
mov dword [ebp - 0x208], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100fd2f
mov dword [ebp - 0x210], 0x76
cmp dword [ebp - 0x208], edi
jne 0x100fd5e
lea eax, [ebp - 0x204]
push eax
movzx eax, word [ebp - 0x210]
push 0x10
push 0x48
push eax
push dword [ebp - 0x21c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x101059b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x218], eax
cmp dword [0x101d0a8], edi
je 0x1010778
push ebx
mov dword [ebp - 0x214], 1
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push dword [0x101d0d0]
push 0x100
push eax
call fcn.010062be
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
push edi
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [0x101d0a8]
call fcn.01003313
mov ebx, dword [ebp + 0xc]
push 3
pop esi
test eax, eax
jne 0x101065f
inc dword [ebp - 0x214]
cmp dword [ebp - 0x214], 0x64
jb 0x10105d4
cmp dword [ebp - 0x214], 0x64
jne 0x10106e1
mov eax, 0xaa
push 0x10
movzx eax, ax
push 0xa8
push eax
push dword [ebp - 0x218]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
jmp 0x1010776
cmp ebx, edi
jbe 0x10106b0
push 2
pop ecx
cmp ebx, ecx
jbe 0x10106a4
cmp ebx, esi
je 0x101069c
push 4
pop eax
cmp ebx, eax
je 0x1010691
cmp ebx, 7
je 0x10106a4
cmp ebx, 0xb
jne 0x10106b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x210], 8
jmp 0x10106b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x210], eax
jmp 0x10106b0
mov dword [ebp - 0x210], edi
jmp 0x10106b0
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x210]
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1010629
mov eax, 0xa9
jmp 0x101063b
push edi
push edi
push 0x1004
push dword [0x101d094]
mov dword [ebp - 0x258], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x244], eax
call esi
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], edi
cmp ebx, 1
je 0x101072d
cmp ebx, 2
je 0x101072d
mov dword [ebp - 0x23c], 5
cmp ebx, 7
jne 0x1010737
mov dword [ebp - 0x23c], 4
lea eax, [ebp - 0x258]
push eax
push edi
push 0x104d
push dword [0x101d094]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x1010776
push ebx
push dword [ebp - 0x210]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [0x101d094]
call fcn.01010222
push esi
push dword [0x101d094]
call fcn.0100fde7
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 8
Function at 0x1010b49
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, dword [0x101d094]
xor ebx, ebx
push ebx
push ebx
push 0x1032
push edi
mov dword [ebp - 0x20c], eax
call esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 0x34
push 0x34
movzx eax, ax
push 0x33
push eax
push dword [ebp - 0x20c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
cmp eax, 6
jne 0x1010c9d
push ebx
push ebx
push 0xb
push edi
call esi
or dword [ebp - 0x208], 0xffffffff
push 2
mov dword [ebp - 0x210], ebx
push 0xffffffffffffffff
jmp 0x1010c5e
test ebx, ebx
je 0x1010c02
and dword [ebp - 0x244], 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x24c]
push eax
push ebx
push 0x1073
push edi
mov dword [ebp - 0x234], 0x100
call esi
jmp 0x1010c0b
xor eax, eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1010c46
cmp ebx, eax
je 0x1010c32
push eax
push ebx
push 0x1008
push edi
call esi
jmp 0x1010c56
push 1
push eax
push eax
push eax
push edi
call fcn.01010222
and dword [ebp - 0x208], 0
jmp 0x1010c56
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x208], ebx
push 2
push dword [ebp - 0x208]
push 0x100c
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1010bcf
push 0
push 1
push 0xb
push edi
call esi
cmp dword [ebp - 0x210], 0
je 0x1010c9d
push 0x10
push 0x58
push 0x59
push dword [ebp - 0x20c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4

Function at 0x1010cb3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push 0
push 0x1032
push dword [0x101d094]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jbe 0x1010cde
cmp eax, 1
je 0x1010ce2
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop ebp
ret 8
pop ebp
jmp fcn.0101078c
Function at 0x1012c94
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x220], eax
push edi
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x214], esi
call fcn.010129d8
mov ebx, eax
cmp ebx, esi
jl 0x1012d5c
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push eax
call fcn.01011956
mov ebx, eax
cmp ebx, esi
jl 0x1012d42
cmp dword [ebp - 0x218], esi
je 0x1012d3e
push 0x104
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
call fcn.01011956
mov ebx, eax
cmp ebx, esi
jge 0x1012d5c
cmp ebx, 0x80070005
je 0x1012d5c
cmp dword [edi], esi
je 0x1012d62
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1012d62
mov esi, dword [ebp - 0x214]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], esi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 0xc

Function at 0x101a29f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x101a388
push 0x80000000
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101a374
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.KERNEL32.dll_RegQueryValueExA]
test eax, eax
jne 0x101a363
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x101a34d
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x101a363
push eax
push edi
push dword [ebp - 0x110]
call fcn.0101a237
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x101a376
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 4