joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x43b190
cmp edx, dword [eax]
je 0x43778b
add eax, 8
inc ecx
cmp eax, 0x43b220
jl 0x43777c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x43b190]
jne 0x4378b9
mov eax, dword [0x43bbb0]
cmp eax, 1
je 0x437893
test eax, eax
jne 0x4377bc
cmp dword [0x43b0e4], 1
je 0x437893
cmp edx, 0xfc
je 0x4378b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4377f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00438670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00438490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x437836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00438490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43a45c
push edi
call fcn.00438f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00438670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00438680
lea eax, [ebp - 0xa0]
push 0x43a43c
push eax
call fcn.00438680
push dword [esi + 0x43b194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00438680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00438e75
add esp, 0x2c
pop edi
jmp 0x4378b9
lea eax, [ebp + 8]
lea esi, [esi + 0x43b194]
push 0
push eax
push dword [esi]
call fcn.00438490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1046141
Capabilities:
Accept command line arguments

Disassembly:
push 0x6c
mov eax, 0x10cd431
call fcn.0109887a
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0xff
push 1
push 0x3fc
mov edi, 0x1002e5c
push edi
push 0x1001a0c
mov ebx, 0x10019a8
push ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
call fcn.01099386
lea ecx, [ebp - 0x78]
call fcn.0109a83a
xor eax, eax
push eax
push eax
push 1
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x10e3e78
call fcn.01043410
push 0x1002e40
mov dword [0x10e3e98], 0x100182c
mov dword [0x10e308c], 0x10e3e78
call fcn.010434e1
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x1002e04
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0xff
push 1
push 0x406
push edi
push 0x1001a0c
push ebx
mov dword [ebp - 0x28], eax
call fcn.01099386
lea eax, [ebp - 0x78]
push eax
call fcn.0109a510
mov edi, dword [ebp - 0x20]
add esp, 0x64
push 0
push edi
push 0x10e3020
lea ecx, [esi + 8]
call fcn.010430b8
mov dword [esi + 0xc8], edi
mov esi, 0x1002dfc
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
movsw word es:[edi], word [esi]
call fcn.01043a7c
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10462f8
push eax
push 0x1002dd0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0xff
push 1
push 0x413
mov esi, 0x1002e5c
push esi
mov edi, 0x1001a0c
push edi
push ebx
call fcn.01099386
lea eax, [ebp - 0x78]
push eax
call fcn.0109a510
add esp, 0x64
push 0xffffffffffffffff
push 0x1002dbc
push 0xffffffffffffffff
push dword [ebp - 0x20]
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x10462ec
push 0x1002d50
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0xff
push 1
push 0x418
push esi
push edi
push ebx
call fcn.01099386
lea eax, [ebp - 0x78]
push eax
call fcn.0109a510
mov eax, dword [ebp - 0x24]
add esp, 0x60
mov dword [eax + 0xa0], 0x32
call fcn.0104352f
mov eax, dword [ebp - 0x24]
mov esi, dword [eax + 0xa0]
lea ecx, [ebp - 0x78]
call fcn.0109a8f3
mov eax, esi
call fcn.010988e5
ret 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
jmp 0x104622f
xor al, al
jne 0x10462cc
mov ecx, dword [ebp - 0x24]
call fcn.01045e92
jmp 0x10462cc
Function at 0x1046c2b
Capabilities:
Get disk information

Disassembly:
push 0x44
mov eax, 0x10cd4e3
call fcn.010987cc
and dword [ebp - 4], 0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 0xb
push 0x183
mov ebx, 0x10038f4
push ebx
mov edi, 0x10038e4
push edi
mov esi, 0x1003898
push esi
call fcn.01099386
lea ecx, [ebp - 0x50]
call fcn.0109a83a
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push 0x1003828
sub esp, 0x58
mov dword [ebp - 0x10], esp
xor eax, eax
mov word [ecx], ax
mov ecx, esp
push 0xff
push 0xb
push 0x18b
push ebx
push edi
push esi
mov byte [ebp - 4], 1
call fcn.01099386
lea eax, [ebp - 0x50]
push eax
call fcn.0109a510
add esp, 0x64
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1046ceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0x64]
lea eax, [ebp + 8]
push 0x1003798
push dword [ebp + 0x60]
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x64], esp
push eax
call fcn.010993d2
lea eax, [ebp - 0x50]
push eax
call fcn.0109b1b1
push dword [ebp + 0x68]
push 0x1003710
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0xff
push 0xb
push 0x193
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x50]
push eax
call fcn.0109a510
add esp, 0x64
lea ecx, [ebp - 0x50]
call fcn.0109a8f3
lea ecx, [ebp + 8]
call fcn.01099436
call fcn.010988b8
ret 0x68

Function at 0x10470b8
Capabilities:
Get common file path
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x630], esp
push 0xff
push 1
push 0xe3f
mov ebx, 0x1003d14
push ebx
mov edi, 0x1003990
push edi
mov esi, 0x1003928
push esi
mov dword [ebp - 0x62c], eax
call fcn.01099386
lea ecx, [ebp - 0x670]
call fcn.0109a83a
push 0x105
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1047205
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x1047205
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x10471b6
push dword [ebp - 0x62c]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb al, al
inc al
pop ecx
movzx eax, al
pop ecx
push eax
lea ecx, [ebp - 0x670]
call fcn.01046874
lea ecx, [ebp - 0x670]
mov bl, al
call fcn.0109a8f3
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.010987b7
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10471ca
and eax, 0xffff
or eax, 0x80070000
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1003ca0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x630], esp
push 0xff
push 1
push 0xe4b
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x670]
push eax
call fcn.0109a510
add esp, 0x68
push 0
jmp 0x104718b
Function at 0x104ad38
Capabilities:
Get disk information

Disassembly:
push 0x58
mov eax, 0x10cd922
call fcn.010987cc
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xff
push 1
push 0xd5d
mov ebx, 0x1006208
push ebx
mov edi, 0x1003990
push edi
mov esi, 0x1003928
push esi
call fcn.01099386
lea ecx, [ebp - 0x64]
call fcn.0109a83a
xor eax, eax
push eax
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x1001df4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov byte [ebp - 4], 1
cmp eax, ecx
jne 0x104adc8
push 0x10061b8
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 2
push 0xd61
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x64]
push eax
call fcn.0109c23a
or dword [ebp - 0x18], 0xffffffff
push ecx
push ecx
push ecx
push 0x1f4
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], 0xffb3b4c0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x104ae05
push 0x1006184
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 2
push 0xd66
jmp 0x104adb7
and dword [ebp - 0x10], 0
push 0x104
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x104ae36
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x104ae6b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x64
jl 0x104ae09
cmp dword [ebp - 0x10], 0x64
jne 0x104ae89
push 0x1006138
push 0x80042308
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 1
push 0xd73
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x64]
push eax
call fcn.0109b1b1
push 0x10060fc
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 1
push 0xd70
jmp 0x104adb7
lea ecx, [ebp - 0x24]
call fcn.01043da5
lea ecx, [ebp - 0x64]
call fcn.0109a8f3
call fcn.010988b8
ret 8
Function at 0x104d7d5
Capabilities:
Get disk information

Disassembly:
push 0x27c
mov eax, 0x10cdb84
call fcn.0109883f
mov eax, dword [ebp + 8]
xor esi, esi
push esi
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xe20
push 0x1007600
mov ebx, 0x1003990
push ebx
mov edi, 0x1003928
push edi
mov dword [ebp - 0x234], eax
call fcn.01099386
lea ecx, [ebp - 0x288]
call fcn.0109a83a
push esi
push 0xf003f
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], esi
call fcn.010abff2
push 0x1003454
lea eax, [ebp - 0x248]
push 0x80000002
push eax
mov byte [ebp - 4], 1
call fcn.010ab96e
add esp, 0xc
test al, al
je 0x104d9f7
mov dword [ebp - 0x228], esi
mov esi, 0x100599c
mov dword [ebp - 0x22c], esi
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call fcn.01047322
push 0
lea eax, [ebp - 0x228]
push eax
push 0x1003470
lea ecx, [ebp - 0x248]
call fcn.010abd93
test al, al
je 0x104d9ea
and dword [ebp - 0x220], 0
mov dword [ebp - 0x224], esi
push 0x1003490
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 3
call fcn.0104a3ce
push dword [ebp - 0x228]
lea ecx, [ebp - 0x224]
call fcn.0104c18e
mov esi, dword [ebp - 0x220]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x104d8df
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x104d905
push 0x100163c
lea ecx, [ebp - 0x224]
call fcn.0104c18e
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x104d987
push dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb al, al
inc al
pop ecx
movzx eax, al
pop ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.01046874
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.0104a19a
lea ecx, [ebp - 0x22c]
call fcn.0104a19a
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.010abb24
lea ecx, [ebp - 0x288]
call fcn.0109a8f3
mov al, bl
call fcn.010988d1
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x104d99b
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0x220]
push dword [ebp - 0x224]
push 0x1003ca0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xe36
push 0x1007600
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x288]
push eax
call fcn.0109a510
add esp, 0x6c
lea ecx, [ebp - 0x224]
call fcn.0104a19a
lea ecx, [ebp - 0x22c]
call fcn.0104a19a
xor esi, esi
push esi
lea ecx, [ebp - 0x288]
call fcn.01046874
mov bl, al
jmp 0x104d963
Function at 0x104da0f
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push 0x68c
mov eax, 0x10cdbc7
call fcn.0109883f
mov eax, dword [ebp + 8]
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x654], esp
push 0xff
push 1
push 0xe55
mov ebx, 0x1007700
push ebx
mov edi, 0x1003990
push edi
mov esi, 0x1003928
push esi
mov dword [ebp - 0x658], eax
call fcn.01099386
lea ecx, [ebp - 0x698]
call fcn.0109a83a
and dword [ebp - 4], 0
push 0
push 0x220
lea eax, [ebp - 0x230]
push eax
push 0x12
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
je 0x104dade
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10076a0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x654], esp
push 0xff
push 1
push 0xe5f
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x698]
push eax
call fcn.0109a510
add esp, 0x64
push 0
lea ecx, [ebp - 0x698]
call fcn.01046874
mov bl, al
lea ecx, [ebp - 0x698]
call fcn.0109a8f3
mov al, bl
call fcn.010988d1
ret 4
lea eax, [ebp - 0x230]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x648]
cmp dword [eax + 4], 0
je 0x104dbf4
and dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0x100599c
push 0x1003490
lea ecx, [ebp - 0x650]
mov byte [ebp - 4], 1
call fcn.0104a3ce
mov eax, dword [ebp - 0x648]
push dword [eax + 0x14]
lea ecx, [ebp - 0x650]
call fcn.0104c18e
mov eax, dword [ebp - 0x64c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x104db3c
sub eax, ecx
mov ecx, dword [ebp - 0x64c]
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
je 0x104db68
push 0x100163c
lea ecx, [ebp - 0x650]
call fcn.0104c18e
push 0x104
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x104dbba
push 0x104
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x104dbba
push dword [ebp - 0x658]
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x104dc2c
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x654], eax
add eax, dword [eax]
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x648], eax
mov byte [ebp - 4], 0
call fcn.0104a19a
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0x648], eax
jne 0x104daea
jmp 0x104daba
push 0x1007640
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x654], esp
push 0xff
push 1
push 0xe6b
push ebx
push edi
push esi
call fcn.01099386
lea eax, [ebp - 0x698]
push eax
call fcn.0109a510
add esp, 0x60
jmp 0x104daba
push 1
lea ecx, [ebp - 0x698]
call fcn.01046874
lea ecx, [ebp - 0x650]
mov bl, al
call fcn.0104a19a
jmp 0x104dac9
Function at 0x1050512
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp eax, 2
jne 0x1050565
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x1009298
push 0x80042308
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x10], esp
push 0xff
push 1
push 0x5c
push 0x1009270
push 0x100925c
push 0x10091f0
call fcn.01099386
push dword [ebp + 8]
call fcn.0109b1b1
test eax, eax
je 0x10505ae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x10091c4
jle 0x1050580
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x10], esp
push 0xff
push 1
push 0x5f
push 0x1009270
push 0x100925c
push 0x10091f0
call fcn.01099386
push dword [ebp + 8]
call fcn.0109c3bb
pop ebp
ret 0xc
Function at 0x10505b7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x14]
push 8
mov dword [ebp - 0x34], ecx
pop ecx
mov ebx, 0x10093b4
mov esi, ebx
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 0x18]
xor edi, edi
mov dword [ebp - 0x3c], eax
mov dword [eax + 8], edi
lea eax, [esi + esi]
push eax
push edi
push edx
mov dword [ebp - 0x2c], edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esi + esi - 2]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x105067b
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x100937c
jle 0x105064e
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xff
push 1
push 0xa8
push ebx
push 0x100925c
push 0x10091f0
call fcn.01099386
push dword [ebp - 0x3c]
call fcn.0109c3bb
cmp dword [ebp - 0x2c], 1
je 0x1050767
push 1
push 0xff
push 1
push 0xae
push ebx
mov edi, 0x100925c
push edi
mov esi, 0x10091f0
push esi
lea ecx, [ebp - 0x1a0]
call fcn.01099386
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, eax
call fcn.01099d7b
push 1
lea ecx, [ebp - 0x148]
push ecx
mov ecx, eax
call fcn.01099d7b
push dword [ebp - 0x34]
lea ecx, [ebp - 0x98]
push ecx
mov ecx, eax
call fcn.010999d6
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push dword [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.010999d6
push 0x3007
push dword [ebp - 0x3c]
call fcn.0109bb37
add esp, 0x64
lea ecx, [ebp - 0x98]
call fcn.01099436
lea ecx, [ebp - 0x148]
call fcn.01099436
lea ecx, [ebp - 0xf0]
call fcn.01099436
lea ecx, [ebp - 0x1a0]
call fcn.01099436
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
push eax
push 0x10092d8
push 0x80042302
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xff
push 1
push 0xaf
push ebx
push edi
push esi
call fcn.01099386
push dword [ebp - 0x3c]
call fcn.0109b1b1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010987b7
leave
ret 0x18
Function at 0x105077d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
push 8
pop ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
push 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov ebx, 0x1009484
mov esi, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
xor esi, esi
lea ecx, [ebp - 0x3c]
push ecx
push eax
mov dword [edx + 8], esi
mov dword [eax], esi
lea eax, [ebp - 0x30]
push eax
push esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
push dword [ebp - 0x28]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x105082d
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push 0x100937c
jle 0x1050800
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0xff
push 1
push 0xf3
push ebx
push 0x100925c
push 0x10091f0
call fcn.01099386
push dword [ebp - 0x38]
call fcn.0109c3bb
cmp dword [ebp - 0x30], edi
je 0x1050918
push 1
push 0xff
push 1
push 0xf9
push ebx
mov edi, 0x100925c
push edi
mov esi, 0x10091f0
push esi
lea ecx, [ebp - 0x19c]
call fcn.01099386
push dword [ebp - 0x30]
lea ecx, [ebp - 0xec]
push ecx
mov ecx, eax
call fcn.01099d7b
push 4
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
call fcn.01099d7b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.010999d6
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push dword [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.010999d6
push 0x3007
push dword [ebp - 0x38]
call fcn.0109bb37
add esp, 0x64
lea ecx, [ebp - 0x94]
call fcn.01099436
lea ecx, [ebp - 0x144]
call fcn.01099436
lea ecx, [ebp - 0xec]
call fcn.01099436
lea ecx, [ebp - 0x19c]
call fcn.01099436
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
push eax
push 0x10093d8
push 0x80042302
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0xff
push 1
push 0xfa
push ebx
push edi
push esi
call fcn.01099386
push dword [ebp - 0x38]
call fcn.0109b1b1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010987b7
leave
ret 0x14
Function at 0x10559ad
Capabilities:
Resume thread

Disassembly:
push 0x44
mov eax, 0x10d19b8
call fcn.010987cc
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 1
push 0x171
push 0x100bfe0
mov ebx, 0x100bfcc
push ebx
mov edi, 0x100bf80
push edi
call fcn.01099386
lea ecx, [ebp - 0x50]
call fcn.0109a83a
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
and dword [ebp - 4], 0
test eax, eax
je 0x1055ab8
cmp dword [esi + 0x10], 2
jne 0x1055ab8
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1055aa8
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push 0x100bef0
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x184
push 0x100bfe0
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x50]
push eax
call fcn.0109ce5e
add esp, 0x6c
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100be90
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x187
push 0x100bfe0
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x50]
push eax
call fcn.0109a510
add esp, 0x68
lea ecx, [ebp - 0x50]
mov dword [esi + 0x10], 5
call fcn.0109a8f3
mov eax, 0x8007000e
jmp 0x1055af9
lea ecx, [ebp - 0x50]
mov byte [esi + 0x14], 1
call fcn.0109a8f3
xor eax, eax
jmp 0x1055af9
push dword [esi + 0x10]
push 0x100be74
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x176
push 0x100bfe0
push ebx
push edi
call fcn.01099386
lea eax, [ebp - 0x50]
push eax
call fcn.0109a510
add esp, 0x64
lea ecx, [ebp - 0x50]
call fcn.0109a8f3
mov eax, 0x8000ffff
call fcn.010988b8
ret 4