joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1032901
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1032971
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1001d50
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1032968
cmp dword [ebp - 8], 0xc00d2afc
sete al
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x103297b
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001b08
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10329f1
cmp dword [ebp + 8], esi
jne 0x10329bb
push 0x1001d6c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10329e8
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10329c1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push esi
push 0x1001d6c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x1032af2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 2
xor ebx, ebx
push ebx
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1032b83
cmp dword [ebp + 8], ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push 4
pop edi
je 0x1032b67
push edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push 0x1001e10
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call esi
push edi
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x1001de0
push dword [ebp - 4]
call esi
push edi
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x1001db8
push dword [ebp - 4]
mov dword [ebp - 8], 1
call esi
push edi
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push 0x1001d88
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1032c1c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10813fc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x80004005
jne 0x1032caf
push 0x58
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1032c59
mov ecx, eax
call fcn.01045c69
jmp 0x1032c5b
xor eax, eax
test eax, eax
mov dword [0x10813fc], eax
je 0x1032cb2
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1032cb2
mov eax, dword [0x10813fc]
mov ecx, dword [0x10813d0]
mov dword [eax + 0x4c], ecx
mov eax, dword [0x10813fc]
mov ecx, dword [0x107f520]
mov dword [eax + 0x44], ecx
mov ecx, dword [0x10813fc]
push 1
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01046cf8
xor edi, edi
jmp 0x1032cb2
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 4

Function at 0x1032f19
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1032f80
cmp dword [ebp + 0xc], esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
mov dword [ebp - 4], esi
push esi
je 0x1032f41
push 0x1001f00
jmp 0x1032f46
push 0x1001e90
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1032f80
cmp dword [ebp - 4], esi
je 0x1032f80
push 2
push 0x1001e8c
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1032f77
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8
Function at 0x1032f8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x210], esi
je 0x103309d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
push 0x1001ff0
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1033066
and dword [ebp - 0x214], esi
lea eax, [ebp - 0x214]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x210]
call edi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x103305e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001fcc
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033056
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
push dword [ebp - 0x214]
call edi
push dword [ebp - 0x210]
call edi
mov ecx, 0x1001fa0
mov eax, ebx
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1033094
test dx, dx
je 0x1033090
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1033094
add eax, 4
add ecx, 4
test dx, dx
jne 0x103306e
xor eax, eax
jmp 0x1033099
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10330b2
push 0
push 0x1001e60
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 4
Function at 0x10330c9
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x214], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
cmp eax, edi
je 0x10331e1
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x210], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, edi
mov dword [ebp - 0x218], eax
je 0x10331e1
push ebx
xor ebx, ebx
cmp dword [ebp - 0x210], edi
jle 0x10331e0
push esi
mov eax, dword [ebp - 0x218]
lea esi, [eax + ebx*4]
push 0x1002068
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x10331d2
push 0x3a
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x10331d2
inc esi
inc esi
je 0x10331d2
push esi
call fcn.01056f43
test eax, eax
je 0x10331d2
push edi
push 2
push edi
push esi
call fcn.0105e6fe
mov esi, eax
cmp esi, 0xffffffff
je 0x10331d2
lea eax, [ebp - 0x228]
push eax
push 0x10098ec
push 0x1002048
push esi
call fcn.0105e74d
test eax, eax
je 0x10331cb
push 0xffffffffffffffff
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.010565bc
cmp eax, edi
mov dword [ebp - 0x214], eax
jl 0x10331cb
push 1
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.01055afa
push esi
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
inc ebx
cmp ebx, dword [ebp - 0x210]
jl 0x103312b
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
call fcn.01047417
leave
ret

Function at 0x10332da
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0x1002170
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcsstr]
xor edi, edi
cmp eax, edi
pop ecx
pop ecx
je 0x1033375
push esi
push 0x3a
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x1033374
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002120
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033374
inc esi
inc esi
je 0x103336b
push 0x1001e8c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103336b
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1033348
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
push 1
push edi
push 0x1002104
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebp
ret 4
Function at 0x1033c0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 1
push esi
push esi
push esi
push 0x1001bd0
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033c7d
push edi
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x10021fc
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033c73
cmp dword [ebp - 8], edi
jne 0x1033c73
cmp dword [ebp - 0xc], 1
sete al
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x1033d98
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x1002248
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1033e14
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x1001fa0
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033e0a
cmp dword [ebp - 8], esi
jne 0x1033e0a
cmp dword [ebp - 0xc], edi
sete bl
cmp ebx, edi
je 0x1033e0a
push 0x1002230
push esi
call fcn.0105e573
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1033ec3
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.010571af
cmp eax, 6
jne 0x1033eeb
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 6
setne al
leave
ret
mov ecx, dword [0x10813fc]
push edi
xor edi, edi
test ecx, ecx
je 0x1033f16
push esi
call fcn.01046a69
mov esi, eax
call fcn.0105e7ec
test eax, eax
jne 0x1033f0d
test esi, esi
jmp 0x1033f10
cmp esi, 1
jne 0x1033f15
xor edi, edi
inc edi
pop esi
mov eax, edi
pop edi
leave
ret
Function at 0x1033f67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x208]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1002388
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x208], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034096
push esi
push 3
pop esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x1002378
push dword [ebp - 0x208]
mov dword [ebp - 0x210], ebx
std
invalid
dec dword [ecx - 0x20b63]
dec dword [ecx - 0x2174b]
inc edi
test esp, esp
std
invalid
dec dword [eax]
add byte [eax], al
add bh, bh
adc eax, sym.imp.ADVAPI32.dll_RegQueryValueExW
test eax, eax
jne 0x1034089
cmp dword [ebp - 0x218], esi
jne 0x1034089
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.0105c511
test eax, eax
je 0x1034089
mov eax, dword [ebp - 0x210]
shr eax, 0x10
cdq
shld edx, eax, 0x10
shl eax, 0x10
mov ecx, eax
movzx eax, word [ebp - 0x210]
mov esi, edx
cdq
or ecx, eax
mov eax, dword [ebp - 0x20c]
or esi, edx
shld esi, ecx, 0x10
shr eax, 0x10
cdq
push edi
shl ecx, 0x10
or ecx, eax
movzx eax, word [ebp - 0x20c]
or esi, edx
mov edi, ecx
shld esi, edi, 0x10
cdq
shl edi, 0x10
or edi, eax
lea eax, [ebp - 0x204]
push eax
or esi, edx
call fcn.01056c56
cmp edx, esi
ja 0x1034088
jb 0x1034082
cmp eax, edi
jae 0x1034088
mov dword [ebp - 0x214], ebx
pop edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret

Function at 0x10340ae
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push esi
push edi
push 0x1002430
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10340d2
inc edi
test esi, esi
je 0x10340e4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x1034367
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x10813d0], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
mov esi, 0x1001bd0
jne 0x10343d8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
push eax
push edi
push 2
push edi
push edi
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x10343b3
push edi
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
push edi
push esi
push SysReAllocString
call ebx
cmp dword [ebp - 4], edi
je 0x103442f
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x1001bb0
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1034426
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 2
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x1034405
push 0x1001bb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 2
push edi
push esi
push SysReAllocString
call ebx
test eax, eax
invalid
jne 0x103442f
push 0x1001bb0

Function at 0x1034439
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0
je 0x10344e6
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 4], eax
je 0x103449f
lea ecx, [ebp - 0x24]
push ecx
push eax
call edi
push 2
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push 0
call ebx
cmp dword [ebp + 0x14], 0
je 0x103449f
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x10344e3
lea ecx, [ebp - 0x14]
push ecx
push eax
call edi
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor edi, edi
push edi
call ebx
mov eax, dword [ebp - 0x20]
push 1
push edi
push edi
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1034b5a
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 4]
push eax
push 3
xor ebx, ebx
push ebx
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034c6e
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x1001d50
push dword [ebp - 4]
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 1
call edi
test eax, eax
mov esi, 0x1002504
jne 0x1034c3f
cmp dword [ebp - 0x10], 0xd2af9
je 0x1034bd5
cmp dword [ebp - 0x10], 0xc00d2afb
jne 0x1034c3f
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0xc], 1
call fcn.0103279d
test eax, eax
jne 0x1034c2e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 8
call edi
test eax, eax
jne 0x1034c2e
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jb 0x1034c2b
ja 0x1034c16
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jbe 0x1034c2b
push 8
lea eax, [ebp - 0x1c]
push eax
push 3
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1034c2e
mov dword [ebp - 0xc], ebx
call fcn.010575fe
test eax, eax
jne 0x1034c3a
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jne 0x1034c63
push 4
lea eax, [ebp - 8]
push eax
push 4
push ebx
push 0x1001d50
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret

Function at 0x1034e1b
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10017c4
call fcn.01056c56
mov edi, eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1034ee3
push 0x1002520
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034cee
test eax, eax
jl 0x1034ee3
lea eax, [ebp - 0x20c]
push eax
call fcn.01057adf
cmp eax, edi
jne 0x1034ee3
cmp edx, ebx
jne 0x1034ee3
xor esi, esi
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1034ee3
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push esi
push 0x10019ec
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret
Function at 0x1034ef7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x620], edi
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x628], edi
call fcn.0105e7ec
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
je 0x1034f6d
push 0x10025ac
call ebx
mov esi, eax
cmp esi, edi
je 0x1034f6d
push 0x100258c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1034f66
lea ecx, [ebp - 0x628]
push ecx
call eax
test eax, eax
je 0x1034f66
mov dword [ebp - 0x624], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1035068
push 0x1002574
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01034cee
test eax, eax
jl 0x1035068
lea eax, [ebp - 0x414]
push eax
call fcn.01056f43
test eax, eax
je 0x1035068
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1035068
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
cmp eax, edi
pop ecx
pop ecx
je 0x1035068
mov word [eax], di
lea eax, [ebp - 0x20c]
push eax
call fcn.01056bba
cmp dword [ebp + 8], edi
lea eax, [ebp - 0x20c]
je 0x1035007
push 0x1001a14
jmp 0x103500c
push 0x1001a30
push esi
push eax
call fcn.01034cee
cmp eax, edi
jl 0x1035068
lea eax, [ebp - 0x20c]
push eax
call fcn.01056f43
test eax, eax
je 0x1035068
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x1002558
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.01034d76
add esp, 0x14
test eax, eax
jl 0x1035068
push 0xffff
push 1
lea eax, [ebp - 0x61c]
push eax
push edi
call fcn.0105ab51
mov dword [ebp - 0x620], eax
call fcn.0105e7ec
test eax, eax
je 0x10350a5
cmp dword [ebp - 0x624], edi
je 0x10350a5
push 0x10025ac
call ebx
mov esi, eax
cmp esi, edi
je 0x10350a5
push 0x1002538
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x103509e
push dword [ebp - 0x628]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x620]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 4