joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e8d0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008584b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x100a6b70
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x100a6b74
call fcn.1003e6a0
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x1003e921
push ebp
call fcn.10014449
add esp, 4
test eax, eax
jne 0x1003e964
push ebp
call fcn.100621a8
add esp, 4
push 0x100a19c4
call fcn.10014449
inc eax
lea esi, [eax + eax]
push esi
call fcn.1006217f
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x1003eaa8
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x100a19c4
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.100144cd
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.10014835
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push 0x100a1998
push eax
call fcn.10014835
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1003ea9f
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x1009b5a4
push eax
call edi
test eax, eax
je 0x1003ea88
lea ecx, [esp + 0x40]
push 0x100a1994
push ecx
call edi
test eax, eax
je 0x1003ea88
test byte [esp + 0x14], 0x10
jne 0x1003ea88
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.10066b6a
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.1005fd90
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.10066af6
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1003ea24
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.100621a8
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x10041570
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x100a6ff8]
sub esp, 0x114
test eax, eax
jne 0x100416bd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x100a6d90
mov dword [0x100a6ff8], 1
mov dword [0x100a6d90], 0x114
call esi
mov edx, dword [0x100a6da0]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x100a1ad0], eax
je 0x10041698
push ebx
push 0x100a6ea8
mov dword [0x100a6ea8], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100a1874
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x100a6fec], eax
call edi
mov dword [0x100a6ff0], eax
mov eax, dword [0x100a6fec]
test eax, eax
push 0x100a6fc8
je 0x10041614
call eax
jmp 0x1004161a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100a6eac]
cmp eax, 6
jae 0x10041632
cmp eax, 5
jne 0x10041646
cmp dword [0x100a6eb0], 2
jb 0x10041646
cmp word [0x100a6fc8], 9
jne 0x10041646
mov dword [0x100a6d84], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x10041664
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x100a6ff4], edx
jmp 0x1004166a
mov edx, dword [0x100a6ff4]
test edx, edx
je 0x10041698
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x10041698
mov ecx, dword [esp + 0x14]
mov dword [0x100a6d9c], ecx
push 0x100a6d98
push 0x100a6d94
call fcn.10041a60
add esp, 8
call fcn.100416d0
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x10042910
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008eec0
push 0x1001c804
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x100a6ffc]
xor ebx, ebx
cmp eax, ebx
jne 0x10042a70
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10042a6b
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x1009b5ac
lea edx, [ebp - 0x42c]
push edx
call fcn.10014835
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.1006217f
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x10042a6b
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10042a62
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x100a2b94
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10042a62
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x100a6ffc], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x10042a62
push esi
call fcn.100621a8
add esp, 4
mov eax, dword [0x100a6ffc]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x10045341
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10045343
mov esi, edi
test esi, esi
je 0x100453b8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100453ad
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x100453ad
cmp dword [esp + 0x1c], eax
jbe 0x1004537e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100453ad
cmp esi, edi
je 0x1004539f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x100453b8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100456d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10085e8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1009d100]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x1004573b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1004573d
mov esi, edi
test esi, esi
je 0x10045807
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100457fc
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x1004577f
cmp eax, 2
je 0x1004577f
cmp eax, 6
je 0x1004577f
cmp eax, 7
jne 0x100457fc
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.1006217f
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x100457e2
lea ecx, [esp + 0x14]
call fcn.10066c8d
cmp esi, dword [esp + 0x14]
je 0x100457d7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.100621a8
add esp, 4
jmp 0x10045819
call fcn.100621a8
add esp, 4
lea ecx, [esp + 0x10]
push 0x100a3a78
call fcn.10066c8d
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x10045807
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x10045819
push eax
lea ecx, [esp + 0x14]
call fcn.10066c8d
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.10066863
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.10066af6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x10045960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x10045997
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1004599a
mov esi, dword [ebp + 8]
test esi, esi
je 0x10045b4d
call fcn.10041c60
test eax, eax
je 0x10045a45
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10045b41
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x100459e9
cmp eax, 2
je 0x100459e9
cmp eax, 6
je 0x100459e9
cmp eax, 7
jne 0x10045b41
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
call fcn.1006217f
mov edx, dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov edi, ebx
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x10045b2c
mov ecx, dword [ebp + 0x18]
call fcn.1002d800
cmp esi, dword [ebp + 8]
je 0x10045b16
jmp 0x10045b0f
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10045a51
mov dword [ebp + 0x10], eax
jmp 0x10045a86
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10015230
mov edx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], edi
mov edx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0x14]
push 0
push ecx
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10045b41
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x10045ac0
cmp eax, 2
je 0x10045ac0
cmp eax, 6
je 0x10045ac0
cmp eax, 7
jne 0x10045b41
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
call fcn.1006217f
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x10045b2c
mov ecx, dword [ebp + 0x18]
call fcn.1002d8d0
cmp esi, dword [ebp + 8]
je 0x10045b16
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.100621a8
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.100621a8
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x100a3a78
call fcn.1002d800
cmp esi, dword [ebp + 8]
je 0x10045b4d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10046560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10085f58
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x100465b6
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100465bb
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x100466aa
call fcn.10041c60
test eax, eax
je 0x1004660a
mov edi, dword [ebp + 0x18]
push edi
call fcn.10014449
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1004669f
cmp esi, ebx
je 0x10046600
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100466ac
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10046615
xor edi, edi
jmp 0x1004664a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10015230
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.10027580
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10046690
cmp esi, ebx
je 0x1004667a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.10027d90
mov eax, 1
jmp 0x100466ac
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.10027d90
cmp esi, ebx
je 0x100466aa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10049760
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100497a1
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100497a3
mov esi, edi
test esi, esi
je 0x10049818
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1004980d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1004980d
cmp dword [esp + 0x1c], eax
jbe 0x100497de
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1004980d
cmp esi, edi
je 0x100497ff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x10049818
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x10049b30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1008600f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1009d100]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x10049b9b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10049b9d
mov esi, edi
test esi, esi
je 0x10049c67
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10049c5c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x10049bdf
cmp eax, 2
je 0x10049bdf
cmp eax, 6
je 0x10049bdf
cmp eax, 7
jne 0x10049c5c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.1006217f
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x10049c42
lea ecx, [esp + 0x14]
call fcn.10066c8d
cmp esi, dword [esp + 0x14]
je 0x10049c37
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.100621a8
add esp, 4
jmp 0x10049c79
call fcn.100621a8
add esp, 4
lea ecx, [esp + 0x10]
push 0x100a3a78
call fcn.10066c8d
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x10049c67
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x10049c79
push eax
lea ecx, [esp + 0x14]
call fcn.10066c8d
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.10066863
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.10066af6
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x10049dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x10049df7
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10049dfa
mov esi, dword [ebp + 8]
test esi, esi
je 0x10049fad
call fcn.1005b7b0
test eax, eax
je 0x10049ea5
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10049fa1
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x10049e49
cmp eax, 2
je 0x10049e49
cmp eax, 6
je 0x10049e49
cmp eax, 7
jne 0x10049fa1
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
call fcn.1006217f
mov edx, dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov edi, ebx
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x10049f8c
mov ecx, dword [ebp + 0x18]
call fcn.1002d800
cmp esi, dword [ebp + 8]
je 0x10049f76
jmp 0x10049f6f
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10049eb1
mov dword [ebp + 0x10], eax
jmp 0x10049ee6
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10015230
mov edx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], edi
mov edx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0x14]
push 0
push ecx
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10049fa1
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x10049f20
cmp eax, 2
je 0x10049f20
cmp eax, 6
je 0x10049f20
cmp eax, 7
jne 0x10049fa1
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
call fcn.1006217f
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x10049f8c
mov ecx, dword [ebp + 0x18]
call fcn.1002d8d0
cmp esi, dword [ebp + 8]
je 0x10049f76
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.100621a8
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.100621a8
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x100a3a78
call fcn.1002d800
cmp esi, dword [ebp + 8]
je 0x10049fad
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1004a9f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100860d8
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x1004aa46
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1004aa4b
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x1004ab3a
call fcn.1005b7b0
test eax, eax
je 0x1004aa9a
mov edi, dword [ebp + 0x18]
push edi
call fcn.10014449
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1004ab2f
cmp esi, ebx
je 0x1004aa90
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1004ab3c
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1004aaa5
xor edi, edi
jmp 0x1004aada
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10015230
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.10027580
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1004ab20
cmp esi, ebx
je 0x1004ab0a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.10027d90
mov eax, 1
jmp 0x1004ab3c
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.10027d90
cmp esi, ebx
je 0x1004ab3a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret