joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000dc80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
lea ecx, [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x23c]
push edi
push 0xa
mov dword [esp + 0x14], eax
xor edi, edi
mov eax, dword [esp + 0x240]
push ecx
push eax
call fcn.1000fe20
test eax, eax
mov ebx, 0xffffb15a
push 5
lea eax, [esp + 0x18]
cmovs edi, ebx
push eax
push esi
call fcn.1000fe20
test eax, eax
lea eax, [esp + 0x28]
push eax
push 0x104
cmovs edi, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1000dcf7
mov edi, ebx
jmp 0x1000de43
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ecx]
call ebp
mov ebx, eax
mov ecx, 0x104
lea eax, [esp + 0x28]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x1000dde0
inc eax
dec ecx
jne 0x1000dd10
xor esi, esi
mov ecx, 0xa
lea eax, [esp + 0x1c]
jmp 0x1000dd30
cmp byte [eax], 0
je 0x1000ddf4
inc eax
dec ecx
jne 0x1000dd30
xor edx, edx
mov ecx, 5
lea eax, [esp + 0x14]
jmp 0x1000dd50
cmp byte [eax], 0
je 0x1000de08
inc eax
dec ecx
jne 0x1000dd50
xor eax, eax
add eax, 0xb
add eax, edx
add eax, esi
cmp eax, 0x104
ja 0x1000de3e
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
push 0x100018f8
lea eax, [esp + 0x140]
push 0x104
push eax
call fcn.1000dc10
add esp, 0x1c
lea eax, [esp + 0x12c]
push 0
push 0x10110080
push 1
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1000dd00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000de1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000de1c
mov eax, 0xffffb15a
jmp 0x1000de45
test ecx, ecx
je 0x1000dd1d
mov esi, 0x104
sub esi, ecx
jmp 0x1000dd1f
test ecx, ecx
je 0x1000dd3d
mov edx, 0xa
sub edx, ecx
jmp 0x1000dd3f
test ecx, ecx
je 0x1000dd5d
mov eax, 5
sub eax, ecx
jmp 0x1000dd5f
push 0x104
push dword [esp + 0x14]
lea eax, [esp + 0x134]
push eax
call fcn.1000fc70
test eax, eax
mov eax, 0xffffb15a
cmovs edi, eax
jmp 0x1000de43
mov edi, 0xffffb15a
mov eax, edi
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007d8c1
add esp, 0x224
ret 0xc
Function at 0x1000e310
Capabilities:
Copy file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x1000e363
push dword [esp + 0x43c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x42c
ret 0xc
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.1000e080
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1000e080
push dword [esp + 0x43c]
push dword [esp + 0xc]
push dword [esp + 0x224]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1000e3e3
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000e3e3
cmp dword [esp + 4], 0xffffffff
je 0x1000e3e3
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x1000e419
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000e419
cmp dword [esp + 0x218], 0xffffffff
je 0x1000e419
push ecx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x42c
ret 0xc

Function at 0x1000e530
Capabilities:
Delete file

Disassembly:
sub esp, 0x218
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x21c]
je 0x1000e572
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1000e080
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1000e5c0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000e5c0
cmp dword [esp + 4], 0xffffffff
je 0x1000e5c0
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 4
Function at 0x1000e6f0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x220]
push edi
mov edi, dword [esp + 0x228]
je 0x1000e73c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
pop edi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x21c
ret 8
push esi
push dword [edi]
lea ecx, [esp + 0xc]
push eax
call fcn.1000de70
push edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 8]
mov esi, eax
call fcn.1000e010
test eax, eax
jle 0x1000e764
dec eax
lea ecx, [esp + 8]
mov dword [edi], eax
call fcn.1000e010
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
cmp ecx, eax
je 0x1000e794
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000e794
cmp dword [esp + 8], 0xffffffff
je 0x1000e794
push ecx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x220]
mov eax, esi
pop esi
pop edi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x21c
ret 8

Function at 0x1000e7b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x218
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x21c]
je 0x1000e7f2
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1000e080
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1000e840
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000e840
cmp dword [esp + 4], 0xffffffff
je 0x1000e840
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 4

Function at 0x1000e860
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x21c]
je 0x1000e8a2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1000e080
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1000e8f0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000e8f0
cmp dword [esp + 4], 0xffffffff
je 0x1000e8f0
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 4
Function at 0x1000ebe0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x644
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x640], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x648]
push esi
mov esi, dword [esp + 0x650]
push edi
mov edi, dword [esp + 0x65c]
je 0x1000ec29
push edi
push dword [esp + 0x65c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1000ed3f
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x224]
mov dword [esp + 0x224], 0
mov dword [esp + 0x228], 0
call fcn.1000e080
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.1000e080
push 0x104
push edi
lea ecx, [esp + 0x438]
call fcn.1000de70
push dword [esp + 0x434]
push dword [esp + 0x65c]
push dword [esp + 0x14]
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x430]
mov esi, eax
call fcn.1000e010
mov eax, dword [esp + 0x434]
lea ecx, [esp + 0x438]
cmp eax, ecx
je 0x1000ecd7
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000ecd7
cmp dword [esp + 0x430], 0xffffffff
je 0x1000ecd7
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp + 0x434], 0
cmp ecx, eax
je 0x1000ed07
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000ed07
cmp dword [esp + 8], 0xffffffff
je 0x1000ed07
push ecx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x220]
lea eax, [esp + 0x224]
mov dword [esp + 0xc], 0
cmp ecx, eax
je 0x1000ed3d
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000ed3d
cmp dword [esp + 0x21c], 0xffffffff
je 0x1000ed3d
push ecx
call fcn.1007d730
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x648]
pop edi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x644
ret 0x10

Function at 0x1000ed60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x1000edaa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.1000de70
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 4]
call fcn.1000e010
mov esi, eax
test esi, esi
jle 0x1000eddc
dec esi
lea ecx, [esp + 4]
call fcn.1000e010
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x1000ee0a
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000ee0a
cmp dword [esp + 4], 0xffffffff
je 0x1000ee0a
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x21c
ret 8
Function at 0x1000ef10
Capabilities:
Move file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x1000ef5c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x42c
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.1000e080
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1000e080
push dword [esp + 8]
push dword [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1000efd5
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1000efd5
cmp dword [esp + 4], 0xffffffff
je 0x1000efd5
push eax
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x1000f00b
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000f00b
cmp dword [esp + 0x218], 0xffffffff
je 0x1000f00b
push ecx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x42c
ret 8

Function at 0x1000f190
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x218
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x220]
je 0x1000f1dc
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1000e080
push dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 8]
mov esi, eax
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1000f22a
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1000f22a
cmp dword [esp + 4], 0xffffffff
je 0x1000f22a
push edx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x218
ret 8
Function at 0x1000f250
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1008f4a4], 0
mov ecx, dword [esp + 0x22c]
mov eax, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x224]
push ecx
push eax
je 0x1000f2ab
push dword [esp + 0x230]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x21c
ret 0x10
lea ecx, [esp + 0xc]
call fcn.1000de70
mov eax, dword [esp + 0x218]
add eax, eax
push eax
push dword [esp + 0xc]
push dword [esp + 0x230]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.1000e010
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1000f300
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1000f300
cmp dword [esp + 4], 0xffffffff
je 0x1000f300
push edx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x21c
ret 0x10
Function at 0x1000f320
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x444]
mov edx, dword [esp + 0x454]
mov ecx, dword [esp + 0x44c]
push ebx
mov ebx, dword [esp + 0x45c]
push ebp
mov ebp, dword [esp + 0x464]
push esi
mov esi, dword [esp + 0x46c]
push edi
mov edi, dword [esp + 0x460]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
je 0x1000f393
push esi
push ebp
push ebx
push edx
push edi
push ecx
push dword [esp + 0x470]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x1000f4ca
test edi, edi
je 0x1000f39b
mov eax, dword [edi]
jmp 0x1000f39d
xor eax, eax
push eax
push ecx
lea ecx, [esp + 0x23c]
call fcn.1000de70
mov eax, dword [esp + 0x448]
add eax, eax
shr eax, 1
mov dword [esp + 0x18], eax
test esi, esi
je 0x1000f3c2
mov eax, dword [esi]
jmp 0x1000f3c4
xor eax, eax
push eax
push ebp
lea ecx, [esp + 0x24]
call fcn.1000de70
push esi
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push ebx
push dword [esp + 0x20]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x470]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1000f456
test edi, edi
je 0x1000f415
lea ecx, [esp + 0x234]
call fcn.1000e010
test eax, eax
jle 0x1000f413
dec eax
mov dword [edi], eax
test ebx, ebx
je 0x1000f447
test esi, esi
je 0x1000f447
mov eax, dword [ebx]
cmp eax, 2
je 0x1000f42e
cmp eax, 1
je 0x1000f42e
cmp eax, 7
jne 0x1000f447
cmp dword [esp + 0x20], 0
mov eax, dword [esi]
je 0x1000f441
push eax
lea ecx, [esp + 0x20]
call fcn.1000dfb0
add eax, eax
mov dword [esi], eax
jmp 0x1000f456
push dword [esi]
push ebp
push dword [esp + 0x28]
call fcn.1007d9f0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.1000e010
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
cmp ecx, eax
je 0x1000f484
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000f484
cmp dword [esp + 0x1c], 0xffffffff
je 0x1000f484
push ecx
call fcn.1007d730
add esp, 4
lea ecx, [esp + 0x234]
mov dword [esp + 0x20], 0
call fcn.1000e010
mov ecx, dword [esp + 0x238]
lea eax, [esp + 0x23c]
cmp ecx, eax
je 0x1000f4c6
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000f4c6
cmp dword [esp + 0x234], 0xffffffff
je 0x1000f4c6
push ecx
call fcn.1007d730
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007d8c1
add esp, 0x440
ret 0x20
Function at 0x1000f5c0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x234
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x230], eax
cmp dword [0x1008f4a4], 0
mov ecx, dword [esp + 0x24c]
mov edx, dword [esp + 0x250]
mov eax, dword [esp + 0x23c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x254]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x258]
push ebx
mov ebx, dword [esp + 0x248]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x260]
push ebp
mov ebp, dword [esp + 0x250]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x244]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x270]
push edi
mov edi, dword [esp + 0x250]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], edx
je 0x1000f678
push dword [esp + 0x20]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push dword [esp + 0x24]
push edx
push ecx
push ebp
push ebx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1000f6e7
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.1000e080
push dword [esp + 0x20]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x3c]
push dword [esp + 0x34]
push ebp
push ebx
push edi
push dword [esp + 0x58]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edx, dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x34]
cmp edx, eax
je 0x1000f6e5
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1000f6e5
cmp dword [esp + 0x2c], 0xffffffff
je 0x1000f6e5
push edx
call fcn.1007d730
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007d8c1
add esp, 0x234
ret 0x30
Function at 0x1000f710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x450]
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x448]
push ebx
mov ebx, dword [esp + 0x448]
push ebp
mov ebp, dword [esp + 0x454]
push esi
mov esi, dword [esp + 0x464]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x1000f776
push esi
push ecx
push eax
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
jmp 0x1000f90f
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x240]
mov dword [esp + 0x240], 0
mov dword [esp + 0x244], 0
call fcn.1000e080
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x24c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x1000f8e1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1000f8c6
cmp eax, 2
jbe 0x1000f848
cmp eax, 7
jne 0x1000f8c6
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.1000de70
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x1000f835
lea ecx, [esp + 0x20]
call fcn.1000def0
jmp 0x1000f8e1
cmp dword [esp + 0x24], 0
je 0x1000f8b6
push ecx
lea ecx, [esp + 0x24]
call fcn.1000dfb0
jmp 0x1000f8b0
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.1000de70
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x1000f8a0
lea ecx, [esp + 0x20]
call fcn.1000def0
jmp 0x1000f8e1
cmp dword [esp + 0x24], 0
je 0x1000f8b6
lea ecx, [esp + 0x20]
call fcn.1000e010
mov ecx, eax
mov dword [esp + 0x10], ecx
lea eax, [ecx + ecx]
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.1000def0
jmp 0x1000f8e1
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov edi, eax
mov ecx, dword [esp + 0x23c]
lea eax, [esp + 0x240]
cmp ecx, eax
je 0x1000f90f
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000f90f
cmp dword [esp + 0x238], 0xffffffff
je 0x1000f90f
push ecx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x44c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007d8c1
add esp, 0x440
ret 0x18
Function at 0x1000f930
Capabilities:
Set registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1008f4a4], 0
mov eax, dword [esp + 0x434]
push ebx
mov ebx, dword [esp + 0x434]
push ebp
mov ebp, dword [esp + 0x448]
push edi
mov edi, dword [esp + 0x450]
je 0x1000f989
push edi
push ebp
push dword [esp + 0x450]
push dword [esp + 0x450]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1000fa79
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x22c]
mov dword [esp + 0x22c], 0
mov dword [esp + 0x230], 0
call fcn.1000e080
mov esi, dword [esp + 0x44c]
cmp esi, 1
je 0x1000f9e1
cmp esi, 2
je 0x1000f9e1
cmp esi, 7
je 0x1000f9e1
push edi
push ebp
push esi
push dword [esp + 0x454]
push dword [esp + 0x238]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x1000fa48
shr edi, 1
lea ecx, [esp + 0x10]
push edi
push ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.1000e080
mov eax, dword [esp + 0x220]
inc eax
push eax
push dword [esp + 0x18]
push esi
push dword [esp + 0x454]
push dword [esp + 0x238]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x1000fa48
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000fa48
cmp dword [esp + 0x10], 0xffffffff
je 0x1000fa48
push ecx
call fcn.1007d730
add esp, 4
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x22c]
cmp ecx, eax
je 0x1000fa76
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1000fa76
cmp dword [esp + 0x224], 0xffffffff
je 0x1000fa76
push ecx
call fcn.1007d730
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x434]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007d8c1
add esp, 0x42c
ret 0x18
Function at 0x10018780
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x8ec
mov eax, dword [0x1008e168]
xor eax, esp
mov dword [esp + 0x8e8], eax
mov eax, dword [esp + 0x8f0]
xor ecx, ecx
mov byte [esp], 0
push esi
mov esi, dword [esp + 0x8f8]
mov word [esi], cx
test eax, eax
jne 0x100187ca
xor eax, eax
pop esi
mov ecx, dword [esp + 0x8e8]
xor ecx, esp
call fcn.1007d8c1
add esp, 0x8ec
ret 0xc
push 0x474
lea ecx, [esp + 0x47c]
push ecx
push eax
call fcn.1000fe20
test eax, eax
js 0x100187b2
push 0x474
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100187b0
cmp eax, 0x474
jae 0x10018833
push dword [esp + 0x8fc]
mov byte [esp + eax + 8], 0
lea eax, [esp + 8]
push esi
push eax
call fcn.1000fc70
mov ecx, dword [esp + 0x8ec]
pop esi
xor ecx, esp
call fcn.1007d8c1
add esp, 0x8ec
ret 0xc
call fcn.1007e6f3
int3