joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007c70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4c4], edi
test esi, esi
je 0x10007dcf
test edi, edi
je 0x10007dcf
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10007d82
xor ebx, ebx
cmp word [ebp - 0x4bc], bx
je 0x10007d82
lea esi, [ebp - 0x4bc]
xor edi, edi
jmp 0x10007ce0
push 0x100307dc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10007d5a
push 0x100307e4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10007d5a
mov cx, word [esi]
mov dx, word [ebp + edi - 0x4ba]
mov word [ebp - 0xc], cx
push 0x64
lea ecx, [ebp - 0xd4]
mov word [ebp - 0xa], dx
push ecx
lea edx, [ebp - 0xc]
xor eax, eax
push edx
mov word [ebp - 8], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10007d8a
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp - 0x4c0]
mov esi, eax
push esi
lea ecx, [ebp - 0xd4]
push ecx
push edi
call fcn.100138ed
add esp, 0xc
test eax, eax
je 0x10007d9d
add ebx, 4
lea edi, [ebx + ebx]
cmp word [ebp + edi - 0x4bc], 0
lea esi, [ebp + edi - 0x4bc]
jne 0x10007ce0
mov edi, dword [ebp - 0x4c4]
mov esi, dword [ebp - 0x4c0]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x4c4]
lea edx, [ebp - 0xc]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + esi*2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10012a2e
mov esp, ebp
pop ebp
ret

Function at 0x10007df0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test esi, esi
jne 0x10007e1a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
push edi
xor ecx, ecx
push eax
push ecx
push 0x400
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10007e51
push 0x104
lea edx, [ebp - 0x20c]
push edx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x10007e62
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.10007c70
push edi
test eax, eax
je 0x10007e4b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop edi
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x1000aa40
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x1003d9d0]
push 0x104
lea eax, [ebp - 0x414]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push str._s_d.bak
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 4
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x1000b750
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a948
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
push eax
push 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000b7fd
push 0x200
call fcn.10013162
push 0x200
mov esi, eax
push 0
push esi
call fcn.10015af0
push 0x10030a5c
lea ecx, [esi + 2]
push 0xff
push ecx
mov byte [esi], 1
call fcn.100132f2
add esp, 0x1c
cmp dword [ebx + 8], 0
jne 0x1000b7ef
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x200
push esi
call eax
push esi
call fcn.10012a23
add esp, 4
jmp 0x1000b8a3
push 0x228
lea ecx, [ebp - 0x254]
push 0
push ecx
call fcn.10015af0
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
push esi
mov dword [ebp - 0x258], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000b8a3
nop
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x234]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000b866
test dx, dx
je 0x1000b862
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000b866
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000b840
xor eax, eax
jmp 0x1000b86b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000b883
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000b830
jmp 0x1000b8a3
cmp dword [ebx + 8], 0
mov byte [ebp - 0x259], 2
jne 0x1000b8a3
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 1
lea eax, [ebp - 0x259]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b8c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x230
call fcn.10013162
add esp, 4
push 0x230
xor esi, esi
mov ebx, eax
push esi
push ebx
call fcn.10015af0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov byte [ebx], 0
mov dword [ebp - 0x18], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0x14]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
push edx
lea edx, [ebx + 2]
push 0x10030460
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x1000b949
push 0xfa
lea ecx, [ebx + 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push esi
push esi
push 1
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.1000ba30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x1000ba12
cmp byte [ebp + 0xc], 0
je 0x1000ba12
add eax, 0x230
push eax
mov dword [ebp - 0x14], eax
call fcn.10010c34
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebx + 0x214], ecx
mov edi, eax
mov dword [ebx + 0x218], edx
mov edx, dword [ebp - 0x10]
mov ecx, 0x8c
mov esi, ebx
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
push ecx
mov dword [ebp + 0xc], eax
push edx
add eax, 0x230
push eax
call fcn.10015250
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 8], 0
jne 0x1000b9e0
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
call eax
mov esi, dword [ebp + 0xc]
push ebx
call fcn.10012a23
mov eax, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x1000b9fc
push eax
call fcn.10013545
add esp, 4
test esi, esi
je 0x1000ba09
push esi
call fcn.10013545
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
cmp dword [eax + 8], esi
jne 0x1000b9e3
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x230
push ebx
call eax
jmp 0x1000b9e3
Function at 0x1000c040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov ecx, 0xb6
mov esi, ebx
lea edi, [ebp - 0x5b0]
push 0x2ce
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x2d6]
push ecx
mov word [ebp - 0x2d8], ax
call fcn.10015af0
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x3a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000c0be
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 0x5b4]
push eax
add ecx, 0xfffffd28
push ecx
add ebx, 0x2d8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000c0a9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x5a8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000c120
lea eax, [ebp - 0x5a8]
push eax
lea ecx, [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x2d8]
push str._s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x1000c134
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x5ac]
sub eax, 0
je 0x1000c145
dec eax
jne 0x1000c152
push eax
jmp 0x1000c147
push 5
lea edi, [ebp - 0x2d8]
call fcn.1000c170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c170
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa68
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.10015af0
push 0x2e
push edi
call fcn.100141fb
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1000c1bb
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x41a]
push edx
mov word [ebp - 0x41c], cx
call fcn.10015af0
push 0x20
push esi
call fcn.100141fb
add esp, 0x14
push esi
test eax, eax
je 0x1000c20f
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
test eax, eax
jle 0x1000c22b
cmp word [esi + eax*2], 0x20
je 0x1000c1ff
dec eax
test eax, eax
jg 0x1000c1f1
jmp 0x1000c22b
push eax
push esi
push 0x104
lea eax, [ebp - 0x41c]
push eax
jmp 0x1000c223
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
call fcn.100136b4
add esp, 0x10
push 1
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x41c]
call fcn.1000c3b0
test eax, eax
je 0x1000c1a8
push 0x3e8
lea edx, [ebp - 0xa0c]
push 0
push edx
call fcn.10015af0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xa0c]
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
lea edx, [ebp - 0x214]
push 0
push edx
call fcn.10015af0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x622]
push ecx
mov word [ebp - 0x624], ax
call fcn.10015af0
add esp, 0x30
push 2
lea edx, [ebp - 0x624]
lea ecx, [ebp - 0xa0c]
call fcn.1000c3b0
test eax, eax
je 0x1000c1a8
push 0x104
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x214]
push 0x10030aa0
push ecx
call fcn.10013aef
add esp, 8
test eax, eax
jne 0x1000c327
lea edx, [ebp - 0x214]
push 0x10030aa8
push edx
call fcn.10013aef
add esp, 8
test eax, eax
jne 0x1000c327
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100303e0
lea eax, [ebp - 0x214]
push eax
call esi
push edi
lea ecx, [ebp - 0x214]
push ecx
call esi
jmp 0x1000c32f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40
lea edx, [ebp - 0xa50]
push 0
push edx
call fcn.10015af0
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 0xa54], 0x44
je 0x1000c35e
mov dword [ebp - 0xa4c], str.WinSta0Default
jmp 0x1000c371
xor eax, eax
mov dword [ebp - 0xa28], 1
mov word [ebp - 0xa24], ax
lea ecx, [ebp - 0xa64]
push ecx
lea edx, [ebp - 0xa54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop esi
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10032bf0
push 0x1001b7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100357ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10015af0
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.10015af0
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c458
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x1000c465.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x1000c465.5
jmp dword [eax*4 + 0x1000c608]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x1000c52a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.1001429e
push ebx
push 0x100303e0
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1001429e
add esp, 0x20
push 0
push esi
call fcn.10013ec4
add esp, 8
lea esi, [eax + 2]
jmp 0x1000c4e7
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x100302e4
jmp 0x1000c5aa
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000c5ee
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10032bf0
push 0x1001b7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100357ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10015af0
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.10015af0
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c458
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x1000c465.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x1000c465.5
jmp dword [eax*4 + 0x1000c608]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x1000c52a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.1001429e
push ebx
push 0x100303e0
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1001429e
add esp, 0x20
push 0
push esi
call fcn.10013ec4
add esp, 8
lea esi, [eax + 2]
jmp 0x1000c4e7
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x100302e4
jmp 0x1000c5aa
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000c5ee
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c53a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10032bf0
push 0x1001b7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100357ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10015af0
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.10015af0
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c458
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x1000c465.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x1000c465.5
jmp dword [eax*4 + 0x1000c608]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x1000c52a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.1001429e
push ebx
push 0x100303e0
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1001429e
add esp, 0x20
push 0
push esi
call fcn.10013ec4
add esp, 8
lea esi, [eax + 2]
jmp 0x1000c4e7
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x100302e4
jmp 0x1000c5aa
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000c5ee
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 4