joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100095b8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 0
push ebx
push esi
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], eax
push 0x10003ef4
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
lea edi, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
mov ecx, edi
mov ebx, 0x201
call fcn.100094f1
mov edx, eax
mov eax, dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex]
mov ecx, ebx
mov esi, edi
sub ecx, eax
lea esi, [esi + eax*2]
test edx, edx
jns 0x10009631
xor eax, eax
mov esi, edi
mov ecx, ebx
mov word [ebp - 0x408], ax
cmp edx, 0x8007007a
jne 0x10009635
mov edi, esi
mov ebx, ecx
test edx, edx
js 0x10009739
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x40a]
push eax
movzx eax, word [ebp - 0x40c]
push eax
movzx eax, word [ebp - 0x40e]
push eax
movzx eax, word [ebp - 0x410]
push eax
movzx eax, word [ebp - 0x418]
push eax
movzx eax, word [ebp - 0x412]
push eax
movzx eax, word [ebp - 0x416]
push eax
push 0x10003f18
push ebx
push edi
call fcn.100078f5
lea ecx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
add esp, 0x28
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1000969c
sub ecx, edx
sar ecx, 1
cmp ecx, 0x200
ja 0x10009739
mov ebx, 0x201
mov eax, ebx
lea edi, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
sub eax, ecx
lea edi, [edi + ecx*2]
mov ecx, esi
je 0x100096d4
cmp eax, 0x7fffffff
jbe 0x100096d9
mov ecx, 0x80070057
test ecx, ecx
js 0x100096f2
push dword [ebp - 0x424]
push dword [ebp - 0x420]
call fcn.1000954e
mov ecx, eax
jmp 0x100096fb
test eax, eax
je 0x100096fb
xor eax, eax
mov word [edi], ax
test ecx, ecx
js 0x10009739
lea ecx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebx
push 0x10003f64
lea ebx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
call fcn.10007c1f
push esi
call dword [sym.imp.SETUPAPI.dll_SetupOpenLog]
test eax, eax
je 0x10009739
push esi
mov eax, ebx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupLogErrorW]
call dword [sym.imp.SETUPAPI.dll_SetupCloseLog]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cace
leave
ret 8
Function at 0x1000981b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x468
mov eax, dword [0x1000e008]
xor eax, esp
mov dword [esp + reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], eax
push ebx
mov ecx, edi
push esi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10009840
sub ecx, edx
sar ecx, 1
mov esi, 0x104
cmp ecx, esi
jbe 0x1000985f
xor eax, eax
jmp 0x10009925
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10009864
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
cmp eax, esi
ja 0x10009858
push 0x10003ff0
push edi
mov ebx, 0x10003ff4
push ebx
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push 0x105
push eax
call fcn.100078f5
add esp, 0x14
test eax, eax
jns 0x100098b2
push 0x148
push 0x10003ea0
call fcn.10009770
pop ecx
pop ecx
jmp 0x10009858
lea eax, [esp + 8]
push eax
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
je 0x10009922
test byte [esp + 8], 0x10
jne 0x1000990b
test dword [esp + 8], reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
jne 0x1000990b
lea eax, [esp + 0x34]
push eax
push edi
push ebx
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push 0x105
push eax
call fcn.100078f5
add esp, 0x14
test eax, eax
js 0x10009939
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100098cc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [esp + reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex]
pop esi
pop ebx
xor ecx, esp
call fcn.1000cace
mov esp, ebp
pop ebp
ret
push 0x163
jmp 0x100098a4

Function at 0x10009948
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebx
push 0x20a
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100099b1
push esi
mov esi, 0x104
push esi
push ebx
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100099a7
sub esi, eax
cmp esi, 0xe
jb 0x100099a7
mov esi, 0x10004000
push esi
mov eax, 0x105
call fcn.10007c1f
test eax, eax
jns 0x100099b3
push 0x6f
call fcn.10009788
push eax
push esi
push ebx
push 0x10004020
call fcn.10009770
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
pop ebx
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100099fa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x100099da
push edi
mov edi, ebx
call fcn.1000981b
pop edi
jmp 0x100099fa
call esi
push eax
call fcn.10009788
push eax
push ebx
push 0x100040a0
call fcn.10009770
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov eax, ebx
jmp 0x100099b0
Function at 0x10009a03
Capabilities:
Delete directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x104
push esi
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10009a7b
sub esi, eax
cmp esi, 0xe
jb 0x10009a7b
push ebx
push 0x10004000
mov eax, 0x106
lea ebx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
call fcn.10007c1f
pop ebx
test eax, eax
jns 0x10009a65
push 0x2a1
push 0x10003ea0
call fcn.10009770
pop ecx
pop ecx
jmp 0x10009a7b
push edi
lea edi, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
call fcn.1000981b
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000cace
leave
ret
Function at 0x10009a8d
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
or ebx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push edi
mov edi, eax
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x10009beb
test edi, edi
je 0x10009beb
cmp dword [ebp + 0xc], esi
je 0x10009beb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x10009aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push 0x10004100
call fcn.10009770
pop ecx
pop ecx
jmp 0x10009bfa
push 0xa
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x10009b21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push edi
push 0x10004178
call fcn.10009770
add esp, 0xc
jmp 0x10009bfa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10009b44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push edi
push 0x100041f0
jmp 0x10009b14
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x10009b69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push edi
push 0x10004268
jmp 0x10009b14
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
jne 0x10009ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push dword [ebp + 0xc]
push 0x100042e0
jmp 0x10009b14
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10009bee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
push 0x10004350
call fcn.10009770
add esp, 0x14
jmp 0x10009bee
push 0x57
pop esi
cmp ebx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
je 0x10009bfa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1000a09b
Capabilities:
Delete service
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0xf003f
push esi
push 0x10004b60
mov ebx, esi
push 0x80000002
mov dword [ebp - 4], esi
mov edi, esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000a16a
cmp dword [ebp - 4], ebx
je 0x1000a190
push esi
push esi
push esi
push esi
push 0x10004bb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000a16a
push 0xf0000
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1000a111
push 0x10004be0
call fcn.10009770
jmp 0x1000a169
push 0x10000
mov ebx, 0x10004c50
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x1000a130
push 0x10004c60
jmp 0x1000a10a
mov ecx, ebx
call fcn.1000a19c
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1000a159
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
je 0x1000a159
push 0x10004cd8
jmp 0x1000a10a
push 0x10004d48
call fcn.10009770
xor eax, eax
inc eax
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 4], 0
je 0x1000a179
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x1000a186
push esi
call ebx
test edi, edi
je 0x1000a18d
push edi
call ebx
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000a9bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
mov edi, ecx
call fcn.1000b60f
mov ebx, eax
test ebx, ebx
je 0x1000a9fe
push ebx
call fcn.10009788
push eax
push 0x100052d8
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000aaba
push 1
push 0
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], esi
test esi, esi
jne 0x1000aa35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10005368
mov esi, eax
call fcn.10009770
pop ecx
mov eax, esi
jmp 0x1000aabc
push 0xf
lea eax, [ebp - 0x24]
push eax
push 0x64
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1000aa57
push edi
lea edx, [ebp - 0x24]
call fcn.1000a502
mov ebx, eax
test ebx, ebx
je 0x1000aab3
push 0xa
push 0x10005400
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x1000aa91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.10009788
push eax
push 0x10005400
push 0x10005420
push 0x10005438
call fcn.10009770
add esp, 0x10
jmp 0x1000aa2e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000aa69
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1000aa69
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cace
leave
ret
Function at 0x1000aad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], ecx
test esi, esi
je 0x1000ac67
push ebx
push edi
lea edi, [esi + 4]
push 0x14
lea ebx, [ebp - 0x2c]
mov dword [esi], ecx
mov dword [edi], ecx
mov dword [esi + 8], ecx
call fcn.1000b534
test eax, eax
jne 0x1000ac65
mov ebx, 0x100054a4
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x10004408
push 0x100054bc
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push 0x100
push eax
call fcn.100078f5
add esp, 0x18
test eax, eax
jns 0x1000ab5b
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x10004408
push 0x100054d0
call fcn.10009770
add esp, 0x10
jmp 0x1000ac65
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
push 1
xor ebx, ebx
push ebx
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ac45
cmp dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], ebx
je 0x1000ac45
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
push esi
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x100055f4
push dword [ebp - 0x230]
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 4
call ebx
test eax, eax
je 0x1000abca
push 0x10005610
call fcn.10009770
and dword [esi], 0
jmp 0x1000ac4f
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
push edi
push 0
push 0
push 0x100056a4
push dword [ebp - 0x230]
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 4
call ebx
test eax, eax
je 0x1000ac03
push 0x100056c0
call fcn.10009770
and dword [esi], 0
and dword [edi], 0
jmp 0x1000ac4f
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
lea ebx, [esi + 8]
push ebx
push 0
push 0
push 0x10005754
push dword [ebp - 0x230]
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000ac50
push 0x10005770
call fcn.10009770
xor eax, eax
mov dword [esi], eax
mov dword [edi], eax
mov dword [ebx], eax
jmp 0x1000ac4f
push 0x10005568
call fcn.10009770
pop ecx
cmp dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 0
je 0x1000ac65
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000cace
leave
ret
Function at 0x1000afcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 0
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x1000b0f9
xor eax, eax
mov word [ebx], ax
push edi
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
call fcn.10009c08
test eax, eax
jne 0x1000b026
push 0x57
pop esi
push edi
push esi
call fcn.10009788
push eax
push 0x10005ee0
call fcn.10009770
add esp, 0xc
jmp 0x1000b0e2
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
lea eax, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push eax
push 0
push 0x10005f94
push dword [ebp - 0x210]
mov dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x1000b06d
push edi
push esi
call fcn.10009788
push eax
push 0x10005fa8
jmp 0x1000b019
mov eax, dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex]
cmp eax, 0x104
jbe 0x1000b07f
push 0x57
pop esi
jmp 0x1000b0e2
shr eax, 1
dec eax
mov edi, eax
jmp 0x1000b09b
movzx ecx, word [ebp + eax*2 - 0x20c]
cmp ecx, 0x2e
jne 0x1000b095
mov edi, eax
cmp ecx, 0x5c
je 0x1000b0a1
dec eax
test eax, eax
jg 0x1000b086
jmp 0x1000b0e2
inc eax
cmp eax, edi
jle 0x1000b0aa
push 0xd
jmp 0x1000b07c
sub edi, eax
lea ecx, reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
lea eax, [ecx + eax*2]
push eax
push 0x64
mov eax, edi
pop edx
mov ecx, ebx
call fcn.1000a436
test eax, eax
jns 0x1000b0dc
push 0x6f
pop esi
push 0x55c
push 0x10003ea0
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000b0e2
xor eax, eax
mov word [ebx + edi*2], ax
cmp dword [ebp - reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], 0
je 0x1000b10f
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000b10f
push 0x57
pop esi
push esi
call fcn.10009788
push eax
push 0x10005e70
call fcn.10009770
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000cace
leave
ret
Function at 0x1000b534
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor eax, eax
push edi
mov dword [ebp - 8], 1
mov word [ebx], ax
call fcn.1000ade7
mov edi, eax
test edi, edi
jne 0x1000b561
push 0x10006230
call fcn.10009770
pop ecx
jmp 0x1000b5d7
mov ecx, dword [ebp + 8]
lea esi, [ebp - 4]
call fcn.1000958f
mov esi, eax
test esi, esi
jns 0x1000b57f
push 0x10006270
call fcn.10009770
pop ecx
jmp 0x1000b5be
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push 0x100062bc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x1000b5c2
push 0x100062d0
call fcn.10009770
pop ecx
push 0x10
push 0x10006318
push 1
push 0
push 0x100062bc
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
jmp 0x1000b5d5
push 3
push 0x100058fc
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x1000b5f7
mov esi, 0x10006318
push esi
push 0x10006328
call fcn.10009770
mov eax, dword [ebp + 8]
pop ecx
mov edx, esi
pop ecx
mov esi, ebx
call fcn.10007bed
mov esi, eax
test edi, edi
je 0x1000b602
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x1000b6c9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
and dword [ebp - 0x28], esi
lea ebx, [ebp - 0x24]
mov dword [ebp - 0x2c], edi
call fcn.10007e4a
test eax, eax
je 0x1000b70c
push eax
call fcn.10009788
push eax
push 0x100063d8
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000b7bb
call fcn.1000ade7
mov esi, eax
test esi, esi
je 0x1000b7bb
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x10006478
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000b7a3
cmp dword [ebp - 0x28], ebx
je 0x1000b7a3
push 0x1e
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x1000b785
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x2c]
push 0x10006538
call fcn.10009770
add esp, 0xc
push edi
call fcn.10009788
push eax
push 0x100065c8
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000b7d3
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
je 0x1000b7bb
push eax
call fcn.10009788
push eax
push 0x10006638
jmp 0x1000b700
push eax
call fcn.10009788
push eax
lea eax, [ebp - 0x24]
push eax
push 0x10006498
call fcn.10009770
add esp, 0xc
cmp dword [ebp - 0x28], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1000b7cc
push dword [ebp - 0x28]
call edi
test esi, esi
je 0x1000b7d3
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cace
leave
ret
Function at 0x1000b7e7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.10009c08
test eax, eax
jne 0x1000b824
push esi
push 0x100066c0
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000b8b4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov esi, 0x10006748
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000b89f
cmp dword [ebp - 0x28], ebx
je 0x1000b89f
lea ebx, [ebp - 0x24]
call fcn.10007e4a
test eax, eax
je 0x1000b867
push eax
call fcn.10009788
push eax
push 0x100067e8
jmp 0x1000b818
push 0x1e
lea eax, [ebp - 0x24]
push eax
push 1
push 0
mov esi, 0x10002174
push esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000b8b4
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.10009788
push eax
push esi
push 0x10006860
call fcn.10009770
add esp, 0x10
jmp 0x1000b8b4
push esi
push eax
call fcn.10009788
push eax
push 0x10006768
call fcn.10009770
add esp, 0xc
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1000b8c5
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x28], 0
je 0x1000b8d0
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cace
leave
ret

Function at 0x1000ba77
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x10006ba8
push 0x80000002
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1000bb42
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
mov ebx, 0x10006a40
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x1000bb41
cmp esi, 0xea
je 0x1000bb3f
xor eax, eax
inc eax
push 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 3
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x1000bb1b
push esi
call fcn.10009788
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
push 0x10006c08
call fcn.10009770
add esp, 0x14
jmp 0x1000bb41
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, eax
test esi, esi
je 0x1000bb41
push esi
call fcn.10009788
push eax
push 0x10006cf0
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000bb41
mov esi, edi
pop ebx
cmp dword [ebp - 4], edi
je 0x1000bb50
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret