joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002cb6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x1002e7a
mov eax, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.msvcrt.dll_calloc]
inc eax
push 1
push eax
call edi
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x1002d03
push 8
pop eax
jmp 0x1002e79
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x1002e79
mov eax, dword [ebp + 0x18]
cmp dword [eax], ebx
jne 0x1002e55
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call esi
test eax, eax
jne 0x1002e55
cmp dword [ebp + 0x14], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ebx
jne 0x1002d52
mov eax, 0x1013ac0
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
add esi, 0x64
push 2
push esi
call edi
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1002d73
xor eax, eax
jmp 0x1002e79
push 2
push esi
call edi
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1002d8e
push ebx
call dword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1002e78
push esi
push edi
push 0x8f
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x1002da9
mov eax, 0x1013ac0
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov edi, dword [sym.imp.msvcrt.dll_free]
call edi
add esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push ebx
push eax
call fcn.010022e2
push dword [sym.imp.msvcrt.dll__iob]
call dword [sym.imp.msvcrt.dll_fgetwc]
add esp, 0xc
mov esi, eax
call dword [sym.imp.msvcrt.dll__flushall]
movzx eax, si
cmp eax, 0x61
je 0x1002df6
cmp eax, 0x6e
je 0x1002df6
cmp eax, 0x79
jne 0x1002dfd
mov dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0
je 0x1002dbe
push ebx
call edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], 0x1001514
push eax
call fcn.010022e2
cmp si, 0x61
pop ecx
pop ecx
je 0x1002e4a
cmp si, 0x41
je 0x1002e4a
cmp si, 0x79
je 0x1002e53
cmp si, 0x59
je 0x1002e53
cmp si, 0x6e
je 0x1002d6c
cmp si, 0x4e
jne 0x1002e53
jmp 0x1002d6c
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
xor ebx, ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
mov eax, esi
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100362e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1008028]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edx, edx
mov dword [ebp - 4], eax
xor eax, eax
cmp ebx, edx
lea edi, [ebp - 0x42]
mov word [ebp - 0x44], dx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 1
stosw word es:[edi], ax
jne 0x1003665
lea ebx, [ebp - 0x44]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x3c]
push eax
push edx
lea eax, [ebp - 0x40]
push eax
push edx
push ebx
push ecx
call esi
test eax, eax
jne 0x10037d9
mov eax, dword [ebp - 0x3c]
and eax, 1
add dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, 2
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x10036a9
push 8
pop eax
jmp 0x10037d9
lea eax, [ebp - 0x3c]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
push 0
push ebx
push dword [ebp - 0x48]
call esi
test eax, eax
je 0x10036c5
mov esi, eax
jmp 0x10037cf
push dword [ebp - 0x40]
lea eax, [ebp - 0x38]
push eax
call fcn.010035a5
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
jne 0x10036e2
mov ebx, 0x1013ac0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
add eax, 0x20
push 0x10015c8
push eax
call fcn.010022e2
mov eax, dword [ebp - 0x40]
add esp, 0x10
test eax, eax
jbe 0x1003790
cmp eax, 2
jbe 0x1003777
cmp eax, 3
jbe 0x1003790
cmp eax, 5
jbe 0x100376e
cmp eax, 7
jne 0x1003790
mov eax, dword [ebp - 0x3c]
add eax, edi
cmp edi, eax
mov esi, edi
jae 0x10037b8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
cmp word [esi], 0
jne 0x100374a
push 0x1001254
push eax
call fcn.010022e2
pop ecx
inc esi
pop ecx
inc esi
jmp 0x1003763
push esi
push 0x100146c
push eax
call fcn.010022e2
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x3c]
add eax, edi
cmp esi, eax
jb 0x100372b
jmp 0x10037b8
push dword [edi]
push 0x10015bc
jmp 0x100377d
push edi
push 0x100146c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call fcn.010022e2
add esp, 0xc
jmp 0x10037b8
xor esi, esi
cmp dword [ebp - 0x3c], esi
jbe 0x10037b8
movzx eax, byte [esi + edi]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x10015b0
push eax
call fcn.010022e2
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x3c]
jb 0x1003797
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x1001514
push eax
call fcn.010022e2
pop ecx
pop ecx
xor esi, esi
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006c92
leave
ret 8
Function at 0x1004185
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1004280
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x10041dd
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100427d
mov eax, dword [ebp - 0x10]
inc dword [ebp - 8]
imul eax, dword [ebp - 8]
push ebx
push edi
push 2
push eax
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
xor ebx, ebx
cmp dword [ebp - 0x10], esi
pop ecx
mov edi, eax
jbe 0x100422a
cmp dword [ebp - 4], esi
jne 0x100422a
mov eax, dword [ebp - 8]
push esi
mov dword [ebp - 4], eax
imul eax, ebx
push esi
push esi
push esi
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + eax*2]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
cmp ebx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jb 0x10041fd
xor ebx, ebx
cmp dword [ebp - 4], esi
jne 0x1004252
cmp ebx, dword [ebp - 0x10]
jae 0x1004252
mov eax, dword [ebp - 8]
imul eax, ebx
lea eax, [edi + eax*2]
push eax
push dword [ebp - 0xc]
call fcn.01004185
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1004252
inc ebx
jmp 0x1004231
cmp edi, esi
je 0x100425e
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
pop edi
pop ebx
jne 0x100427d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x100428a
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x18], edi
mov dword [ebp - 0x10], edi
je 0x10042b5
push dword [esi + 0x1c]
push dword [esi + 0x30]
push 0x10017a0
call fcn.010025f4
test eax, eax
je 0x10042ce
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x10042d5
push dword [esi + 0x1c]
push eax
push 0x1001750
call fcn.010025f4
test eax, eax
jne 0x10042d5
xor eax, eax
jmp 0x10043cd
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push dword [esi + 0x30]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10043cd
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x100430e
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 8], eax
jmp 0x10043c1
cmp dword [esi + 0x18], edi
je 0x10043c1
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10043c1
mov eax, dword [ebp - 0xc]
inc dword [ebp - 8]
imul eax, dword [ebp - 8]
push ebx
push 2
push eax
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
xor ebx, ebx
cmp dword [ebp - 0xc], edi
pop ecx
mov esi, eax
mov dword [ebp - 0x10], edi
jbe 0x100438b
cmp dword [ebp + 8], edi
jne 0x100438b
mov eax, dword [ebp - 8]
push edi
mov dword [ebp - 0x10], eax
imul eax, ebx
push edi
push edi
push edi
lea ecx, [ebp - 0x10]
push ecx
lea eax, [esi + eax*2]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
cmp ebx, dword [ebp - 0xc]
mov dword [ebp + 8], eax
jb 0x100435e
xor ebx, ebx
cmp dword [ebp + 8], edi
jne 0x10043b4
cmp ebx, dword [ebp - 0xc]
jae 0x10043b4
mov eax, dword [ebp - 8]
imul eax, ebx
lea eax, [esi + eax*2]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10043b4
inc ebx
jmp 0x1004392
cmp esi, edi
pop ebx
je 0x10043c1
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 4
Function at 0x100492e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp eax, edi
jne 0x1004a8a
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [ebp + 0x10]
call esi
cmp eax, edi
jne 0x1004a8a
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.msvcrt.dll_calloc]
inc eax
push 1
push eax
call edi
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x18], eax
jne 0x1004998
mov dword [ebp + 8], 8
jmp 0x1004a87
mov eax, dword [ebp - 8]
inc eax
push 1
push eax
call edi
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x10049b5
mov dword [ebp + 8], 8
jmp 0x1004a73
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
push 0
push ebx
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x10049e7
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push dword [ebp + 0x10]
call esi
test eax, eax
mov dword [ebp + 8], eax
je 0x10049fb
push dword [ebp + 0x18]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push edi
call esi
pop ecx
jmp 0x1004a86
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
jne 0x1004a39
cmp esi, dword [ebp - 8]
jne 0x1004a39
push esi
push edi
push dword [ebp + 0x18]
call fcn.010046da
test eax, eax
jne 0x1004a39
cmp dword [ebp + 0x1c], 2
je 0x1004a25
cmp dword [ebp + 0x1c], 3
jne 0x1004a73
push 0
push esi
push dword [ebp + 0x18]
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
call fcn.01004561
jmp 0x1004a73
cmp dword [ebp + 0x1c], 1
je 0x1004a45
cmp dword [ebp + 0x1c], 3
jne 0x1004a69
push 1
push esi
push dword [ebp + 0x18]
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
call fcn.01004561
push 2
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
push ebx
push dword [ebp + 0x14]
call fcn.01004561
mov dword [0x1008040], 1
push dword [ebp + 0x18]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
test edi, edi
pop ecx
je 0x1004a87
push edi
call esi
pop ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10054ff
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push 9
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005534
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x10055ef
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100557a
cmp eax, 0xea
je 0x100557a
cmp eax, 0x7a
je 0x100557a
mov esi, eax
jmp 0x1005593
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x10055a0
push 8
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10055ee
push edi
xor edi, edi
mov eax, dword [ebp - 8]
inc eax
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x10055c4
push esi
push dword [ebp - 4]
call fcn.010054ff
test eax, eax
je 0x10055c5
inc edi
cmp eax, 0x103
je 0x10055d1
cmp edi, dword [ebp - 0x10]
jb 0x10055a3
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
leave
ret 8

Function at 0x1005804
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1008020]
mov ecx, dword [0x1010a88]
xor edx, edx
test eax, eax
setne dl
push esi
mov esi, 0x200
push edi
inc edx
imul edx, ecx
cmp edx, esi
jne 0x10058ce
push 0
cmp eax, 1
lea eax, [ebp - 4]
push eax
push esi
jne 0x1005866
push 0x1010682
push dword [0x1010a84]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100585c
mov dword [0x1010264], 0x82
jmp 0x10058d6
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
jmp 0x1005890
mov edi, 0x1010280
push edi
push dword [0x1010a84]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005850
push esi
push 0x1010682
push dword [ebp - 4]
push edi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [0x1010a94]
mov dword [0x1010a90], eax
mov eax, dword [ebp - 4]
add dword [0x1010a98], eax
xor ecx, ecx
test esi, esi
mov dword [0x1010a88], ecx
je 0x10058be
mov eax, dword [0x1010a98]
xor edx, edx
div esi
cmp eax, 0x64
jbe 0x10058c1
push 0x64
pop eax
cmp dword [0x1010a9c], eax
je 0x10058ce
mov dword [0x1010a9c], eax
cmp ecx, dword [0x1010a90]
jl 0x10058da
xor eax, eax
jmp 0x10058f1
mov ax, word [ecx*2 + 0x1010682]
mov ecx, dword [ebp + 8]
mov word [ecx], ax
inc dword [0x1010a88]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4
Function at 0x1005977
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1010a88]
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x1005a00
cmp dword [0x1010aa0], edi
je 0x10059cd
push esi
push edi
push edi
push 0x402
mov esi, 0x1010280
push esi
push eax
push 0x1010682
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [0x1010a84]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop esi
je 0x10059f6
cmp ebx, dword [ebp - 4]
jmp 0x10059f4
push edi
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push 0x1010682
push dword [0x1010a84]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10059f6
mov eax, dword [0x1010a88]
add eax, eax
cmp eax, dword [ebp - 4]
je 0x1005a00
mov dword [0x1010264], 0x8d
mov dword [0x1010a88], edi
pop edi
pop ebx
leave
ret

Function at 0x1005d45
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1008028]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 2
xor ebx, ebx
push ebx
push ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005d84
mov dword [0x1010264], 0x83
jmp 0x1005ef6
lea eax, [ebp - 0x208]
push eax
call fcn.01005804
test eax, eax
je 0x1005ede
push esi
push edi
dec dword [0x1010a88]
push 0x5c
call fcn.010058fc
test eax, eax
je 0x1005db2
mov esi, 0x10019e8
jmp 0x1005dc0
cmp word [0x10012cc], bx
mov esi, 0x10012cc
je 0x1005dda
xor eax, eax
mov ax, word [esi]
push eax
call fcn.010058fc
inc esi
inc esi
test eax, eax
je 0x1005ec3
cmp word [esi], bx
jne 0x1005dc0
push 0x5c
call fcn.010058fc
mov edi, eax
cmp edi, ebx
je 0x1005ec3
xor esi, esi
jmp 0x1005e16
mov ecx, dword [ebp - 0x208]
cmp cx, 0x20
je 0x1005e2a
push ecx
call fcn.01005954
test eax, eax
jne 0x1005e2a
cmp esi, 0xff
jae 0x1005e28
mov word [ebp + esi*2 - 0x204], cx
inc esi
lea eax, [ebp - 0x208]
push eax
call fcn.01005804
test eax, eax
jne 0x1005def
jmp 0x1005e2a
xor edi, edi
cmp edi, ebx
je 0x1005ec3
mov word [ebp + esi*2 - 0x204], bx
call fcn.01005c76
push 0x3d
call fcn.010058fc
test eax, eax
je 0x1005e51
push 0x20
call fcn.010058fc
xor esi, esi
jmp 0x1005e76
mov ecx, dword [ebp - 0x208]
push ecx
call fcn.01005954
test eax, eax
jne 0x1005e8a
cmp esi, 0x3fff
jae 0x1005e88
mov word [esi*2 + 0x1008260], cx
inc esi
lea eax, [ebp - 0x208]
push eax
call fcn.01005804
test eax, eax
jne 0x1005e55
jmp 0x1005e8a
xor edi, edi
cmp edi, ebx
je 0x1005ec3
lea eax, [esi + esi]
push eax
push 0x1008260
mov word [eax + 0x1008260], bx
push 1
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
je 0x1005ec8
mov dword [0x1010264], 0x84
jmp 0x1005ec8
call fcn.01005ca6
lea eax, [ebp - 0x208]
push eax
call fcn.01005804
test eax, eax
jne 0x1005d9a
pop edi
pop esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01006c92
leave
ret
Function at 0x1006177
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1008028]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], edi
call fcn.01005c76
push 0x22
call fcn.010058fc
xor ebx, ebx
test eax, eax
je 0x10061ea
lea eax, [ebp - 0x108]
push eax
mov esi, 0x1008260
push esi
mov dword [ebp - 0x108], 0x4000
call fcn.01005b20
test eax, eax
je 0x100629e
call fcn.01005c19
test eax, eax
je 0x100629e
xor edi, edi
inc edi
jmp 0x10062e7
push 0x64
call fcn.010058fc
test eax, eax
je 0x100623f
mov esi, 0x1001a6e
xor eax, eax
mov ax, word [esi]
push eax
call fcn.010058fc
inc esi
inc esi
test eax, eax
je 0x100629e
cmp word [esi], bx
jne 0x10061fa
call fcn.01005c76
mov esi, 0x1008260
push esi
call fcn.01005f06
test eax, eax
je 0x100629e
call fcn.01005c19
test eax, eax
je 0x100629e
push 4
pop edi
mov dword [ebp - 0x108], edi
jmp 0x10062e7
push 0x2d
call fcn.010058fc
test eax, eax
je 0x100625d
call fcn.01005c19
test eax, eax
je 0x100629e
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10062a3
mov esi, 0x1001a64
xor eax, eax
mov ax, word [esi]
push eax
call fcn.010058fc
inc esi
inc esi
test eax, eax
je 0x100629e
cmp word [esi], bx
jne 0x1006262
push 0x28
call fcn.010058fc
test eax, eax
je 0x10062b2
lea eax, [ebp - 0x108]
push eax
call fcn.01005f06
test eax, eax
je 0x100629e
push 0x29
call fcn.010058fc
test eax, eax
jne 0x10062b7
call fcn.01005ca6
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006c92
leave
ret 8
push 3
pop edi
jmp 0x10062bd
mov edi, dword [ebp - 0x108]
push 0x3a
call fcn.010058fc
test eax, eax
je 0x100629e
lea eax, [ebp - 0x108]
push eax
mov esi, 0x1008260
push esi
call fcn.0100603f
test eax, eax
je 0x100629e
call fcn.01005c19
test eax, eax
je 0x100629e
cmp dword [0x1010260], 0x500
jae 0x100634e
cmp edi, 2
je 0x10062fd
cmp edi, 7
jne 0x100634e
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10c]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push esi
push edi
push ebx
push eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10062a3
mov dword [0x1010264], 0x84
jmp 0x10062a3
push dword [ebp - 0x108]
push esi
push edi
push ebx
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10062a3
push eax
mov dword [0x1010264], 0x84
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10062a3
Function at 0x1006429
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x5b
call fcn.01005cf1
push dword [ebp + 0xc]
call fcn.01005f82
push 0x1001ac4
call fcn.01005f82
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [ebp - 8]
push ecx
mov esi, 0x1008260
push esi
lea ecx, [ebp - 0x10]
push ecx
xor eax, eax
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edi, 0x1008060
push edi
mov dword [ebp - 4], eax
push eax
jmp 0x10064fe
inc dword [ebp - 4]
cmp dword [ebp - 0xc], 0
je 0x1006488
push edi
call fcn.01005fa9
jmp 0x100648f
push 0x40
call fcn.01005cf1
push 0x3d
call fcn.01005cf1
mov eax, dword [ebp - 0x10]
dec eax
je 0x10064ce
sub eax, 3
jne 0x10064c0
cmp dword [ebp - 8], 4
jne 0x10064c0
push 0x1001a6c
call fcn.01005f82
push 1
push dword [0x1008260]
call fcn.01005ff4
jmp 0x10064d4
push dword [ebp - 8]
push dword [ebp - 0x10]
push esi
call fcn.010060a3
jmp 0x10064d4
push esi
call fcn.01005fa9
push 0xa
call fcn.01005cf1
cmp dword [0x1010264], 0x8d
je 0x10065ca
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push dword [ebp + 8]
mov dword [ebp - 8], 0x4000
mov dword [ebp - 0xc], 0x200
call ebx
test eax, eax
mov dword [ebp - 0x14], eax
je 0x1006477
push 0xa
call fcn.01005cf1
cmp dword [ebp - 0x14], 0x103
je 0x1006536
mov dword [0x1010264], 0x8c
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
lea esi, [esi + eax*2]
mov word [esi], 0x5c
inc esi
inc esi
push esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x100
sub edi, eax
and dword [ebp - 4], 0
push edi
push esi
push 0
jmp 0x10065b0
inc dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
push 9
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10065a1
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.01006429
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1010264], 0x8d
je 0x10065ca
jmp 0x10065ab
mov dword [0x1010264], 0x8b
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x1006566
cmp eax, 0x103
je 0x10065ca
mov dword [0x1010264], 0x8c
pop edi
pop esi
pop ebx
leave
ret 8