joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100085d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
call sym.CIMIO_NO_WRITE.dll_GetIp21RegSamViewFlag
mov dword [ebp - 0x168], eax
cmp dword [ebp + 8], 0
jne 0x100085fb
xor eax, eax
jmp 0x1000871d
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x168]
or ecx, 1
push ecx
push 0
push str.SOFTWAREAspenTechInfoPlus.21CurrentVersion
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x10008634
xor eax, eax
jmp 0x1000871d
mov dword [ebp - 0x164], 0x50
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x1005d9d0
mov ecx, dword [ebp - 0x158]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x10008682
mov edx, dword [ebp - 0x158]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000871d
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x160], ecx
cmp dword [ebp - 0x160], 0x50
jae 0x100086a6
jmp 0x100086ab
call fcn.10059a86
mov edx, dword [ebp - 0x160]
mov byte [ebp + edx - 0x54], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x54]
push ecx
push str.SOFTWAREAspenTechInfoPlus.21_sgroup200RunningTasks_s
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x168]
or ecx, 1
push ecx
push 0
lea edx, [ebp - 0x154]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x1000870b
xor eax, eax
jmp 0x1000871d
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret

Function at 0x10008730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sym.CIMIO_NO_WRITE.dll_GetCimioRegSamViewFlag
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
or ecx, 1
push ecx
push 0
push 0x1005da64
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100087cb
mov dword [ebp - 0x14], 4
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push str.CIMIORescanLogicalDevices
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x100087c5
cmp dword [ebp - 0x18], 4
jne 0x100087c5
cmp dword [ebp - 0x1c], 0
je 0x100087b7
mov dword [ebp - 0xc], 1
jmp 0x100087be
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x100087cd
xor eax, eax
jmp 0x100087cd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call sym.CIMIO_NO_WRITE.dll_CIMIO_IsWow64
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x1000a6bc
cmp dword [ebp + 8], 0
je 0x1000a6bc
mov dword [ebp - 0xc], 0x100
cmp dword [ebp - 8], 1
jne 0x1000a6cf
cmp dword [ebp + 8], 0
jne 0x1000a6cf
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
or edx, 0x20019
push edx
push 0
push str.SOFTWAREAspentechInfoplus.21CurrentVersion
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000a703
jmp 0x1000a742
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push str.INFOPLUS21_VERSION
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000a732
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000a742
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x1000a750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x118], eax
push str.SOFTWAREAspentechInfoplus.21
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCR120.dll_strcpy
add esp, 8
push 0x1005dd58
lea edx, [ebp - 0x104]
push edx
call sub.MSVCR120.dll_strcat
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCR120.dll_strcat
add esp, 8
call sym.CIMIO_NO_WRITE.dll_CIMIO_IsWow64
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jne 0x1000a7f3
cmp dword [ebp + 8], 0
je 0x1000a7f3
mov dword [ebp - 0x110], 0x100
cmp dword [ebp - 0x10c], 1
jne 0x1000a80c
cmp dword [ebp + 8], 0
jne 0x1000a80c
mov dword [ebp - 0x110], 0x200
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x110]
or eax, 0x20019
push eax
push 0
lea ecx, [ebp - 0x104]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000a83b
jmp 0x1000a88c
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push str.INFOPLUS21_BASE
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000a876
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000a88c
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret
Function at 0x1000a8a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
push str.SOFTWAREAspentechInfoplus.21
lea eax, [ebp - 0x104]
push eax
call sub.MSVCR120.dll_strcpy
add esp, 8
push 0x1005de18
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCR120.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x104]
push eax
call sub.MSVCR120.dll_strcat
add esp, 8
push 0x1005de1c
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCR120.dll_strcat
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x104]
push eax
call sub.MSVCR120.dll_strcat
add esp, 8
push 0x1005de20
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCR120.dll_strcat
add esp, 8
push 0x1005de24
lea edx, [ebp - 0x104]
push edx
call sub.MSVCR120.dll_strcat
add esp, 8
call sym.CIMIO_NO_WRITE.dll_CIMIO_IsWow64
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jne 0x1000a989
cmp dword [ebp + 8], 0
je 0x1000a989
mov dword [ebp - 0x160], 0x100
cmp dword [ebp - 0x164], 1
jne 0x1000a9a2
cmp dword [ebp + 8], 0
jne 0x1000a9a2
mov dword [ebp - 0x160], 0x200
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x160]
or ecx, 0x20019
push ecx
push 0
lea edx, [ebp - 0x104]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000a9d8
jmp 0x1000aa60
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x15c], 0
jmp 0x1000a9fd
mov eax, dword [ebp - 0x15c]
add eax, 1
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x16c], 0
jne 0x1000aa47
mov dword [ebp - 0x174], 0x50
lea ecx, [ebp - 0x17c]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x16c], eax
jmp 0x1000a9ee
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret
Function at 0x10014b00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
ja 0x10014b42
mov eax, 0x80004005
jmp 0x10014cce
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10014b62
mov eax, 0x8007000e
jmp 0x10014cce
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10014b90
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x105b7588
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x1006492c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x10014bc1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, 0x80004005
jmp 0x10014cce
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
je 0x10014be3
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
cmp dword [ebp - 4], 0x7f
jle 0x10014bf0
mov dword [ebp - 4], 0x7f
mov ecx, dword [ebp - 4]
shl ecx, 0x18
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x10014c1f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0xff
jle 0x10014c2f
mov dword [ebp - 4], 0xff
mov edx, dword [ebp - 4]
shl edx, 0x10
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
je 0x10014c64
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
cmp dword [ebp - 4], 0xff
jle 0x10014c74
mov dword [ebp - 4], 0xff
mov eax, dword [ebp - 4]
shl eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
or ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x18], 0
je 0x10014ca5
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
mov dword [edx], eax
cmp dword [ebp - 4], 0xff
jle 0x10014cb5
mov dword [ebp - 4], 0xff
mov ecx, dword [ebp - 8]
or ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10018920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], reloc.WSOCK32.dll_bind
mov dword [ebp - 8], 0
call sym.CIMIO_NO_WRITE.dll_GetCimioRegSamViewFlag
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
or ecx, 1
push ecx
push 0
push 0x10064d80
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001896a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10018999
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push str.CIMIOQueueLimit
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10021730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc88
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc6c], 0
mov dword [ebp - 0xc68], 0
call sym.CIMIO_NO_WRITE.dll_GetCimioRegSamViewFlag
mov dword [ebp - 0xc80], eax
lea eax, [ebp - 0xc64]
push eax
call sym.CIMIO_NO_WRITE.dll_CIMIO_CLIENT_INITBLK
add esp, 4
push str.SoftwareAspenTechCIM_IO
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 8
lea edx, [ebp - 0xc70]
push edx
mov eax, dword [ebp - 0xc80]
or eax, 0x20019
push eax
push 0
lea ecx, [ebp - 0x20c]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0xc6c], 0
je 0x1002180c
cmp dword [ebp - 0xc6c], 2
je 0x10021801
lea edx, [ebp - 0x20c]
push edx
push str.Opening
push str.ReadExtendAsciiValueOption__Error__s_key__s__n
lea eax, [ebp - 0xc14]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0xc64]
push ecx
lea edx, [ebp - 0xc14]
push edx
push 0x10070158
call fcn.1002f2b0
add esp, 0xc
mov eax, dword [ebp - 0xc68]
jmp 0x10021936
mov dword [ebp - 0xc84], 4
mov dword [ebp - 0xc78], 0
push str.ExtendAsciiValuePrintOption
lea eax, [ebp - 0x414]
push eax
call sub.MSVCR120.dll_strcpy
add esp, 8
lea ecx, [ebp - 0xc84]
push ecx
lea edx, [ebp - 0xc78]
push edx
lea eax, [ebp - 0xc88]
push eax
push 0
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp - 0xc70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0xc6c], 0
jne 0x1002189e
cmp dword [ebp - 0xc78], 0
jle 0x10021883
mov dword [ebp - 0xc74], 1
jmp 0x1002188d
mov dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc68], eax
jmp 0x10021923
cmp dword [ebp - 0xc68], 0
jle 0x100218b3
mov dword [ebp - 0xc7c], 0x10068684
jmp 0x100218bd
mov dword [ebp - 0xc7c], 0x100686f0
mov ecx, dword [ebp - 0xc7c]
push ecx
mov edx, dword [ebp - 0xc68]
push edx
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.Querying
push str.ReadExtendAsciiValueOption___s_value__s_s___assuming____d_s__n
lea edx, [ebp - 0xc14]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 0xc64]
push eax
lea ecx, [ebp - 0xc14]
push ecx
push 0x10070158
call fcn.1002f2b0
add esp, 0xc
mov edx, dword [ebp - 0xc70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc68]
jmp 0x10021936
mov eax, dword [ebp - 0xc70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc68]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret
Function at 0x1002f4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], reloc.WSOCK32.dll_bind
call sym.CIMIO_NO_WRITE.dll_GetCimioRegSamViewFlag
mov dword [ebp - 8], eax
call fcn.10030820
mov dword [0x1006a664], 0
cmp dword [0x1006a668], 0
jne 0x1002f532
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
or ecx, 1
push ecx
push 0
push 0x10069fc8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1002f4f9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002f532
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push str.CIMIODebugTraceLevel
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002f528
mov ecx, dword [ebp - 0x14]
mov dword [0x1006a664], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10030820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], reloc.WSOCK32.dll_bind
call sym.CIMIO_NO_WRITE.dll_GetCimioRegSamViewFlag
mov dword [ebp - 8], eax
cmp dword [0x1006a668], 0
jge 0x100308c4
mov dword [0x1006a668], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
or ecx, 1
push ecx
push 0
push 0x10069f94
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10030878
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100308b1
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push str.DisableCIMIODebugTrace
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100308a7
mov ecx, dword [ebp - 0x14]
mov dword [0x1006a668], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1006a668], 0
je 0x100308c4
mov dword [0x1006a668], 1
mov esp, ebp
pop ebp
ret
Function at 0x10030cb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x4a4], 0x400
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x498], eax
push 0x25
mov ecx, dword [ebp - 0x498]
push ecx
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
je 0x10030d35
push 0x25
mov edx, dword [ebp - 0x494]
add edx, 1
push edx
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x494], 0
je 0x10030ed0
cmp dword [ebp - 0x49c], 0
je 0x10030ed0
mov eax, dword [ebp - 0x494]
sub eax, dword [ebp - 0x498]
test eax, eax
jle 0x10030d93
mov ecx, dword [ebp - 0x494]
sub ecx, dword [ebp - 0x498]
push ecx
mov edx, dword [ebp - 0x498]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR120.dll_strncat]
add esp, 0xc
mov ecx, dword [ebp - 0x494]
sub ecx, dword [ebp - 0x498]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0x49c]
sub eax, dword [ebp - 0x494]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x494]
add ecx, 1
push ecx
lea edx, [ebp - 0x8c]
push edx
call dword [sym.imp.MSVCR120.dll_strncpy]
add esp, 0xc
mov eax, dword [ebp - 0x49c]
sub eax, dword [ebp - 0x494]
sub eax, 1
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0x85
jae 0x10030de0
jmp 0x10030de5
call fcn.10059a86
mov ecx, dword [ebp - 0x4a0]
mov byte [ebp + ecx - 0x8c], 0
lea edx, [ebp - 0x8c]
push edx
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
jne 0x10030e5e
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.libc21.dll_c21_getenv]
add esp, 4
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
jne 0x10030e5e
lea ecx, [ebp - 0x4a4]
push ecx
lea edx, [ebp - 0x490]
push edx
lea eax, [ebp - 0x8c]
push eax
call sym.CIMIO_NO_WRITE.dll_GetCimioVar
add esp, 0xc
test eax, eax
je 0x10030e5e
lea ecx, [ebp - 0x490]
mov dword [ebp - 0x494], ecx
cmp dword [ebp - 0x494], 0
je 0x10030e7c
mov edx, dword [ebp - 0x494]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR120.dll_strcat
add esp, 8
jmp 0x10030e80
xor al, al
jmp 0x10030ee5
mov ecx, dword [ebp - 0x49c]
add ecx, 1
mov dword [ebp - 0x498], ecx
push 0x25
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
je 0x10030ecb
push 0x25
mov eax, dword [ebp - 0x494]
add eax, 1
push eax
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
mov dword [ebp - 0x49c], eax
jmp 0x10030d35
mov ecx, dword [ebp - 0x498]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR120.dll_strcat
add esp, 8
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret
Function at 0x10031790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov eax, dword [0x1059c8e4]
mov dword [ebp - 0x44], eax
mov ecx, 6
mov esi, 0x1006b760
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, dword [str.ASPENCOMMON64]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x1006b780]
mov dword [ebp - 0x10], edx
mov eax, dword [0x1006b784]
mov dword [ebp - 0xc], eax
mov cx, word [0x1006b788]
mov word [ebp - 8], cx
mov edx, dword [str.ASPENCOMMON]
mov dword [ebp - 0x20], edx
mov eax, dword [0x1006b790]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x1006b794]
mov dword [ebp - 0x18], ecx
cmp dword [0x1006b74c], 0
je 0x100318d0
mov dword [0x1006b74c], 0
call sym.CIMIO_NO_WRITE.dll_is64BitApp
test eax, eax
je 0x1003182e
mov dword [ebp - 0x48], 0x200
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x48]
or eax, 0x20019
push eax
push 0
lea ecx, [ebp - 0x3c]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x1059c8e4], eax
cmp dword [0x1059c8e4], 0
jne 0x100318c6
mov dword [0x1059c5cc], 0x104
push 0x1059c5cc
push 0x1059c7e0
lea edx, [ebp - 0x4c]
push edx
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x1059c6d4], eax
cmp dword [0x1059c6d4], 0
je 0x10031899
cmp dword [0x1059c6d4], 2
jne 0x100318c6
mov dword [0x1059c4c4], 0x104
push 0x1059c4c4
push 0x1059c6d8
lea edx, [ebp - 0x4c]
push edx
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x1059c7dc], eax
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1059c8e4], 0
jne 0x10031967
cmp dword [0x1059c7dc], 0
jne 0x10031923
cmp dword [0x1059c4c4], 0
jbe 0x10031923
mov eax, dword [0x1059c4c4]
add eax, 1
cmp dword [ebp + 8], eax
jl 0x1003191a
push 0x1059c6d8
mov ecx, dword [0x1059c4c4]
add ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR120.dll_strcpy_s]
add esp, 0xc
jmp 0x10031923
mov dword [ebp - 0x44], 8
jmp 0x10031967
cmp dword [0x1059c6d4], 0
jne 0x10031967
cmp dword [0x1059c5cc], 0
jbe 0x10031967
mov eax, dword [0x1059c5cc]
add eax, 1
cmp dword [ebp + 8], eax
jl 0x10031960
push 0x1059c7e0
mov ecx, dword [0x1059c5cc]
add ecx, 1
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.MSVCR120.dll_strcpy_s]
add esp, 0xc
jmp 0x10031967
mov dword [ebp - 0x44], 8
mov eax, dword [ebp - 0x44]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret
Function at 0x10031a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], reloc.WSOCK32.dll_bind
call sym.CIMIO_NO_WRITE.dll_GetCimioRegSamViewFlag
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
or ecx, 1
push ecx
push 0
push 0x1006b034
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10031ac3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10031b16
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10031af4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10031b16
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003d7b0
add esp, 0x10
mov esp, ebp
pop ebp
ret