joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005920
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ecx
push ebx
push ebp
lea eax, [esp + 8]
xor ebp, ebp
push eax
push 0x1002f9b4
push 1
push ebp
push 0x1002fa04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x10005ae7
push esi
push edi
mov edi, dword [esp + 0x18]
push ebp
push dword [esp + 0x28]
mov eax, dword [edi]
push edi
call dword [eax + 0x2e0]
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x50]
mov ecx, dword [edi]
push 2
push esi
push dword [esp + 0x2c]
push edi
call dword [ecx + 0x300]
mov eax, dword [edi]
push ebp
push dword [esp + 0x2c]
push edi
call dword [eax + 0x2e0]
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [edi]
push 2
push esi
push dword [esp + 0x30]
push edi
call dword [ecx + 0x300]
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x100059d1
mov eax, dword [edi]
push ebp
push ebx
push edi
call dword [eax + 0x2e0]
mov ecx, dword [esp + 0x10]
mov esi, eax
push ebp
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x44]
mov ecx, dword [edi]
push 2
push esi
push ebx
push edi
call dword [ecx + 0x300]
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x100059fe
mov eax, dword [edi]
push ebp
push ebx
push edi
call dword [eax + 0x2e0]
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, dword [edi]
push 2
push esi
push ebx
push edi
call dword [ecx + 0x300]
mov ebx, dword [esp + 0x38]
test ebx, ebx
je 0x10005a2b
mov eax, dword [edi]
push ebp
push ebx
push edi
call dword [eax + 0x2e0]
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [edi]
push 2
push esi
push ebx
push edi
call dword [ecx + 0x300]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x1002fa84
push eax
mov ecx, dword [eax]
call dword [ecx]
mov ebx, eax
test ebx, ebx
js 0x10005adb
push dword [esp + 0x20]
push edi
call fcn.1000a99e
cmp byte [esp + 0x3c], 0
mov esi, eax
pop ecx
pop ecx
je 0x10005ab8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], ebp
push 0x1002f9d4
mov edx, dword [ecx]
push ecx
call dword [edx]
mov ebx, eax
test ebx, ebx
js 0x10005ac7
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
test ebx, ebx
js 0x10005aaa
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
or edx, 0x2000
mov dword [esp + 0x24], edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
js 0x10005ac7
mov eax, dword [esp + 0x18]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
push 2
push esi
call fcn.1000cf4a
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
shr ebx, 0x1f
xor bl, 1
pop ebp
mov al, bl
pop ebx
pop ecx
ret 0x24
Function at 0x10005b00
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ecx
push ebx
lea eax, [esp + 4]
push eax
push 0x1002f9c4
push 1
push 0
push 0x1002fa04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x10005cba
push ebp
push esi
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
push edi
call fcn.1000a99e
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x50]
push 2
pop ebp
push ebp
push esi
call fcn.1000cf4a
push dword [esp + 0x30]
push edi
call fcn.1000a99e
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov esi, eax
mov edx, dword [ecx]
push esi
push ecx
call dword [edx + 0x24]
push ebp
push esi
call fcn.1000cf4a
cmp dword [esp + 0x34], 0
pop ecx
pop ecx
je 0x10005b9d
push dword [esp + 0x2c]
push edi
call fcn.1000a99e
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
mov esi, eax
push 0
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x44]
push ebp
push esi
call fcn.1000cf4a
pop ecx
pop ecx
cmp dword [esp + 0x30], 0
je 0x10005bc6
push dword [esp + 0x30]
push edi
call fcn.1000a99e
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
push ebp
push esi
call fcn.1000cf4a
pop ecx
pop ecx
cmp dword [esp + 0x38], 0
je 0x10005bef
push dword [esp + 0x38]
push edi
call fcn.1000a99e
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
push ebp
push esi
call fcn.1000cf4a
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
push dword [esp + 0x3c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
push 0x1002fa84
push eax
mov ecx, dword [eax]
call dword [ecx]
mov ebx, eax
test ebx, ebx
js 0x10005cad
push dword [esp + 0x20]
push edi
call fcn.1000a99e
cmp byte [esp + 0x3c], 0
mov esi, eax
pop ecx
pop ecx
je 0x10005c8b
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x34]
and dword [esp + 0x34], 0
push eax
push 0x1002f9d4
mov edx, dword [ecx]
push ecx
call dword [edx]
mov ebx, eax
test ebx, ebx
js 0x10005c9a
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x2c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
test ebx, ebx
js 0x10005c7d
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
or edx, 0x2000
mov dword [esp + 0x2c], edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
js 0x10005c9a
mov eax, dword [esp + 0x24]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
push ebp
push esi
call fcn.1000cf4a
mov eax, dword [esp + 0x2c]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
shr ebx, 0x1f
xor bl, 1
mov al, bl
pop ebx
pop ecx
ret 0x28
Function at 0x10005d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
cmp dword [0x1003da88], 0
jne 0x10005d77
push str.Comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005d70
push str.TaskDialogIndirect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003da88], eax
test eax, eax
jne 0x10005d77
xor eax, eax
jmp 0x10005f61
push ebx
push ebp
push esi
push edi
push 0x60
pop edi
push edi
xor esi, esi
lea eax, [esp + 0x24]
push esi
push eax
call fcn.1000e4c0
mov eax, dword [esp + 0xac]
add esp, 0xc
or eax, 0x802
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x24], eax
test eax, eax
je 0x10005dc5
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x10005dc5
or dword [esp + 0x2c], 0x1000
push dword [esp + 0x94]
mov ebx, dword [esp + 0x88]
push ebx
call fcn.1000a99e
pop ecx
pop ecx
mov dword [esp + 0x34], eax
movzx eax, word [esp + 0xa4]
push eax
push esi
call dword [sym.imp.USER32.dll_LoadIconW]
push dword [esp + 0x98]
mov dword [esp + 0x3c], eax
push ebx
call fcn.1000a99e
push dword [esp + 0xa4]
mov dword [esp + 0x48], eax
push ebx
call fcn.1000a99e
add esp, 0x10
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x7c], eax
mov eax, dword [ebx]
push dword [esp + 0xb0]
push ebx
call dword [eax + 0x2ac]
push 8
pop ecx
mov dword [esp + 0x44], eax
mul ecx
push 0xffffffffffffffff
pop ecx
cmovb eax, ecx
push eax
call fcn.1000cf9b
mov ebp, eax
mov edi, esi
pop ecx
mov dword [esp + 0x48], ebp
cmp dword [esp + 0x44], esi
jbe 0x10005e83
lea eax, [edi + 0x65]
push edi
push dword [esp + 0xb4]
mov dword [ebp + edi*8], eax
mov eax, dword [ebx]
push ebx
call dword [eax + 0x2b4]
push eax
push ebx
call fcn.1000a99e
mov dword [ebp + edi*8 + 4], eax
inc edi
pop ecx
pop ecx
cmp edi, dword [esp + 0x44]
jb 0x10005e57
mov eax, dword [esp + 0xb4]
push dword [esp + 0xac]
add eax, 0x65
push ebx
mov dword [esp + 0x54], eax
call fcn.1000a99e
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
pop ecx
pop ecx
test eax, eax
je 0x10005ec4
lea eax, [esp + 0x18]
mov dword [esp + 0x74], 0x10005cf0
mov dword [esp + 0x78], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], esi
push eax
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x2c]
push eax
call dword [0x1003da88]
push 2
pop ebx
cmp dword [esp + 0x44], esi
jbe 0x10005f02
lea edi, [ebp + 4]
push ebx
push dword [edi]
call fcn.1000cf4a
inc esi
lea edi, [edi + 8]
pop ecx
pop ecx
cmp esi, dword [esp + 0x44]
jb 0x10005eee
push 8
push dword [esp + 0x4c]
call fcn.1000cf4a
push ebx
push dword [esp + 0x40]
call fcn.1000cf4a
push ebx
push dword [esp + 0x50]
call fcn.1000cf4a
push ebx
push dword [esp + 0x5c]
call fcn.1000cf4a
add esp, 0x20
cmp dword [esp + 0x5c], 0
je 0x10005f41
push ebx
push dword [esp + 0x60]
call fcn.1000cf4a
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, 0x64
jle 0x10005f53
add eax, 0xffffff9c
jmp 0x10005f58
mov eax, 0x3e8
cmp dword [esp + 4], 0
je 0x10005f61
neg eax
add esp, 0x70
ret 0x34
Function at 0x10006df0
Capabilities:
Get user security identifier
Link many functions at runtime

Disassembly:
mov eax, 0x4044
call fcn.1000cf70
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x4040], eax
mov eax, dword [esp + 0x4048]
push ebx
push esi
push edi
mov edi, dword [esp + 0x4060]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x405c]
push str.advapi32.dll
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10006fe6
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LsaOpenPolicy
push esi
call ebp
push str.LsaAddAccountRights
push esi
mov dword [esp + 0x20], eax
call ebp
push str.LsaRemoveAccountRights
push esi
mov dword [esp + 0x28], eax
call ebp
push str.LsaClose
push esi
mov dword [esp + 0x2c], eax
call ebp
mov dword [esp + 0x34], eax
cmp dword [esp + 0x18], ebx
je 0x10006fe5
cmp dword [esp + 0x20], ebx
je 0x10006fe5
test eax, eax
je 0x10006fe5
cmp dword [esp + 0x24], ebx
je 0x10006fe5
push dword [esp + 0x10]
push dword [esp + 0x20]
call fcn.1000a99e
pop ecx
pop ecx
push str.ConvertStringSidToSidW
push esi
mov dword [esp + 0x18], eax
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x10006f1e
lea ecx, [esp + 0x14]
push ecx
push esi
call eax
test eax, eax
jne 0x10006f1e
mov eax, 0x2000
push eax
push 0x40
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x2000
push ecx
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x3c]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x10006f1e
push dword [esp + 0x14]
call ebp
mov dword [esp + 0x14], ebx
push 2
push esi
call fcn.1000cf4a
pop ecx
pop ecx
cmp dword [esp + 0x14], ebx
je 0x10006fe5
push 0x18
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.1000e4c0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x810
lea eax, [esp + 0x40]
push eax
push ebx
call dword [esp + 0x28]
test eax, eax
jne 0x10006fdf
mov esi, 0x10022d38
test edi, edi
je 0x10006f75
push edi
push dword [esp + 0x20]
call fcn.1000a99e
pop ecx
pop ecx
mov esi, eax
push esi
call fcn.10014ace
add eax, eax
mov dword [esp + 0x30], esi
mov word [esp + 0x2c], ax
add eax, 2
pop ecx
mov word [esp + 0x2a], ax
lea eax, [esp + 0x28]
push 1
push eax
cmp byte [esp + 0x4070], bl
je 0x10006fad
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [esp + 0x30]
jmp 0x10006fc2
test edi, edi
sete al
movzx eax, al
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [esp + 0x38]
push dword [esp + 0x10]
neg eax
sbb al, al
lea ebx, [eax + 1]
call dword [esp + 0x38]
test edi, edi
je 0x10006fdf
push 2
push esi
call fcn.1000cf4a
pop ecx
pop ecx
push dword [esp + 0x14]
call ebp
pop ebp
mov ecx, dword [esp + 0x404c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000cf58
add esp, 0x4044
ret 0x14
Function at 0x100075b2
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x24
mov eax, 0x10021c6d
call fcn.1000d02b
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
mov eax, edi
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100076ec
push 0x800
xor ebx, ebx
mov dword [ebp + 0x10], 0x400
call fcn.1000cf9b
pop ecx
mov esi, eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], esi
call fcn.100070af
xor ecx, ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 4], ecx
push eax
push esi
push ecx
jmp 0x1000764b
lea eax, [ebp - 0x14]
mov dword [ebp + 0x10], 0x400
push eax
lea ecx, [ebp - 0x30]
inc ebx
call fcn.10007002
push 0x800
call fcn.1000cf9b
pop ecx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
mov dword [ebp - 0x14], esi
push eax
push eax
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10007618
push 2
push esi
call fcn.1000cf4a
pop ecx
pop ecx
jmp 0x100076a2
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
dec edx
add edx, esi
mov ecx, edx
and edx, 3
shr ecx, 2
dec eax
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub esi, 1
mov eax, dword [eax + ecx*4]
mov ebx, dword [eax + edx*4]
mov dword [ebp - 0x20], esi
jne 0x1000768d
and dword [ebp - 0x24], 0
push edi
push ebx
push dword [ebp - 0x10]
call fcn.100075b2
push 2
push ebx
call fcn.1000cf4a
add esp, 0x14
mov esi, dword [ebp - 0x20]
test esi, esi
jne 0x10007664
test edi, edi
je 0x100076d8
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100076d8
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100076d8
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x100076e4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x30]
call fcn.100070d7
call fcn.1000d008
ret

Function at 0x10007b00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x1c]
push 1
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10007950
mov edi, eax
add esp, 0x18
test edi, edi
je 0x10007b4c
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.1000a99e
pop ecx
pop ecx
mov esi, eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 2
push esi
call fcn.1000cf4a
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebp
ret 0x18
Function at 0x10007b60
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4028
call fcn.1000cf70
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x4024], eax
mov eax, dword [esp + 0x403c]
mov ecx, dword [esp + 0x4038]
mov edx, dword [esp + 0x4034]
push ebp
push esi
push edi
mov edi, dword [esp + 0x4038]
xor esi, esi
push eax
push esi
push esi
push ecx
push edx
push edi
call fcn.10007950
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x10007cc7
push ebx
mov eax, 0x1000
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
mov ebx, esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], ebx
push eax
lea eax, [esp + 0x203c]
mov dword [esp + 0x2c], esi
push eax
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x28], esi
push eax
lea eax, [esp + 0x48]
push eax
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x10007c6b
mov ebx, 0x1000
push dword [esp + 0x10]
mov eax, dword [edi]
lea ecx, [esp + 0x38]
push ecx
push edi
call dword [eax + 0x28c]
mov dword [esp + 0x28], eax
test eax, eax
je 0x10007c2a
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
call fcn.10002af2
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push ecx
lea ecx, [esp + 0x203c]
mov dword [esp + 0x18], ebx
push ecx
push esi
lea ecx, [esp + 0x20]
inc eax
push ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x2c], eax
push ecx
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x10007c02
mov ebx, dword [esp + 0x20]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
push str.java_lang_String
push edi
call dword [eax + 0x18]
test eax, eax
je 0x10007cb7
sub ebx, dword [esp + 0x1c]
mov ecx, dword [edi]
push esi
push eax
sar ebx, 2
push ebx
push edi
call dword [ecx + 0x2b0]
mov ebp, eax
test ebp, ebp
je 0x10007cb7
test ebx, ebx
je 0x10007cb9
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi]
push dword [ecx + esi*4]
push esi
push ebp
push edi
call dword [eax + 0x2b8]
inc esi
cmp esi, ebx
jb 0x10007c9e
jmp 0x10007cb9
mov ebp, esi
lea ecx, [esp + 0x1c]
call fcn.10002d3b
mov eax, ebp
pop ebx
jmp 0x10007cc9
xor eax, eax
mov ecx, dword [esp + 0x4030]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1000cf58
add esp, 0x4028
ret 0x14
Function at 0x10007cf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x201c
call fcn.1000cf70
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x2018], eax
mov eax, dword [esp + 0x2030]
mov ecx, dword [esp + 0x202c]
mov edx, dword [esp + 0x2028]
push ebp
push esi
push edi
mov edi, dword [esp + 0x202c]
xor esi, esi
push eax
push esi
push esi
push ecx
push edx
push edi
call fcn.10007950
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x10007e2f
push ebx
push esi
push esi
push esi
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x28], esi
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x34], esi
push eax
push esi
mov ebx, esi
mov dword [esp + 0x2c], 0x1000
push ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x10007dd3
push dword [esp + 0x10]
mov eax, dword [edi]
lea ecx, [esp + 0x2c]
push ecx
push edi
call dword [eax + 0x28c]
mov dword [esp + 0x24], eax
test eax, eax
je 0x10007da1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.10002af2
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push esi
push esi
push esi
push esi
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], 0x1000
inc eax
push ecx
push eax
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x10007d79
mov ebx, dword [esp + 0x1c]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
push str.java_lang_String
push edi
call dword [eax + 0x18]
test eax, eax
je 0x10007e1f
sub ebx, dword [esp + 0x18]
mov ecx, dword [edi]
push esi
push eax
sar ebx, 2
push ebx
push edi
call dword [ecx + 0x2b0]
mov ebp, eax
test ebp, ebp
je 0x10007e1f
test ebx, ebx
je 0x10007e21
mov ecx, dword [esp + 0x18]
mov eax, dword [edi]
push dword [ecx + esi*4]
push esi
push ebp
push edi
call dword [eax + 0x2b8]
inc esi
cmp esi, ebx
jb 0x10007e06
jmp 0x10007e21
mov ebp, esi
lea ecx, [esp + 0x18]
call fcn.10002d3b
mov eax, ebp
pop ebx
jmp 0x10007e31
xor eax, eax
mov ecx, dword [esp + 0x2024]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1000cf58
add esp, 0x201c
ret 0x14
Function at 0x10007e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x186ac
call fcn.1000cf70
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x186a8], eax
mov eax, dword [esp + 0x186c4]
mov ecx, dword [esp + 0x186bc]
mov edx, dword [esp + 0x186b8]
push ebx
mov ebx, dword [esp + 0x186b4]
push ebp
mov ebp, dword [esp + 0x186c8]
push esi
push edi
push eax
xor esi, esi
push esi
push esi
push ecx
push edx
push ebx
call fcn.10007950
mov edi, eax
add esp, 0x18
test edi, edi
je 0x10007f01
push ebp
push ebx
call fcn.1000a99e
pop ecx
pop ecx
mov ebp, eax
mov dword [esp + 0x10], 0x186a0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007eec
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push ebx
call fcn.1000731d
add esp, 0x10
mov esi, eax
push 2
push ebp
call fcn.1000cf4a
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10007f03
xor eax, eax
mov ecx, dword [esp + 0x186b8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000cf58
add esp, 0x186ac
ret 0x18

Function at 0x10008040
Capabilities:
Set registry value

Disassembly:
mov eax, 0x186b0
call fcn.1000cf70
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x186ac], eax
mov eax, dword [esp + 0x186c8]
mov ecx, dword [esp + 0x186c0]
mov edx, dword [esp + 0x186bc]
push ebx
push ebp
mov ebp, dword [esp + 0x186bc]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x186d4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x186e0]
push eax
push ebx
push 1
push ecx
push edx
push ebp
call fcn.10007950
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1000812d
push edi
push ebp
call fcn.1000a99e
mov edi, eax
mov dword [esp + 0x18], 0x186a0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x186f0]
push dword [esp + 0x30]
push ebp
call fcn.100076f2
add esp, 0x20
test al, al
je 0x1000811c
push dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
push ebx
push edi
push esi
call ebp
test eax, eax
jne 0x100080fd
mov bl, 1
jmp 0x1000811c
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
push ebx
push edi
push esi
call ebp
push eax
push str.no_success__d_n
call fcn.10001324
pop ecx
pop ecx
push 2
push edi
call fcn.1000cf4a
pop ecx
pop ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x186bc]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000cf58
add esp, 0x186b0
ret 0x20