joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025d7d
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x2dc
mov eax, 0x1008e0b2
call fcn.10061d7a
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2d0], esi
mov dword [ebp - 0x2cc], ebx
mov dword [esi], ebx
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x2cc], 1
call fcn.10063660
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1c
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x10025e7c
push 0xb0
lea eax, [ebp - 0x2c8]
push ebx
push eax
call fcn.10063660
add esp, 0xc
lea ecx, [ebp - 0x2c8]
push 1
call fcn.10017a4c
push edi
push 0x100af6a4
push 0x1009a434
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.10019ce0
push eax
call fcn.10019ce0
push eax
call fcn.10019ce0
push eax
call fcn.1001d3c9
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.10018965
lea eax, [ebp - 0x2e8]
mov ecx, esi
push eax
call fcn.100088b1
lea ecx, [ebp - 0x2e8]
call fcn.10009725
lea ecx, [ebp - 0x2c8]
call fcn.1001688c
mov eax, esi
call fcn.10061d29
ret 8

Function at 0x10025e88
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor esi, esi
push esi
push eax
call fcn.10063660
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x1009b438
push str.SoftwareMicrosoftOneDrive
call fcn.100259d5
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10025f0a
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.1000b08e
jmp 0x10025f0f
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1006100c
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x10025e86
Function at 0x100260f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
jne 0x10026122
mov eax, 0x80070057
jmp 0x100261a0
movzx eax, byte [ebp + 0x14]
shl eax, 8
add eax, 0x20019
cmp dword [ecx + 0x14], 8
jb 0x10026136
mov ecx, dword [ecx]
push esi
lea esi, [ebp - 0xc]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x1002619d
cmp dword [edi + 0x14], 8
jb 0x10026160
mov edi, dword [edi]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push ebx
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x10026194
xor eax, eax
mov esi, 0x8007065d
cmp dword [ebp - 8], 3
cmove esi, eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1006100c
leave
ret 0x18

Function at 0x100262ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
jne 0x100262d9
mov eax, 0x80070057
jmp 0x1002636c
movzx eax, byte [ebp + 0x14]
shl eax, 8
add eax, 0x20019
cmp dword [ecx + 0x14], 8
jb 0x100262ed
mov ecx, dword [ecx]
push esi
lea esi, [ebp - 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
push 8
cmovle esi, eax
pop eax
mov dword [ebp - 8], eax
test esi, esi
js 0x10026369
cmp dword [edi + 0x14], eax
jb 0x1002631c
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x10026360
cmp dword [ebp - 0xc], 0xb
jne 0x1002635b
mov eax, dword [ebp - 0x14]
xor esi, esi
mov ecx, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
jmp 0x10026360
mov esi, 0x8007065d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1006100c
leave
ret 0x14
Function at 0x10028352
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 4
xor ebx, ebx
cmp dword [eax + 0x14], 8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
jb 0x1002837c
mov eax, dword [eax]
push eax
push str.SoftwareMicrosoftOneDriveAccounts
lea eax, [ebp - 0x28]
push eax
call fcn.1002dec6
cmp dword [eax + 0x14], 8
jb 0x10028393
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x10
push str.IsGoSov
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.10009725
test esi, esi
pop esi
jne 0x100283c9
cmp dword [ebp - 8], 1
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1006100c
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x10028350

Function at 0x10029311
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
inc esi
xor ebx, ebx
push esi
push 8
push str.SoftwareClasses
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002939c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10029393
cmp dword [ebp - 8], ebx
jne 0x10029393
cmp dword [ebp - 0xc], esi
jne 0x10029393
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x1000ffff
push str.SymbolicLinkValue
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10029393
cmp dword [ebp - 0x10], 6
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1006100c
leave
ret
jmp 0x1002930f
Function at 0x1002b049
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x1c], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b080
mov eax, dword [eax]
push 0
lea edi, [ebp - 8]
push edi
xor edi, edi
push edi
push ecx
push edi
push edi
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b0c9
cmp dword [esi + 0x10], eax
jne 0x1002b0a4
xor esi, esi
jmp 0x1002b0ac
cmp dword [esi + 0x14], 8
jb 0x1002b0ac
mov esi, dword [esi]
push dword [ebp + 0x18]
push ebx
push 3
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006100c
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b047

Function at 0x1002b20d
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b244
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b286
cmp dword [esi + 0x10], eax
jne 0x1002b262
xor esi, esi
jmp 0x1002b26a
cmp dword [esi + 0x14], 8
jb 0x1002b26a
mov esi, dword [esi]
push 4
push ebx
push 4
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006100c
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b20b
Function at 0x1002b2a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b2dd
mov eax, dword [eax]
push 0
lea edi, [ebp - 8]
push edi
xor edi, edi
push edi
push ecx
push edi
push edi
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b325
cmp dword [esi + 0x10], eax
jne 0x1002b301
xor esi, esi
jmp 0x1002b309
cmp dword [esi + 0x14], 8
jb 0x1002b309
mov esi, dword [esi]
push 8
push ebx
push 0xb
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006100c
leave
ret 0x14

Function at 0x1002b474
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b4ab
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b503
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
lea ecx, [eax*2 + 2]
jb 0x1002b4d2
mov ebx, dword [ebx]
movzx eax, byte [ebp + 0x1c]
inc eax
cmp dword [esi + 0x10], 0
jne 0x1002b4e1
xor esi, esi
jmp 0x1002b4e9
cmp dword [esi + 0x14], 8
jb 0x1002b4e9
mov esi, dword [esi]
push ecx
push ebx
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006100c
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b472

Function at 0x1002b523
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea edx, [eax*2 + 2]
jb 0x1002b53b
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1002b546
mov eax, dword [eax]
push edx
push ecx
push 2
push eax
push str.Environment
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
mov edx, 0x80070000
or ecx, edx
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovle edx, ecx
shr edx, 0x1f
xor dl, 1
mov al, dl
pop ebp
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b521
Function at 0x1002c25e
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
push 0x100ae2c8
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x240], eax
call fcn.1000b08e
mov eax, dword [ebp - 0x240]
xor ecx, ecx
push 0x118
push ecx
mov dword [eax], ecx
lea eax, [ebp - 0x238]
mov dword [ebx], ecx
mov bl, cl
push eax
mov dword [edi], ecx
call fcn.10063660
add esp, 0xc
mov dword [ebp - 0x23c], 0x11c
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002c341
mov ecx, dword [ebp - 0x120]
mov bl, 1
mov eax, dword [ebp - 0x238]
mov dword [edi], eax
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x120], 0x118
mov dword [ecx], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 2
push str.BuildLab
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push dword [0x100c6028]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
js 0x1002c341
push esi
lea eax, [ebp - 0x11c]
push eax
call fcn.1002bee4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006100c
leave
ret 0x10
push ebp
mov ebp, esp
pop ebp
jmp 0x1002c25c

Function at 0x1002d93a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1002d975
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1002d95c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1002d96d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1002d977
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1002d952
xor eax, eax
pop edi
pop esi
ret
Function at 0x1002df57
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1002dfae
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1002dfa9
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1002df93
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1002df9b
cmp edx, ebx
jne 0x1002e0e9
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1002df6a
add eax, dword [eax + 4]
jmp fcn.1002df57
mov dword [ebp + 0xc], ebx
jmp 0x1002dfb9
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002dfd1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002dfef
push ds
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002e04d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1002e034
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002e03d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002e047
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002e029
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
invalid
invalid
dec edi

Function at 0x10031932
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 8
pop esi
cmp dword [0x100cca94], esi
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
mov eax, 0x100cca80
xorps xmm0, xmm0
cmovae eax, dword [0x100cca80]
push 0
push eax
push SysReAllocString
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], esi
mov esi, 0x80070000
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x100319ce
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.LastUpdate
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x100319bd
cmp dword [ebp - 0x14], 0xb
je 0x100319c5
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor ecx, ebp
mov edx, dword [ebp - 8]
pop esi
call fcn.1006100c
leave
ret
Function at 0x10034b12
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c6700]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100cca94], 8
lea ecx, [ebp - 0x10]
push esi
mov eax, 0x100cca80
cmovae eax, dword [0x100cca80]
xor esi, esi
push esi
push ecx
push esi
push 0x20006
push esi
push esi
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x10034b91
push esi
call fcn.1006ade3
pop ecx
push 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xb
push esi
push str.LastUpdate
push dword [ebp - 0x10]
mov dword [ebp - 8], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006100c
leave
ret

Function at 0x100375f6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x420
mov eax, 0x10090b80
call fcn.10061d7a
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, eax
push 0x100ae2c8
mov dword [ebp - 0x42c], eax
call fcn.1000b08e
lea eax, [ebp + 8]
mov ecx, esi
push eax
mov edi, 0x80004004
call fcn.10036dd3
mov dword [ebp - 0x428], eax
cmp eax, dword [esi]
je 0x1003772a
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x410]
mov esi, 0x400
mov ebx, 0x2001b
push esi
push 0
push eax
call fcn.10063660
xor eax, eax
mov dword [ebp - 0x414], esi
lea edi, [ebp - 0x424]
add esp, 0xc
stosd dword es:[edi], eax
lea ecx, [ebp - 0x424]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x428]
add eax, 0x14
push eax
call fcn.10036f95
mov eax, dword [ebp - 0x420]
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x424]
mov dword [ebp - 0x428], eax
cmp esi, eax
je 0x1003771a
add esi, 0x18
mov eax, ebx
lea ecx, [esi + 4]
or eax, 0x10000
cmp byte [esi + 0x1c], 0
cmovne ebx, eax
cmp dword [esi + 0x18], 8
jb 0x100376b9
mov ecx, dword [ecx]
cmp dword [esi], 8
lea eax, [esi - 0x14]
jb 0x100376c3
mov eax, dword [eax]
lea edx, [ebp - 0x414]
push edx
lea edx, [ebp - 0x410]
push edx
lea edx, [ebp - 0x418]
push edx
push ebx
push ecx
push eax
push dword [esi - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x10037706
add esi, 0x38
lea eax, [esi - 0x18]
cmp eax, dword [ebp - 0x428]
jne 0x100376a0
jmp 0x1003771f
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x410]
push eax
call fcn.1000b08e
jmp 0x1003771f
mov edi, 0x80004004
lea ecx, [ebp - 0x424]
call fcn.1002cc96
mov eax, edi
call fcn.10061d29
ret 8
Function at 0x10039833
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xdc
mov eax, 0x10091232
call fcn.10061d7a
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xa8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x98
push ebx
mov dword [ebp - 0xb8], ebx
push eax
mov dword [edi], ebx
call fcn.10063660
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
call fcn.10021298
mov dword [ebp - 4], ebx
cmp byte [ebp + 0x10], bl
je 0x1003988d
push str.Wow6432Node_
lea eax, [ebp - 0xa8]
push eax
call fcn.10019ce0
push str.LocalServer32
push esi
push str.CLSID_
lea eax, [ebp - 0xa8]
push eax
call fcn.10019ce0
push eax
call fcn.10019ce0
push eax
call fcn.10019ce0
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xa4]
call fcn.10018965
cmp dword [ebp - 0xd4], 8
lea ecx, [ebp - 0xb0]
push 5
pop eax
push ecx
mov dword [ebp - 0xac], eax
mov esi, SysReAllocString
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xe8]
cmovae eax, dword [ebp - 0xe8]
push 0x20019
push ebx
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10039955
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xa4]
call fcn.10018965
cmp dword [ebp - 0xbc], 8
lea ecx, [ebp - 0xb0]
push 0xf
pop eax
push ecx
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xd0]
push 0x20119
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0xb1], bl
test eax, eax
jne 0x1003995c
mov byte [ebp - 0xb1], 1
mov eax, dword [ebp - 0xac]
test al, 2
je 0x10039980
and eax, 0xfffffffd
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xac], eax
call fcn.10009725
mov eax, dword [ebp - 0xac]
test al, 1
je 0x1003998f
lea ecx, [ebp - 0xe8]
call fcn.10009725
cmp byte [ebp - 0xb1], 0
je 0x10039a03
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], ebx
push eax
push ebx
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100399f7
push dword [ebp - 0xac]
call fcn.1006af50
mov esi, eax
pop ecx
test esi, esi
je 0x100399f7
lea eax, [ebp - 0xac]
push eax
push esi
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100399f0
mov dword [edi], esi
mov bl, 1
jmp 0x100399f7
push esi
call fcn.10066b84
pop ecx
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa8]
call fcn.10021d11
mov al, bl
call fcn.10061d29
ret 0xc