joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036080
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x100ec50b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [ebp + 0x20c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], 1
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
cmp eax, esi
jne 0x100360f6
push str.Fail_to_get_registry_key_in_CWSPSearchPrinter::LoadPrinters________
mov ecx, 0x10152dd8
call fcn.1003f430
add esp, 4
xor al, al
jmp 0x100361f8
lea ecx, [ebp - 0x18]
push ecx
push str.InstallingSetupFoundPrinter
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100360ef
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea edx, [ebp - 0x24]
push edx
push esi
push esi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100360ef
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp edi, dword [ebp - 0x24]
jae 0x100361ee
push 0x200
push esi
lea ecx, [ebp]
push ecx
call fcn.100c7d20
add esp, 0xc
mov dword [ebp - 0x20], 0x100
lea edx, [ebp - 0x38]
push edx
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp]
push ecx
push edi
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100361e4
push 8
call fcn.100b6196
add esp, 4
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp eax, esi
je 0x1003618c
mov edi, eax
call fcn.1000eec0
mov esi, eax
mov edi, dword [ebp - 0x1c]
mov byte [ebp - 4], 0
test esi, esi
je 0x100361e4
lea eax, [ebp]
push eax
mov edx, dword [ebp - 0x2c]
mov ecx, esi
call fcn.1000ef30
test eax, eax
jne 0x100361df
push esi
mov ecx, ebx
call fcn.10036250
test al, al
je 0x100361df
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x28], eax
mov esi, dword [esi]
push 0x1e14
push esi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebx + 0x18]
call fcn.1002cf70
push eax
call fcn.100c8130
add esp, 0xc
add edi, 1
xor esi, esi
jmp 0x10036128
call fcn.1002c860
add edi, 1
xor esi, esi
jmp 0x10036128
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.100c59be
add ebp, 0x204
mov esp, ebp
pop ebp
ret 4
Function at 0x10036b00
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, 1
xor ebp, ebp
push edi
mov ecx, esi
mov dword [esp + 0x10], ebp
call fcn.100b894e
cmp byte [esp + 0x14], 0
mov eax, dword [esi + 0x131a8]
mov edx, dword [eax - 0xc]
mov bl, 1
je 0x10036c3e
cmp edx, 5
jne 0x10036b43
mov eax, dword [esp + 0xc]
mov dword [esi + 0x120fc], edi
pop edi
pop ebp
pop ebx
pop ecx
ret 4
cmp edx, 0xd
je 0x10036bb1
cmp edx, 0xa
je 0x10036b56
cmp edx, 0x1a
jne 0x10036c44
lea ecx, [edx - 1]
cmp ecx, ebp
jl 0x10036ba3
lea ecx, [ecx]
cmp ecx, ebp
jl 0x10036bc6
mov eax, dword [esi + 0x131a8]
cmp ecx, dword [eax - 0xc]
jg 0x10036bc6
movzx eax, word [eax + ecx*2]
cmp ax, 0x61
jb 0x10036b7f
cmp ax, 0x66
jbe 0x10036b9b
cmp ax, 0x41
jb 0x10036b8b
cmp ax, 0x46
jbe 0x10036b9b
cmp ax, 0x30
jb 0x10036b97
cmp ax, 0x39
jbe 0x10036b9b
xor bl, bl
xor ecx, ecx
sub ecx, edi
jns 0x10036b60
test bl, bl
je 0x10036bd0
cmp edx, 0xa
je 0x10036b32
cmp edx, 0x1a
jne 0x10036c44
mov eax, dword [esp + 0xc]
pop edi
pop ebp
mov dword [esi + 0x120fc], 2
pop ebx
pop ecx
ret 4
push 0x80070057
call fcn.10006b90
push ebp
push 0x30
lea edx, [esi + 0x12100]
lea ecx, [esi + 0x78]
mov dword [esi + 0x120fc], ebp
call fcn.1004ef40
push 0xfa6
mov ecx, esi
call fcn.100bd4e2
push 0xffffffffffffffff
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov ecx, dword [edi + 0x20]
push 0xb1
push ecx
call ebp
mov edx, dword [edi + 0x20]
push 0
push 0
push 0xb7
push edx
call ebp
push 0xfa6
mov ecx, esi
call fcn.100bd4e2
mov ecx, eax
call fcn.100bd682
pop edi
mov dword [esp + 8], 0xd
mov eax, dword [esp + 8]
pop ebp
pop ebx
pop ecx
ret 4
mov dword [esi + 0x120fc], ebp
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x1003cd30
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0xa04]
sub esp, 0xa04
push 0xffffffffffffffff
push 0x100eb7b0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp + 0xa00], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], 0xd
mov dword [ebp - 4], 0
test edx, edx
je 0x1003cf0b
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003cd90
sub eax, esi
sar eax, 1
je 0x1003cf0b
lea esi, [edi + 0x120f8]
mov ecx, esi
call fcn.10046d00
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x1003cdde
push str.Load_Script_files_fail__
mov ecx, 0x10152dd8
call fcn.1003f430
add esp, 4
mov dword [ebp - 0x18], edi
push 0x1012ac78
lea eax, [ebp - 0x18]
push eax
call fcn.100c80ad
xor edx, edx
xor eax, eax
mov ecx, esi
call fcn.10046cb0
mov esi, eax
test esi, esi
jne 0x1003cdf6
xor eax, eax
jmp 0x1003cf49
push 0x800
push 0
lea ecx, [ebp]
push ecx
call fcn.100c7d20
add esp, 0xc
push 0
push 0x400
lea ebx, [ebp]
mov edx, str.PROGRAM_INFO_PROGRAM_NAME
mov ecx, esi
call fcn.10046730
test eax, eax
jne 0x1003cdef
mov edx, ebx
push edx
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov eax, ebx
push eax
push str.This_program_is_already_running.___s____
mov ecx, 0x10152dd8
call fcn.1003f430
add esp, 8
test esi, esi
je 0x1003cf02
lea esp, [esp]
push 0x200
push 0
lea ecx, [ebp + 0x800]
push ecx
call fcn.100c7d20
add esp, 0xc
push 0x100
lea edx, [ebp + 0x800]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x800]
push ecx
call fcn.100c629b
add esp, 8
mov ecx, 0x10152dd8
test eax, eax
jne 0x1003cedb
lea edx, [ebp + 0x800]
push edx
push str.Send_END_Dialog_message_to_the_window__s_
call fcn.1003f430
add esp, 8
push 1
push 1
push 0x800
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x1014
jne 0x1003ceef
push str.The_program_is_closed____
mov ecx, 0x10152dd8
call fcn.1003f430
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x1003cf47
lea eax, [ebp + 0x800]
push eax
push str.The_window_is_not_matched__s_
call fcn.1003f430
add esp, 8
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x1003ce50
mov dword [ebp - 4], 0xffffffff
jmp 0x1003cf47
mov eax, 0xd
jmp 0x1003cf49
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa00]
xor ecx, ebp
call fcn.100c59be
add ebp, 0xa04
mov esp, ebp
pop ebp
ret
Function at 0x1003f150
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1804]
mov eax, 0x1804
call fcn.100c8100
push 0xffffffffffffffff
push 0x100e60f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp + 0x1800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp]
push eax
call fcn.100c7d20
push 0x800
push ebx
lea ecx, [ebp + 0x800]
push ecx
call fcn.100c7d20
push 0x800
push ebx
lea edx, [ebp + 0x1000]
push edx
call fcn.100c7d20
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [esi], ebx
je 0x1003f1da
mov al, 1
jmp 0x1003f2a3
push 0x400
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1003f1ff
mov byte [ebp - 0x12], bl
push 0x1012ae58
lea ecx, [ebp - 0x12]
push ecx
call fcn.100c80ad
push 0x5c
lea edx, [ebp]
push edx
call fcn.100c747a
add esp, 8
mov edi, eax
cmp edi, ebx
je 0x1003f218
add edi, 2
jmp 0x1003f21d
mov edi, str.SSLog
lea eax, [ebp + 0x800]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea ecx, [ebp + 0x800]
push ecx
push str._s_s.log
lea edx, [ebp + 0x1000]
call fcn.10005c50
add esp, 0xc
push ebx
push 0x80
push 4
push ebx
push 1
push 0xc0000000
lea edx, [ebp + 0x1000]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x1003f271
mov byte [ebp - 0x11], bl
mov byte [esi + 0x204], 1
push 0x1010e9a4
push 0x100
lea eax, [esi + 4]
push eax
call fcn.100c6466
add esp, 0xc
mov ecx, esi
call fcn.1003f620
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1800]
xor ecx, ebp
call fcn.100c59be
add ebp, 0x1804
mov esp, ebp
pop ebp
ret
Function at 0x1003f2f0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e60c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4008
call fcn.100c8100
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
cmp dword [esi], 0
je 0x1003f3fc
mov dword [ebp - 4], 0
push 0x2000
push 0
lea eax, [ebp - 0x2014]
push eax
call fcn.100c7d20
push 0x2000
push 0
lea ecx, [ebp - 0x4014]
push ecx
call fcn.100c7d20
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1000
lea ecx, [ebp - 0x2014]
push ecx
call fcn.100c5f1f
add esp, 0x28
test edi, edi
je 0x1003f3ce
push 0
push 0
lea edx, [ebp - 0x4018]
push edx
push 0x409
push edi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x4018]
test eax, eax
je 0x1003f3ce
push eax
push edi
lea eax, [esi + 4]
push eax
push str.___s___Error_Code___d_:_s
lea edx, [ebp - 0x4014]
call fcn.1001c660
add esp, 0x10
mov ecx, dword [ebp - 0x4018]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea edx, [ebp - 0x2014]
mov ecx, esi
call fcn.1003f510
test edi, edi
je 0x1003f3f5
lea edx, [ebp - 0x4014]
mov ecx, esi
call fcn.1003f510
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c59be
mov esp, ebp
pop ebp
ret

Function at 0x1003f920
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.100c8100
push 0xffffffffffffffff
push 0x100e5930
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [esi], ebx
jne 0x1003f974
xor eax, eax
jmp 0x1003f9f1
cmp byte [esi + 0x20c], bl
jne 0x1003f970
mov dword [ebp - 4], ebx
mov byte [esi + 0x20c], 1
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x1000
push ebx
lea ecx, [ebp]
push ecx
call fcn.100c7d20
add esp, 0xc
push ebx
push ebx
push 0x1000
lea edx, [ebp]
push edx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1003f9c0
sub eax, edx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push eax
lea edx, [ebp]
push edx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov byte [esi + 0x20c], bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.100c59be
add ebp, 0x1004
mov esp, ebp
pop ebp
ret
Function at 0x10044220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e58c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10144930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], ebx
je 0x1004435f
cmp dword [ebp + 0x14], ebx
je 0x1004435f
cmp edx, ebx
je 0x100442b2
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10044274
sub eax, esi
sar eax, 1
je 0x100442b2
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
push edx
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x100442b8
mov dword [ebp - 0x24], eax
push 0x1012ac78
lea edx, [ebp - 0x24]
push edx
call fcn.100c80ad
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.100b61c6
mov esi, eax
mov dword [ebp - 0x20], esi
mov edx, dword [ebp + 0x14]
push edx
push ebx
push esi
call fcn.100c7d20
add esp, 0x10
cmp esi, ebx
jne 0x100442ed
mov dword [ebp - 0x28], 0xe
push 0x1012ac78
lea eax, [ebp - 0x28]
push eax
call fcn.100c80ad
lea ecx, [ebp + 0x14]
push ecx
push esi
lea edx, [ebp - 0x1c]
push edx
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x1004431f
mov dword [ebp - 0x2c], edi
push 0x1012ac78
lea edx, [ebp - 0x2c]
push edx
call fcn.100c80ad
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x18]
cmp eax, ecx
je 0x1004433f
cmp ecx, 1
jne 0x10044356
cmp eax, 2
jne 0x10044356
mov eax, dword [ebp + 0x14]
push eax
push esi
push eax
mov eax, dword [ebp + 0x10]
push eax
jmp 0x10044349
mov eax, dword [ebp + 0x14]
push eax
push esi
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100c5bd3
add esp, 0x10
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
jmp 0x100443a0
mov dword [ebp - 0x30], 0x57
push 0x1012ac78
lea edx, [ebp - 0x30]
push edx
call fcn.100c80ad
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, 0x1004439b
ret
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x100443b3
cmp eax, dword [ebp + 8]
je 0x100443b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x100443c3
push eax
call fcn.100b61c1
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100443e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e58a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10144930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
cmp edi, eax
jne 0x10044434
mov dword [ebp - 0x1c], 0x57
push 0x1012ac78
lea eax, [ebp - 0x1c]
push eax
call fcn.100c80ad
cmp edx, eax
je 0x10044486
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10044440
sub eax, esi
sar eax, 1
je 0x10044486
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10044489
mov dword [ebp - 0x24], eax
push 0x1012ac78
lea ecx, [ebp - 0x24]
push ecx
call fcn.100c80ad
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp + 0x10]
push edx
push edi
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100444bf
cmp eax, dword [ebp + 8]
je 0x100444bf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044800
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5880
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10144930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp ebx, eax
je 0x100448c6
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10044847
sub eax, edx
sar eax, 1
je 0x100448c6
test edi, edi
jne 0x10044864
mov edi, reloc.WSOCK32.dll_bind
mov dword [ebp + 8], edi
test esi, esi
je 0x100448ac
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10044870
sub eax, edx
sar eax, 1
je 0x100448ac
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100448af
mov dword [ebp - 0x1c], eax
push 0x1012ac78
lea ecx, [ebp - 0x1c]
push ecx
call fcn.100c80ad
mov dword [ebp - 0x14], edi
push ebx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x10044905
mov dword [ebp - 0x20], 0x57
push 0x1012ac78
lea eax, [ebp - 0x20]
push eax
call fcn.100c80ad
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10044902
ret
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10044917
cmp eax, edi
je 0x10044917
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1204]
mov eax, 0x1204
call fcn.100c8100
push 0xffffffffffffffff
push 0x100e5fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp + 0x1200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x120c]
mov dword [ebp - 0x30], eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x10044a9b
cmp eax, edi
je 0x10044a9b
mov dword [ebp - 0x18], eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, edi
je 0x100449d2
mov dword [ebp - 0x44], ebx
push 0x1012ac78
lea ecx, [ebp - 0x44]
push ecx
call fcn.100c80ad
xor esi, esi
mov dword [ebp - 0x38], esi
cmp esi, dword [ebp - 0x28]
jge 0x10044a92
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x200
mov dword [ebp - 0x20], 0x1000
push 0x1000
push edi
lea edx, [ebp]
push edx
call fcn.100c7d20
push 0x200
push edi
lea eax, [ebp + 0x1000]
push eax
call fcn.100c7d20
add esp, 0x18
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp]
push edx
lea eax, [ebp - 0x1c]
push eax
push edi
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp + 0x1000]
push edx
push esi
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x10044a50
mov dword [ebp - 0x40], eax
push 0x1012ac78
lea ecx, [ebp - 0x40]
push ecx
call fcn.100c80ad
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp + 0x1000]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp]
xor edx, edx
call fcn.100443e0
add esp, 0x10
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, edi
je 0x10044a8a
mov dword [ebp - 0x34], ebx
push 0x1012ac78
lea eax, [ebp - 0x34]
push eax
call fcn.100c80ad
add esi, 1
jmp 0x100449d4
mov dword [ebp - 4], 0xffffffff
jmp 0x10044adc
mov dword [ebp - 0x3c], 0x57
push 0x1012ac78
lea ecx, [ebp - 0x3c]
push ecx
call fcn.100c80ad
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10044ad7
ret
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x10044aef
cmp eax, dword [ebp - 0x30]
je 0x10044aef
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1200]
xor ecx, ebp
call fcn.100c59be
add ebp, 0x1204
mov esp, ebp
pop ebp
ret
Function at 0x100450c0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x100e7700
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10144930]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
push 0x11c
push esi
lea eax, [ebp]
push eax
call fcn.100c7d20
add esp, 0xc
mov dword [ebp], 0x11c
lea ecx, [ebp]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
call edi
mov ebx, eax
test ebx, ebx
jne 0x10045144
mov dword [ebp], 0x114
lea edx, [ebp]
push edx
call edi
test eax, eax
je 0x10045337
mov eax, dword [ebp + 0x10]
sub eax, 0
je 0x10045305
mov ecx, 1
sub eax, ecx
je 0x10045264
sub eax, ecx
jne 0x1004530a
mov eax, dword [ebp + 4]
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x10045174
jmp dword [eax*4 + 0x1004535c]
mov esi, 0x20001
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov esi, 0x20002
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov eax, dword [ebp + 8]
sub eax, 0
je 0x100451ef
sub eax, ecx
je 0x100451db
sub eax, ecx
jne 0x100451db
mov esi, 0x40003
mov dword [ebp - 0x14], esi
cmp byte [0x10153000], al
je 0x1004530a
test ebx, ebx
je 0x1004530a
cmp byte [ebp + 0x11a], cl
jne 0x1004530a
mov esi, 0x40002
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov esi, 0x40001
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
cmp dword [ebp + 8], 0
je 0x1004522c
xor eax, eax
cmp byte [ebp + 0x11a], cl
setne al
lea eax, [eax + eax + 0x100002]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
test ebx, ebx
je 0x10045250
cmp byte [ebp + 0x11a], cl
jne 0x1004530a
mov esi, 0x100001
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov esi, 0x100003
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov eax, dword [ebp + 8]
test eax, eax
je 0x100452b9
cmp eax, 0xa
je 0x10045290
sub eax, 0x5a
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 0x10005
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
push 0x1011ae14
lea ecx, [ebp + 0x14]
push ecx
call fcn.100c629b
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
add esi, 0x10004
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
push 0x1011ae0c
lea edx, [ebp + 0x14]
push edx
call fcn.100c629b
add esp, 8
test eax, eax
je 0x100452f4
push 0x1011ae10
lea eax, [ebp + 0x14]
push eax
call fcn.100c629b
add esp, 8
test eax, eax
je 0x100452f4
mov esi, 0x10001
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov esi, 0x10002
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x10045335
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.100c59be
add ebp, 0x120
mov esp, ebp
pop ebp
ret