joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004093
Capabilities:
Check os version

Disassembly:
push 0xa0
push 0x1004168
call fcn.01004184
mov esi, dword [ebp + 0xc]
mov dword [0x101602c], esi
mov eax, dword [ebp + 8]
mov dword [0x1016020], eax
xor edi, edi
mov dword [ebp - 4], edi
push 0x1016034
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100415d
cmp dword [ebp - 0xac], 6
sbb al, al
inc al
mov byte [section..data], al
call fcn.01009081
mov dword [0x1016024], eax
cmp dword [ebp - 0xa0], 2
jne 0x100413f
mov byte [0x1016001], 1
cmp dword [ebp - 0xac], 5
jb 0x1004121
mov byte [0x1016002], 1
je 0x1004152
cmp dword [ebp - 0xac], 6
jb 0x100413f
cmp esi, 0x7d0
jne 0x1004138
push edi
call fcn.01013156
mov byte [0x1016004], 1
xor eax, eax
cmp dword [0x1016020], edi
setne al
call fcn.010041e5
ret 8
cmp dword [ebp - 0xa8], 1
jb 0x1004121
jmp 0x100412a
xor eax, eax
jmp 0x100414a

Function at 0x1004394
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
push esi
mov dword [eax], ebx
cmp byte [0x1016001], bl
push edi
je 0x1007c61
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x100442b
call fcn.01003e64
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100442b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1004438
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100442b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1007c4a
cmp eax, ebx
jle 0x1004417
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004417
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x100442b
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 8], esp
jne 0x1007c94
mov eax, 0x8007000e
jmp 0x1004417
push ebx
push ebx
push edi
push dword [ebp - 8]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x100442b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x100442b
call fcn.01003e64
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100442b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1005b08
push edi
call sub.VERSION.dll_VerQueryValueA
jmp 0x10043fe
Function at 0x100506d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1016001], bl
push esi
push edi
mov dword [ebp - 8], 4
je 0x1009639
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10096a1
jle 0x10050c3
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0xc
cmp dword [ebp + 0xc], ebx
je 0x1009681
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x1009664
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x10050b7
call fcn.01003e64
mov dword [ebp - 0xc], esp
push ebx
push ebx
push edi
push dword [ebp - 0xc]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x1009657
jmp 0x1009684
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x10050af
cmp dword [ebp - 0x10], 4
jne 0x10096b4
cmp dword [ebp - 8], 4
jne 0x10096b4
xor eax, eax
jmp 0x10050c3
mov eax, 0x80040153
jmp 0x10050c3
Function at 0x10051e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1016001], bl
push esi
push edi
je 0x1009588
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x14]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.0100527f
test eax, eax
jl 0x100955d
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1009567
cmp dword [ebp - 0xc], 1
jne 0x100957c
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x100955d
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0x10
mov eax, 0x80040153
jmp 0x1005266
jle 0x1005266
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005266
cmp dword [ebp - 0xc], 2
je 0x1005254
jmp 0x100955d
cmp dword [ebp + 0xc], ebx
je 0x10095cd
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x10095b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x1009567
call fcn.01003e64
mov dword [ebp - 0x10], esp
push ebx
push ebx
push edi
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10095a6
jmp 0x10095d0
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x14]
inc esi
mov eax, esi
call fcn.01003e64
mov edi, esp
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1009567
cmp dword [ebp - 0xc], 1
je 0x100960e
cmp dword [ebp - 0xc], 2
jne 0x100955d
mov eax, dword [ebp - 8]
cmp byte [edi + eax - 1], bl
jne 0x100955d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1005264
jmp 0x10095a6
Function at 0x100530a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x10053b5
mov ecx, eax
call fcn.010053c1
mov esi, eax
cmp esi, ebx
je 0x1008281
mov eax, dword [ebp + 8]
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x100828b
lea eax, [esi + 0x14]
push eax
push ebx
push esi
push 0x1002293
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x100828b
push 0xff
push 0xffffffffffffffff
push ebx
push dword [esi + 0x1c]
call fcn.0100224c
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
cmp eax, ebx
mov dword [esi + 0x1c], ebx
jg 0x10082a6
mov edi, eax
cmp edi, ebx
jl 0x10053a4
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor esi, esi
xor edi, edi
cmp esi, ebx
jne 0x10082b5
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
xor esi, esi
jmp 0x100532d
mov edi, 0x8007000e
jmp 0x10053ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100829f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10053a4
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005395
push 1
mov ecx, esi
call fcn.0100325a
jmp 0x10053ac

Function at 0x10058f6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [eax], 0
push esi
push 0
lea eax, [ebp - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x1008a65
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100591f
push ebx
sub eax, ecx
push edi
lea edi, [eax + esi + 2]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1008a82
inc esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1008a8c
sub edi, eax
push 0x1005b08
lea esi, [eax + ebx]
push edi
push esi
call fcn.01005b0f
push dword [ebp + 8]
dec edi
push edi
inc esi
push esi
call fcn.01005b0f
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1008a8c
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor esi, esi
test ebx, ebx
je 0x1005991
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1008a76
mov esi, eax
jmp 0x1005993
and eax, 0xffff
or eax, 0x80070000
jmp 0x1008a6f
mov esi, 0x8007000e
jmp 0x1005986
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1008aa0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1005986
Function at 0x1005b5d
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
push esi
mov esi, ecx
je 0x10097e5
push edi
xor edi, edi
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x10097ef
cmp eax, edi
je 0x100980c
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x1009820
push 2
pop ecx
cmp ebx, ecx
jne 0x1005bd7
push 4
pop ecx
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
je 0x1009820
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 8
cmp ebx, 4
jne 0x1009813
jmp 0x1005bb8
mov eax, 0x8000ffff
jmp 0x1005bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1005bd1
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005bd1
xor eax, eax
jmp 0x1005bd1
xor ecx, ecx
cmp ebx, 8
sete cl
jmp 0x1005bb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1005bd0
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005bd0
Function at 0x1009081
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x1016020]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1016024]
test eax, eax
jne 0x1004082
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
mov ecx, esi
and ecx, 0x3ff
movzx eax, cx
cmp ax, 1
je 0x10090c3
cmp ax, 0xd
jne 0x10090dd
cmp dword [0x101602c], 0x7d0
je 0x100407c
mov dword [0x10164c4], 0x180000
cmp byte [section..data], 0
jne 0x100407c
cmp cx, 9
je 0x100407c
push ebx
push edi
push esi
push dword [0x1016020]
call fcn.010130fb
cmp eax, dword [0x1016020]
jne 0x1009112
push eax
call fcn.01013c97
jmp 0x100911a
test eax, eax
jne 0x10092cf
push 5
lea eax, [ebp - 0xc]
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1009137
mov eax, dword [0x1016024]
jmp 0x10092c6
mov esi, 0x104
push esi
lea eax, [ebp - 0x318]
push eax
push 0x3e9
push dword [0x1016020]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x100912d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
mov ebx, 0x10092d8
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0100f269
add esp, 0x14
push esi
lea eax, [ebp - 0x41c]
push eax
push dword [0x1016020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010131cd
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x10092cf
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x10092cf
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jle 0x100924b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
mov byte [ebp - 0xa], 0
call fcn.0100c941
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010131cd
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x10092cf
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x10092cf
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 5
lea ecx, [ebp - 0xc]
push ecx
and eax, 0x3ff
or eax, 0x400
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100912d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0100c941
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010131cd
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x10092cf
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x10092cf
mov eax, dword [0x1016020]
pop edi
pop ebx
jmp 0x1004081
Function at 0x100e723
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100e736
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100e732
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100e757
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100e796
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100e78c
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100e798
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100e77c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100eada
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp byte [0x1016001], bl
push edi
mov dword [ebp - 0x39c], esi
je 0x100eb37
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100ebcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x100ebcf
lea eax, [ebp - 0x394]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x100ebb7
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x100eb64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100ebd4
and eax, 0xffff
or eax, 0x80070000
jmp 0x100ebd4
call fcn.01003e64
mov dword [ebp - 0x398], esp
push ebx
push ebx
push edi
push dword [ebp - 0x398]
push 0xffffffffffffffff
push dword [ebp - 0x39c]
push ebx
push ebx
call esi
test eax, eax
je 0x100eb4e
push dword [ebp - 0x398]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100ebcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x100ebcf
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x398]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, ebx
je 0x100ebcf
cmp eax, 0xffffffff
je 0x100ebcf
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100ebd4
test al, 0x10
je 0x100ebc7
mov eax, 0x80070002
lea esp, [ebp - 0x3a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 4
Function at 0x100f16c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20006
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100f1b9
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x100f1c7
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x100f42a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x43
je 0x100f461
cmp dword [ebp + 8], 0x57
je 0x100f455
mov eax, 0x80070057
jmp 0x100f5ad
mov dword [ebp - 0x214], 0x100f5bc
jmp 0x100f46b
mov dword [ebp - 0x214], 0x100f5c4
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x218], ebx
mov edi, 0x104
push ebx
mov esi, 0x80000000
jmp 0x100f558
cmp eax, ebx
jne 0x100f59e
cmp byte [ebp - 0x108], 0x2e
jne 0x100f53a
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x100f59e
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x10099dc
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], ebx
jne 0x100f53a
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x100f53a
mov byte [ebp + eax - 0x109], bl
push 1
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x214]
call fcn.0100f374
cmp eax, ebx
jl 0x100f5aa
inc dword [ebp - 0x218]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x218]
push esi
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x100f498
mov eax, dword [ebp - 0x214]
push ebx
push 0x100f5cc
call fcn.0100f374
cmp eax, ebx
jl 0x100f5aa
mov eax, dword [ebp - 0x214]
push ebx
push 0x100f5d4
call fcn.0100f374
cmp eax, ebx
jl 0x100f5aa
xor eax, eax
jmp 0x100f5aa
jle 0x100f5aa
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 4
Function at 0x101334f
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1016001], bl
push esi
push edi
je 0x101338b
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1013505
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10133c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1013507
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013507
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 0x18], esp
jne 0x10133da
mov eax, 0x8007000e
jmp 0x1013507
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x10133a7
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10133a7
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 0x14], esp
je 0x10133d0
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x14]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10133a7
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10133a7
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 0x10], esp
je 0x10133d0
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x10133a7
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10134aa
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10133a7
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 0xc], esp
je 0x10133d0
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
test eax, eax
je 0x10133a7
jmp 0x10134c1
push 4
pop eax
call fcn.01003d00
mov eax, esp
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10133d0
mov byte [eax], bl
mov esi, dword [ebp + 0x18]
lea eax, [esi + 1]
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 8], esp
je 0x10133d0
push dword [ebp - 0x18]
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push dword [ebp + 0x14]
push edi
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10133a7
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0x18