joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003bdc
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
je 0x10003c54
cmp dword [ebp - 8], 4
je 0x10003c54
jmp 0x10008b05
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x10008b50
cmp word [ecx], bx
je 0x10008b50
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x10008b35
cmp word [edi], bx
je 0x10008b35
cmp dword [ebp + 0x14], ebx
je 0x10008aea
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003247c]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
push eax
push ebx
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x10003ba7
cmp dword [ebp - 4], ebx
jne 0x10003c62
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10003c59
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10008b74
test byte [eax + 0x1c], 1
je 0x10008b74
push 0x1000bcb8
push 0x16
jmp 0x10008b69
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10008b2d
test byte [eax + 0x1c], 1
je 0x10008b2d
push dword [ebp - 8]
push edi
push 0x1000bcb8
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001fe35
push 0xd
pop esi
jmp 0x10003c54
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10008b74
test byte [eax + 0x1c], 1
je 0x10008b74
push 0x1000bcb8
push 0x15
jmp 0x10008b69
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10008b74
test byte [eax + 0x1c], 1
je 0x10008b74
push 0x1000bcb8
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
push reloc.KERNEL32.dll_VerSetConditionMask
pop eax
jmp 0x10003c5c
Function at 0x1000478a
Capabilities:
Query or enumerate registry value

Disassembly:
xor edx, edx
mov dword [ebp - 4], edx
cmp eax, 2
je 0x10004811
jmp 0x10007974
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, edx
mov esi, 0x80000002
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x24], 0x10003110
test eax, eax
je 0x1000796a
push ebx
mov dword [eax], edx
mov ebx, edx
mov eax, dword [ebp + ebx*4 - 0x24]
test eax, eax
je 0x10004811
lea ecx, [ebp - 4]
push ecx
push 0x101
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004772
cmp esi, 0x80000002
jne 0x10004860
mov esi, dword [ebp - 4]
xor edx, edx
inc ebx
mov dword [ebp - 4], edx
cmp ebx, 5
jb 0x100047d9
pop ebx
cmp esi, 0x80000002
je 0x1000483b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edx
push 0x10004bf0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000798f
test esi, esi
je 0x1000484e
cmp esi, 0x80000002
je 0x1000484e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x100079ba
mov eax, edi
pop edi
pop esi
leave
ret 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004803
mov edi, 0x80070057
jmp 0x10004858
mov edi, eax
test eax, eax
jle 0x10004811
and edi, 0xffff
or edi, 0x80070000
jmp 0x10004811
cmp dword [ebp - 8], 4
jne 0x1000483b
cmp dword [ebp - 0xc], 4
jne 0x1000483b
cmp dword [ebp - 0x10], eax
jbe 0x1000483b
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0x1000483b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004858
Function at 0x100049d9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push 4
pop eax
xor ebx, ebx
push reloc.KERNEL32.dll_VerSetConditionMask
mov edi, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 0x10004a58
mov dword [ebp - 0x20], 0x10004ae0
mov dword [ebp - 0x1c], 0x10004b58
mov dword [ebp - 0x18], 0x10003110
call fcn.1000685a
test eax, eax
jne 0x10008fd0
push esi
mov esi, ebx
lea eax, [ebp - 4]
push eax
push 0x20119
push ebx
push dword [ebp + esi*4 - 0x24]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10004bbe
inc esi
cmp esi, 4
jb 0x10004a2a
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10004bf0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10008fd7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004a51
xor eax, eax
jmp 0x10004a54
cmp dword [ebp - 8], 4
jne 0x10004be1
cmp dword [ebp - 0xc], ebx
jbe 0x10004be1
xor edi, edi
inc edi
test esi, esi
jne 0x10004be1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10009019
cmp dword [ebp - 0x10], ebx
je 0x10004be1
mov edi, ebx
jmp 0x10004be1
Function at 0x10005136
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10032138]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x10005238
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x1000522e
mov ecx, 0x104
cmp eax, ecx
ja 0x1000522e
push esi
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.1000525b
mov esi, eax
test esi, esi
js 0x1000aaaf
push edi
mov edi, 0x104
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.1000525b
mov esi, eax
test esi, esi
js 0x1000aad6
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.10006961
mov esi, eax
test esi, esi
js 0x1000aafd
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.10006d15
mov esi, eax
test esi, esi
js 0x1000ab24
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
call fcn.10001075
mov esi, eax
test esi, esi
js 0x1000ab48
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100024c8
leave
ret 0xc
call sub.KERNEL32.dll_GetLastError
jmp 0x1000ab6c
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1000521b
test byte [eax + 0x1c], 1
je 0x1000521b
push esi
push 0x1000c1d4
push 0x24
jmp 0x1000aba9
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1000521b
test byte [eax + 0x1c], 1
je 0x1000521b
push esi
push 0x1000c1d4
push 0x25
jmp 0x1000aba9
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1000521b
test byte [eax + 0x1c], 1
je 0x1000521b
push esi
push 0x1000c1d4
push 0x26
jmp 0x1000aba9
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1000521b
test byte [eax + 0x1c], 1
je 0x1000521b
push esi
push 0x1000c1d4
push 0x27
jmp 0x1000aba9
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1000521b
test byte [eax + 0x1c], 1
je 0x1000521b
push esi
push 0x1000c1d4
push 0x28
jmp 0x1000aba9
mov esi, eax
test esi, esi
jle 0x1000ab80
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x1000ab87
mov esi, 0x80004005
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1000521b
test byte [eax + 0x1c], 1
je 0x1000521b
push esi
push 0x1000c1d4
push reloc.ADVAPI32.dll_GetTraceLoggerHandle
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001fead
jmp 0x1000521b
Function at 0x100069c0
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 0x1e
ja 0x10009667
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
jne 0x100069f1
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000969d
xor eax, eax
pop esi
pop ebp
ret 0xc
mov esi, 0xa1
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10009707
test byte [eax + 0x1c], 1
je 0x10009707
push dword [ebp + 8]
push reloc.ADVAPI32.dll_UnregisterTraceGuids
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10013378
jmp 0x10009707
push ebx
push 0x5c
pop eax
push eax
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x100096ba
mov esi, 0x80070003
jmp 0x10009706
xor eax, eax
mov word [ebx], ax
lea eax, [esi + 1]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100069c0
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x10009706
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
jne 0x10009704
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x10009704
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.100033fb
mov esi, eax
jmp 0x10009706
xor esi, esi
pop ebx
mov eax, esi
jmp 0x100069f3
Function at 0x1000cd19
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, edi
and eax, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x1000cd47
xor eax, eax
xor edx, edx
jmp 0x1000ce42
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1000cdba
cmp dword [ebp - 4], ebx
je 0x1000cdba
mov ecx, edi
or edi, reloc.ADVAPI32.dll_TraceMessage
add ecx, edi
mov eax, esi
adc eax, edi
push eax
push ecx
push edi
push edi
call fcn.100076b4
mov ebx, edi
sub ebx, eax
mov eax, edi
sbb eax, edx
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp dword [ebp - 0xc], edi
ja 0x1000cd81
jb 0x1000cd9c
cmp dword [ebp - 0x10], ebx
ja 0x1000cd81
mov edi, dword [ebp + 8]
push esi
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.100076b4
push 0
add eax, 1
pop ebx
adc edx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x10], ebx
jne 0x1000ce2c
cmp dword [ebp - 0xc], ebx
jne 0x1000ce2c
push ebx
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
call dword [sym.imp.msvcrt.dll_rand]
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
add edi, reloc.ADVAPI32.dll_TraceMessage
adc esi, reloc.ADVAPI32.dll_TraceMessage
mov eax, esi
fstp qword [ebp + 8]
and esi, 0x7fffffff
fld qword [ebp + 8]
mov dword [ebp + 8], edi
fdiv qword [0x1000ce58]
mov dword [ebp + 0xc], esi
and eax, 0x80000000
fild qword [ebp + 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
fild qword [ebp + 8]
fchs
faddp st(1)
fstp qword [ebp + 8]
fmul qword [ebp + 8]
fadd qword [0x1000ce50]
call fcn.10001543
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], 0
je 0x1000ce3c
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1000dc2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
push edi
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jne 0x1000dd04
push ebx
push edi
push edi
push 0x1000dd0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi], eax
test eax, eax
je 0x1000dce2
lea eax, [esi + 4]
push eax
push 0x1000dd24
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1000dce2
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000dd40
push dword [esi]
call ebx
mov dword [esi + 8], eax
test eax, eax
je 0x1000dce2
push 0x1000dd54
push dword [esi]
call ebx
mov dword [esi + 0xc], eax
test eax, eax
je 0x1000dce2
push 0x1000dd68
push dword [esi]
call ebx
mov dword [esi + 0x10], eax
test eax, eax
je 0x1000dce2
push 0x1000dd7c
push dword [esi + 4]
call ebx
mov dword [esi + 0x14], eax
test eax, eax
je 0x1000dce2
push 0x1000dd8c
push dword [esi + 4]
call ebx
mov dword [esi + 0x18], eax
test eax, eax
je 0x1000dce2
push 0x1000dda4
push dword [esi + 4]
call ebx
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1000dce2
push 0x1000ddbc
push dword [esi + 4]
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1000dd03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1000dcfc
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jns 0x1000dd03
call fcn.1000ddd9
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x1000f09a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov ebx, 0x80000002
cmp dword [ebp + 0x14], esi
jne 0x1000f0fe
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push dword [ebp + 8]
push ebx
call dword [edi + 0x18]
test eax, eax
jne 0x1000f143
cmp dword [ebp - 8], 2
jne 0x1000f0e6
push esi
push dword [ebp - 4]
call dword [edi + 0x14]
test eax, eax
jne 0x1000f143
cmp dword [ebp + 0x14], esi
je 0x1000f123
push esi
push dword [ebp + 0x10]
push esi
push 0x100
push dword [ebp + 8]
push ebx
call dword [edi + reloc.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x1000f13f
lea eax, [ebp - 4]
push eax
push 0xf013f
push esi
push dword [ebp + 8]
mov dword [ebp - 8], 2
push ebx
call dword [edi + 0x1c]
test eax, eax
je 0x1000f0d5
cmp eax, 2
je 0x1000f153
test eax, eax
jmp 0x1000f143
cmp dword [ebp + 0xc], esi
je 0x1000f153
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push 0x10004bf0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000f153
mov esi, eax
jle 0x1000f153
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 4], 0
je 0x1000f162
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1000f16f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov ecx, edx
push edi
mov edi, edx
mov esi, 0x80000002
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], 0x10003110
mov dword [ebp - 0x18], edx
test eax, eax
jne 0x1000f1c1
mov edi, 0x80070057
jmp 0x1000f28b
push ebx
mov dword [eax], edx
mov ebx, edx
mov eax, dword [ebp + ebx*4 - 0x28]
test eax, eax
je 0x1000f226
push edx
push dword [ebp + 0x18]
lea ecx, [ebp - 4]
push ecx
push 0x101
push edx
push eax
mov eax, dword [ebp + 8]
push esi
call dword [eax + 0x1c]
test eax, eax
jne 0x1000f20a
cmp esi, 0x80000002
je 0x1000f1f7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], ebx
inc ebx
mov dword [ebp - 4], edx
cmp ebx, 5
jae 0x1000f226
jmp 0x1000f1c6
xor edx, edx
mov dword [ebp - 4], edx
cmp eax, 2
je 0x1000f226
mov edi, eax
test eax, eax
jle 0x1000f226
and edi, 0xffff
or edi, 0x80070000
pop ebx
cmp esi, 0x80000002
je 0x1000f266
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edx
push 0x10004bf0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000f266
cmp dword [ebp - 0xc], 4
jne 0x1000f266
cmp dword [ebp - 0x10], 4
jne 0x1000f266
cmp dword [ebp - 0x14], eax
jbe 0x1000f266
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
test esi, esi
je 0x1000f279
cmp esi, 0x80000002
je 0x1000f279
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x1000f288
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1000f294
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
leave
ret 0x18
Function at 0x10011071
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
jne 0x1001109a
mov esi, 0x80070057
jmp 0x100111d7
lea eax, [ebp - 4]
push eax
push 1
push ebx
push 0x100111e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100110ce
mov esi, eax
jle 0x100111c8
and esi, 0xffff
or esi, 0x80070000
jmp 0x100111c8
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100110b5
cmp dword [ebp - 0xc], ebx
je 0x100111c8
mov eax, dword [ebp - 0x10]
push edi
xor ecx, ecx
push 2
pop edi
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000150e
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10011121
mov esi, 0x8007000e
jmp 0x100111c7
mov eax, dword [ebp - 8]
add eax, edi
push eax
mov dword [ebp - 8], eax
call fcn.1000150e
mov edi, eax
pop ecx
test edi, edi
jne 0x1001113d
mov esi, 0x8007000e
jmp 0x100111b5
and dword [ebp - 0x14], esi
cmp dword [ebp - 0xc], esi
jbe 0x100111b5
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100111a9
cmp dword [ebp - 0x18], 1
jne 0x100111a9
push ebx
push 0x10011238
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100111a9
mov ecx, dword [ebp + 8]
push edi
push ebx
call fcn.1001a3dc
mov esi, eax
test esi, esi
js 0x100111b5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0xc]
jb 0x10011145
push ebx
call fcn.10001485
pop ecx
test edi, edi
je 0x100111c7
push edi
call fcn.10001485
pop ecx
pop edi
cmp dword [ebp - 4], 0
je 0x100111d7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x1001266a
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100126c7
cmp eax, esi
jb 0x1001268e
mov esi, 0x8007007a
jmp 0x100126df
push 0x100126e8
push esi
push dword [ebp + 8]
call fcn.1002b630
add esp, 0xc
test eax, eax
je 0x100126aa
mov esi, 0x80004005
jmp 0x100126df
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100126df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100126df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100126df
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10014050
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
push esi
push edi
mov esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x10014071
mov esi, 0x80070057
jmp 0x10014106
push 1
push eax
push eax
push 0x1001410c
push 0x1000c5d8
push 0x80000001
call fcn.1001afaf
mov dword [ebp - 4], eax
test eax, eax
jne 0x100140f2
lea edi, [ebp - 4]
call fcn.1000ce65
mov esi, eax
xor edi, edi
test esi, esi
jns 0x100140a5
mov dword [ebp - 4], edi
jmp 0x100140f2
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0x20106
push edi
push edi
push edi
push 0x1000c5d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100140e2
push 4
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0x1001410c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100140f2
mov esi, eax
jle 0x100140f2
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [ebx], eax
je 0x10014106
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x100178f8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
test ebx, ebx
je 0x10017a65
cmp word [ebx], si
je 0x10017a65
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10017a4a
cmp word [eax], si
je 0x10017a4a
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x10017a2f
cmp word [edi], si
je 0x10017a2f
lea eax, [ebp - 8]
push eax
push 0x7fffffff
push edi
call fcn.100032b7
test eax, eax
jns 0x10017988
mov ecx, dword [0x100320c8]
cmp ecx, 0x100320c8
je 0x10017980
test byte [ecx + 0x1c], 1
je 0x10017980
push eax
push 0x1000bcb8
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.1001fead
push reloc.KERNEL32.dll_VerSetConditionMask
pop esi
jmp 0x10017a1c
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003247c]
push dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x100179d4
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017a1c
test byte [eax + 0x1c], 1
je 0x10017a1c
push esi
push ebx
push 0x1000bcb8
push 0x12
jmp 0x10017a11
mov eax, dword [ebp - 8]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x10017a1c
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017a1c
test byte [eax + 0x1c], 1
je 0x10017a1c
push esi
push edi
push 0x1000bcb8
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001fe35
cmp dword [ebp - 4], 0
je 0x10017a2b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10017a8c
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017a89
test byte [eax + 0x1c], 1
je 0x10017a89
push 0x1000bcb8
push 0x10
jmp 0x10017a7e
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017a89
test byte [eax + 0x1c], 1
je 0x10017a89
push 0x1000bcb8
push 0xf
jmp 0x10017a7e
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10017a89
test byte [eax + 0x1c], 1
je 0x10017a89
push 0x1000bcb8
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1000c7e1
push reloc.KERNEL32.dll_VerSetConditionMask
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x14