joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015930
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push 0x208
push edi
mov esi, 0x102b058
push esi
mov dword [0x102b260], edi
mov dword [0x102b264], edi
call fcn.01009000
mov eax, dword [ebp + 8]
add esp, 0xc
cmp eax, edi
je 0x10159d6
cmp word [eax], di
je 0x10159d6
push eax
push 0x104
push esi
call fcn.0100579c
test eax, eax
jne 0x10159d6
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x1004904
push 0x80000001
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10159d6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x10159d6
cmp dword [ebp - 4], edi
je 0x10159d6
xor eax, eax
inc eax
mov dword [0x102b260], eax
jmp 0x10159d8
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x1016c52
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ecx
push edi
lea edi, [eax + 8]
mov ecx, edi
call fcn.01020ceb
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1016cb4
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov ecx, edi
jne 0x1016ca8
push 0x1004938
call fcn.01015f1e
jmp 0x1016cb4
lea eax, [ebp - 0x414]
push eax
call fcn.01015ffa
and dword [ebp - 0x418], 0
mov esi, 0x1004940
push esi
push ebx
call fcn.01021101
test eax, eax
pop ecx
pop ecx
je 0x1016cd7
push eax
call fcn.01014ce3
pop ecx
push ebx
jmp 0x1016d1c
push ebx
push dword [edi]
lea eax, [ebp - 0x20c]
push 0x1002530
push 0x104
push eax
call fcn.01005817
add esp, 0x14
test eax, eax
je 0x1016cfb
xor eax, eax
jmp 0x1016d2e
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.01021101
test eax, eax
pop ecx
pop ecx
je 0x1016d28
push eax
call fcn.01014ce3
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008fe1
leave
ret 4
Function at 0x101711b
Capabilities:
Get common file path

Disassembly:
push 0x63c
mov eax, 0x1026553
call fcn.010097fd
xor esi, esi
mov edi, 0x208
push edi
lea eax, [ebp - 0x420]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x62c], esi
call fcn.01009000
push edi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.01009000
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push 0
mov ecx, ebx
call fcn.0101a66e
cmp eax, 0xffffffff
je 0x1017329
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
mov ecx, ebx
call fcn.01016d44
lea eax, [ebp - 0x420]
push eax
push 0x1004a30
call fcn.010092cf
test eax, eax
pop ecx
pop ecx
jne 0x10171ca
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x30]
call fcn.01015f1e
mov dword [ebp - 0x634], 1
inc dword [ebp - 0x62c]
push edi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.01009000
push edi
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.01009000
add esp, 0x18
push esi
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x62c]
mov ecx, ebx
call fcn.0101a66e
cmp eax, 0xffffffff
jne 0x1017185
cmp dword [ebp - 0x634], 1
jne 0x1017329
xor edi, edi
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x630], edi
call fcn.0101895a
push edi
lea eax, [ebp - 0x630]
lea ecx, [ebx + 0x30]
push eax
mov dword [ebp - 4], edi
call fcn.01020ceb
push eax
lea ecx, [ebp - 0x648]
call fcn.01018a56
test eax, eax
jne 0x10172f4
lea eax, [ebp - 0x628]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
lea edi, [ebx + 8]
mov ecx, edi
jne 0x101727c
push 0x1004938
jmp 0x1017283
lea eax, [ebp - 0x628]
push eax
call fcn.01015f1e
lea ecx, [ebx + 0x30]
call fcn.01020ceb
push eax
mov ecx, edi
call fcn.01020ceb
push eax
push 0x1002530
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.01005817
add esp, 0x14
test eax, eax
lea ecx, [ebp - 0x648]
je 0x10172c5
or dword [ebp - 4], 0xffffffff
call fcn.01018a3f
xor eax, eax
jmp 0x101733a
push 0
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.01018a56
test eax, eax
jne 0x10172f4
lea eax, [ebp - 0x628]
push eax
mov ecx, ebx
call fcn.01016c52
lea ecx, [ebp - 0x648]
jmp 0x10172b8
push dword [ebp - 0x630]
lea ecx, [ebx + 4]
call fcn.01015f1e
mov ecx, ebx
call fcn.0101711b
cmp dword [ebx + 0x44], 0
jne 0x101731a
lea ecx, [ebp - 0x648]
call fcn.01018997
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.01018a3f
mov ecx, ebx
call fcn.010168b4
mov ecx, ebx
call fcn.010169ae
xor eax, eax
inc eax
call fcn.0100988f
ret
Function at 0x1017468
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [0x102b270], edi
je 0x1017494
xor eax, eax
inc eax
jmp 0x1017519
push esi
mov esi, 0x114
push esi
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.01009000
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1017516
cmp dword [ebp - 0x108], 2
jne 0x1017516
cmp dword [ebp - 0x114], 5
jb 0x1017516
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
xor eax, eax
cmp esi, edi
jne 0x10174e6
push ebx
call fcn.0101b79f
cmp esi, 2
jne 0x10174f1
push ebx
call fcn.0101b7e2
cmp esi, 3
jne 0x10174fc
push ebx
call fcn.0101b825
cmp esi, 4
jne 0x1017507
push ebx
call fcn.0101b868
test eax, eax
je 0x1017513
mov dword [0x102b270], edi
jmp 0x1017516
or edi, 0xffffffff
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01008fe1
leave
ret

Function at 0x1018662
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x620], esi
call fcn.01009000
push esi
push edi
push ebx
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0101845b
add esp, 0x20
test eax, eax
je 0x101875b
cmp word [ebp - 0x20c], 0
je 0x101875b
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x10013b4
push 0x1004c84
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x101875b
cmp eax, 0x206
je 0x101875b
push dword [ebp - 0x620]
lea eax, [ebp - 0x414]
push edi
push ebx
push esi
push eax
call fcn.0101822f
add esp, 0x14
test eax, eax
jne 0x1018730
push 0x1004c80
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100579c
test eax, eax
jne 0x101875b
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x1002530
push dword [ebp + 0xc]
push dword [ebp - 0x624]
call fcn.01005817
add esp, 0x14
neg eax
sbb eax, eax
inc eax
jmp 0x101875d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008fe1
leave
ret
Function at 0x1018a56
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x44
mov eax, 0x10267fd
call fcn.010097c2
mov esi, ecx
mov dword [ebp - 0x28], esi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x1018a75
xor eax, eax
jmp 0x1018c30
call fcn.01018972
mov ecx, esi
call fcn.010189ff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1018a9a
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
sub eax, ecx
sar eax, 1
lea edi, [eax + eax + 2]
push edi
push 0x40
mov dword [ebp - 0x4c], eax
call ebx
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x1018ad2
and dword [ebp - 0x30], eax
push 0x1026b30
lea eax, [ebp - 0x30]
push eax
call fcn.010098b7
push dword [ebp + 8]
shr edi, 1
push edi
push eax
call fcn.0100579c
test eax, eax
je 0x1018af0
and dword [ebp - 0x34], 0
push 0x1026b30
lea eax, [ebp - 0x34]
jmp 0x1018acc
xor edi, edi
push edi
push 0x100
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x1018b20
mov dword [ebp - 0x38], edi
push 0x1026b30
lea eax, [ebp - 0x38]
jmp 0x1018acc
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x1018b3d
mov dword [ebp - 0x3c], edi
push 0x1026b30
lea eax, [ebp - 0x3c]
jmp 0x1018acc
lea edi, [eax + 2]
push edi
push 0x40
mov dword [ebp - 0x2c], edi
call ebx
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x18], ebx
jne 0x1018b63
mov dword [ebp - 0x40], eax
push 0x1026b30
lea eax, [ebp - 0x40]
jmp 0x1018acc
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1018b8c
and dword [ebp - 0x44], eax
push 0x1026b30
lea eax, [ebp - 0x44]
jmp 0x1018acc
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x24], eax
je 0x1018bf4
and dword [ebp - 0x48], 0
push 0x1026b30
lea eax, [ebp - 0x48]
jmp 0x1018acc
cmp dword [ebp - 0x20], 1
jne 0x1018c2d
mov eax, dword [ebp - 0x14]
mov ecx, esi
mov dword [esi], eax
call fcn.01018972
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], edi
je 0x1018c21
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1018c2d
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
call fcn.01009876
ret 0xc
Function at 0x1018c3d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.01018972
mov ecx, dword [ebp - 8]
call fcn.010189ff
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
test ebx, ebx
je 0x1018caf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebx + ebx]
push eax
push 8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x1018caf
push eax
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1018cb6
push dword [ebp - 0xc]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
and dword [ebp - 0x10], 0
lea eax, [ebx + ebx + 0x208]
push eax
push 8
call esi
push eax
call edi
mov edi, dword [ebp - 8]
xor ebx, ebx
cmp eax, ebx
mov dword [edi + 8], eax
je 0x1018d0c
push eax
push ebx
push 0x1004930
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x1018d0c
mov eax, dword [edi + 8]
cmp word [eax], bx
je 0x1018d0c
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1018cf4
sub eax, edx
sar eax, 1
mov dword [edi + 4], eax
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x10], ebx
jne 0x1018d25
mov ecx, edi
call fcn.010189ff
mov eax, dword [ebp - 0x10]
jmp 0x1018cb1

Function at 0x1018d2f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
je 0x1018d74
cmp dword [ebp + 0xc], ebx
jbe 0x1018d74
cmp dword [ebp + 0x10], ebx
je 0x1018d74
call fcn.01018c3d
test eax, eax
je 0x1018d74
push ebx
push 0x100
push 2
push ebx
push 1
push 0x40000000
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x1018d7c
mov dword [esi], ebx
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
jne 0x1018d9b
mov ecx, esi
call fcn.01018997
mov ecx, esi
call fcn.01018972
mov eax, edi
pop edi
jmp 0x1018d76
Function at 0x1019048
Capabilities:
Check os version
Get common file path

Disassembly:
push 0x340
mov eax, 0x102690f
call fcn.010097fd
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, eax
push eax
push 0
push ebx
mov edi, ecx
call fcn.01009000
push 0x114
lea eax, [ebp - 0x32c]
push 0
push eax
call fcn.01009000
add esp, 0x18
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x32c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x31c], 2
jne 0x10190af
cmp dword [ebp - 0x328], 5
jb 0x10190af
cmp dword [edi + 4], 4
je 0x10190be
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x101923c
push dword [edi + 8]
lea eax, [ebp - 0x218]
push 0x100253c
push 0x1002530
push 0x104
push eax
call fcn.01005817
add esp, 0x14
test eax, eax
jne 0x101923c
lea ecx, [ebp - 0x33c]
call fcn.01015d2c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x334]
call fcn.01015d2c
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.01015d2c
add edi, 0xc
push edi
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 2
call fcn.01015ec4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x334]
call fcn.01015f1e
push 0x1004c14
lea ecx, [ebp - 0x338]
call fcn.01015f1e
lea ecx, [ebp - 0x340]
call fcn.0101a489
push ecx
lea eax, [ebp - 0x338]
mov ecx, esp
mov dword [ebp - 0x344], esp
push eax
mov byte [ebp - 4], 3
call fcn.010164f9
push ecx
lea eax, [ebp - 0x334]
mov ecx, esp
mov dword [ebp - 0x34c], esp
push eax
mov byte [ebp - 4], 4
call fcn.010164f9
push ecx
lea eax, [ebp - 0x33c]
mov ecx, esp
mov dword [ebp - 0x348], esp
push eax
mov byte [ebp - 4], 5
call fcn.010164f9
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 3
call fcn.0101da94
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 6
call fcn.01020ceb
push eax
push 0x1004e00
call fcn.010157ba
pop ecx
pop ecx
lea ecx, [ebp - 0x330]
call fcn.01015a9f
test eax, eax
jne 0x10191f1
lea ecx, [ebp - 0x330]
call fcn.01020ceb
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0100579c
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 3
call fcn.01015bce
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 2
call fcn.0101a497
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.01015bce
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 0
call fcn.01015bce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.01015bce
call fcn.0100988f
ret 8
Function at 0x101942d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x438], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x428], 0x1004f68
jne 0x1019470
mov dword [ebp - 0x428], 0x1004f18
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
mov dword [ebp - 0x418], esi
push 0x80000001
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10194b2
push 4
pop eax
jmp 0x10195ec
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x440]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x418]
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x41c], 0x104
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10195c2
cmp dword [ebp - 0x424], 0x103
je 0x10195d9
lea eax, [ebp - 0x420]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101958c
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push 0x1004f08
push dword [ebp - 0x420]
mov dword [ebp - 0x430], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x420]
mov dword [ebp - 0x424], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x424], esi
mov dword [ebp - 0x420], esi
jne 0x101958c
push dword [ebp - 0x438]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10195f9
inc dword [ebp - 0x42c]
lea eax, [ebp - 0x440]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x42c]
mov dword [ebp - 0x41c], 0x104
push dword [ebp - 0x418]
call edi
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x10194f6
xor esi, esi
inc esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01008fe1
leave
ret
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x428]
push 0x1004c2c
push dword [ebp + 0x14]
push dword [ebp - 0x434]
call fcn.01005817
add esp, 0x14
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x10195dc
Function at 0x101962b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x21c], 0x1004f68
jne 0x1019670
mov dword [ebp - 0x21c], 0x1004f18
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push 0xf003f
push esi
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x21c]
mov edi, 0x80000001
push edi
mov word [ebp - 0x220], si
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x214], esi
call ebx
test eax, eax
je 0x10196d0
push 4
pop eax
jmp 0x101989a
mov dword [ebp - 0x210], esi
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x21c]
push 0x1004fc4
push 0x104
push eax
call fcn.01005817
add esp, 0x14
test eax, eax
jne 0x101975a
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push 0xf003f
push esi
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call ebx
test eax, eax
jne 0x101987e
cmp dword [ebp - 0x224], 1
je 0x1019769
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x210]
cmp dword [ebp - 0x210], 0x7fffffff
jl 0x10196d6
jmp 0x1019888
mov dword [ebp - 0x218], 6
jmp 0x1019888
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x22c]
push 1
push esi
push 0x1004f08
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x10197b5
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x218], 2
jmp 0x1019888
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x230]
call fcn.0100579c
test eax, eax
je 0x10197e9
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x218], 5
jmp 0x1019888
push 4
pop eax
push eax
lea ecx, [ebp - 0x210]
push ecx
push eax
push esi
mov ebx, 0x1004fb4
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x21c], eax
call edi
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
push 4
push esi
push 0x1001bac
push dword [ebp - 0x214]
mov dword [ebp - 0x210], 0xa
call edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1019866
cmp dword [ebp - 0x210], esi
je 0x1019870
mov dword [ebp - 0x218], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1019888
mov dword [ebp - 0x218], 3
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008fe1
leave
ret
Function at 0x10198ae
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x10290b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x620]
push ecx
push 0xf003f
xor esi, esi
push esi
push eax
push 0x80000001
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x620], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10198fa
or eax, 0xffffffff
jmp 0x10199ae
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, 0x104
jmp 0x1019951
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101997c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x61c]
push 0x1004c2c
push ebx
push eax
call fcn.01005817
add esp, 0x14
test eax, eax
jne 0x101999d
lea eax, [ebp - 0x61c]
push eax
call fcn.010198ae
test eax, eax
pop ecx
jne 0x10199bb
lea eax, [ebp - 0x638]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x620]
mov dword [ebp - 0x628], ebx
call edi
test eax, eax
je 0x1019909
lea eax, [ebp - 0x638]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x624], esi
push esi
jmp 0x1019a1a
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01008fe1
leave
ret
or esi, 0xffffffff
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10199ac
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1019a2c
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10199fc
inc dword [ebp - 0x624]
lea eax, [ebp - 0x638]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x624]
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], ebx
call edi
test eax, eax
je 0x10199ce
push dword [ebp - 0x630]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x10199be
Function at 0x1019e98
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1019ec5
or eax, 0xffffffff
leave
ret
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x1004fb4
push dword [ebp - 4]
mov dword [ebp - 8], 0xff
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call fcn.010198ae
pop ecx
xor eax, eax
leave
ret
Function at 0x101aad8
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor eax, eax
cmp dword [ebp + 8], eax
push esi
push edi
je 0x101ab2f
mov ebx, dword [ebp + 0x10]
cmp dword [ebx], eax
je 0x101ab2f
cmp dword [ebp + 0x14], eax
je 0x101ab2f
push dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 1
push eax
push dword [ebp + 8]
push 0x1005028
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov esi, eax
test esi, esi
je 0x101ab2f
add edi, 0xfffffffe
cmp edi, esi
jne 0x101ab1e
push 0xfffffffffffffffc
pop eax
jmp 0x101ab32
push esi
push dword [ebp + 8]
call fcn.0101aab0
pop ecx
mov dword [ebx], eax
pop ecx
mov eax, esi
jmp 0x101ab32
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret