joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008dd7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
xor esi, esi
dec eax
je 0x1008e18
dec eax
dec eax
je 0x1008e0a
dec eax
jne 0x1008e55
lea eax, [ebp + 8]
push eax
push 1
push esi
push 0x1001ef0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008e55
inc esi
jmp 0x1008e4c
lea eax, [ebp + 8]
push eax
push 1
push esi
push 0x1001f18
jmp 0x1008e24
lea eax, [ebp + 8]
push eax
push 1
push esi
push 0x1001fbc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008e55
push esi
push esi
push esi
push esi
push 0x10023a4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1008eb6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1016c8c]
dec eax
je 0x1008ed2
dec eax
je 0x1008ecc
xor eax, eax
pop ebp
ret 4
pop ebp
jmp fcn.01008e61
pop ebp
jmp fcn.01008dd7

Function at 0x1008edd
Capabilities:
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
mov eax, dword [0x1016c8c]
dec eax
push ebx
je 0x1008f11
dec eax
jne 0x1008fdf
mov dword [ebp - 0x124], 0x10059d4
mov ebx, 0x100239c
jmp 0x1008f20
mov dword [ebp - 0x124], 0x10059ac
mov ebx, 0x1005a34
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push edi
push dword [0x1016be4]
mov edi, 0x104
push 0x10169d8
push 0x100594c
lea eax, [ebp - 0x11c]
push edi
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x11c]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x10051e4
push ebx
push 0x10058c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp - 0x124]
mov ebx, eax
push 0x1005388
push 0x1002474
lea eax, [ebp - 0x11c]
push edi
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x120]
push eax
push 2
push 0
lea eax, [ebp - 0x11c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
pop esi
jne 0x1008fd3
inc ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push 0x100239c
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008fdf
push 1
push 0x10014f0
call fcn.0100cbb8
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100d038
leave
ret
Function at 0x100a239
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x10055a0
mov esi, 0x80000002
push esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, 0x10055c4
jne 0x100a2b1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a2a8
cmp dword [ebp - 0x14], 4
jne 0x100a2a8
mov eax, dword [ebp - 8]
and al, 3
xor cl, cl
cmp cl, al
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [0x1016be0]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a307
cmp dword [ebp - 0xc], edi
je 0x100a2f4
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100a2fe
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a547
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
mov eax, dword [0x1016c8c]
dec eax
push ebx
push edi
je 0x100a577
dec eax
jne 0x100a743
mov dword [ebp - 0x118], 0x10059d4
jmp 0x100a581
mov dword [ebp - 0x118], 0x10059ac
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x100a704
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x124]
push eax
push 0x20019
push esi
mov edi, 0x1005388
push edi
push 0x80000002
call ebx
test eax, eax
jne 0x100a742
lea eax, [ebp - 0x120]
push eax
push 1
push esi
push dword [ebp - 0x118]
push dword [ebp - 0x124]
call ebx
test eax, eax
jne 0x100a6fc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
mov ebx, 0x20006
push ebx
push esi
push esi
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x80000001
call edi
test eax, eax
jne 0x100a6f0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x11c]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp - 0x118]
push dword [ebp - 0x110]
call edi
test eax, eax
jne 0x100a6e4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
mov ebx, 0x100239c
push ebx
push dword [ebp - 0x120]
mov dword [ebp - 0x114], 0x104
call edi
test eax, eax
jne 0x100a685
push dword [ebp - 0x114]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
push esi
push ebx
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
mov ebx, 0x1005600
push ebx
push dword [ebp - 0x120]
mov dword [ebp - 0x114], 0x104
call edi
test eax, eax
jne 0x100a6d8
push dword [ebp - 0x114]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
push esi
push ebx
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x124]
jmp 0x100a73c
lea eax, [ebp - 0x110]
push eax
push 0x2001f
push esi
push 0x1005388
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a742
push dword [ebp - 0x118]
push dword [ebp - 0x110]
call fcn.0100b1e1
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0100d038
leave
ret 4
Function at 0x100a756
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push dword [0x1016be0]
mov dword [ebp - 8], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a7a8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x10055e8
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], esi
pop esi
setne al
leave
ret

Function at 0x100aa00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [0x1016c8c]
dec eax
je 0x100aa12
dec eax
je 0x100aa0e
xor eax, eax
ret
xor eax, eax
inc eax
ret
jmp fcn.0100a7b8

Function at 0x100aa1c
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101203c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.0100aa00
push dword [0x1016be4]
mov edi, 0x10169d8
push edi
push 0x100594c
mov ebx, 0x104
lea eax, [ebp - 0x210]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push dword [0x1016be4]
push 0x10056d4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100aa81
call fcn.010069e3
test eax, eax
mov eax, 0x10057e0
jne 0x100aa86
mov eax, 0x10057d0
xor esi, esi
push esi
push 5
push esi
push 0x10167d0
push edi
push eax
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x1016c94]
push 1
call fcn.010086cf
call fcn.010069e3
test eax, eax
je 0x100ab17
push ebx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
mov dword [ebp - 0x214], esi
call fcn.01007e4e
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x105
sub ecx, eax
push ecx
push 0x1001da8
lea eax, [ebp + eax - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0xa
push esi
push 0x1001d90
lea eax, [ebp - 0x10c]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d038
leave
ret

Function at 0x100ad0b
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100ad69
lea eax, [ebp - 0x10]
push eax
push 0x1005b24
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100ad69
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x100ad74
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x100ad91
push 4
push 0x40
push 0x3fd
push 0
call fcn.0100cc57
jmp 0x100ad94
push 6
pop eax
cmp eax, 6
jne 0x100adb3
cmp dword [0x1016bf8], 1
jne 0x100adae
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x100adb3
call fcn.0100ad0b
pop ebp
ret 4
Function at 0x100b1e1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
lea eax, [ebp - 4]
push eax
push 9
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100b216
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x100b2d6
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x100b25c
cmp eax, 0xea
je 0x100b25c
cmp eax, 0x7a
je 0x100b25c
mov esi, eax
jmp 0x100b271
mov eax, dword [ebp - 0xc]
inc eax
push eax
lea eax, [ebp - 8]
push eax
call fcn.010068d5
test eax, eax
jne 0x100b27e
push 8
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100b2d5
xor esi, esi
mov eax, dword [ebp - 0xc]
inc eax
push eax
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100b2a5
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0100b1e1
test eax, eax
je 0x100b2a6
inc esi
cmp eax, 0x103
je 0x100b2b2
cmp esi, dword [ebp - 0x14]
jb 0x100b280
mov eax, dword [0x1016cb0]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
leave
ret 8
Function at 0x100b7ff
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x101203c]
push ebx
push edi
push 0xc
pop ecx
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0x38], bl
lea edi, [ebp - 0x37]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x3c]
push eax
push 3
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100b8bc
cmp dword [0x1016c80], ebx
push esi
mov dword [ebp - 0x40], 0x32
mov esi, 0x10051a8
mov edi, 0x1004fb0
jne 0x100b880
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x38]
push eax
jmp 0x100b88a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push 0x1004fa0
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0100d038
leave
ret

Function at 0x100ba76
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101203c]
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1005578
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bb14
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push 0x100239c
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x14
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100bb0b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
mov word [ebp - 0xc], 5
mov word [ebp - 0xa], si
mov word [ebp - 8], si
mov word [ebp - 6], si
call fcn.0100c560
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0100c33b
mov edi, eax
cmp edi, esi
jne 0x100bb0b
push 1
push 0x1005c5c
call fcn.0100cbb8
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0100d038
leave
ret
Function at 0x100bcaf
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101203c]
push ebx
push esi
push edi
push 2
pop edi
cmp dword [0x1016bf8], edi
mov esi, 0x104
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push esi
jne 0x100bcf0
push 0x1005afc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x21c], edi
jmp 0x100bd01
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x21c], 1
xor eax, eax
xor edi, edi
cmp dword [ebp + 8], edi
setne al
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1005b14
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp + 8], edi
mov eax, 0x1002464
jne 0x100bd39
mov eax, 0x100244c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x100be97
push esi
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
add eax, 0x40d
push eax
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push edi
push edi
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x1005af0
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 2
call esi
push 1
push 0x1002574
push 1
push edi
push 0x1005ae0
push dword [ebp - 0x210]
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1005ad4
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100be36
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002251
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100be8b
cmp dword [ebp + 8], edi
je 0x100be6c
push 0x2e
push 0x1005a78
jmp 0x100be73
push 0x2c
push 0x1005aa8
push 1
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d038
leave
ret 4

Function at 0x100bf7c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [0x1016c8c]
dec eax
dec eax
jne 0x100bf8a
jmp fcn.0100bb27
ret
Function at 0x100c180
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x101203c]
mov ecx, dword [ebp + 0xc]
push esi
lea edx, [ebp - 0x118]
push edx
push 0x2000000
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x124], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 0x120], eax
jne 0x100c2b2
push ebx
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push esi
push dword [ebp - 0x118]
mov ebx, 0x105
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, esi
mov dword [ebp - 0x120], eax
jne 0x100c23e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x100c219
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x118]
call fcn.0100c180
push dword [ebp - 0x110]
dec dword [ebp - 0x114]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x118]
call edi
test eax, eax
je 0x100c207
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x124], esi
je 0x100c26c
push dword [ebp - 0x124]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x120], eax
jmp 0x100c2b0
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x100c28b
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x100c2b0
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x11c]
mov dword [ebp - 0x110], ebx
call edi
test eax, eax
je 0x100c274
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x120]
pop esi
call fcn.0100d038
leave
ret 8

Function at 0x100c2ca
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x1016bf8], 2
jne 0x100c32f
mov eax, dword [0x1012030]
cmp eax, 0xffffffff
jne 0x100c306
push 0x1005d58
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100c2ff
push 0x1005d3c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x100c301
xor eax, eax
mov dword [0x1012030], eax
test eax, eax
je 0x100c30d
pop ebp
jmp eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ebp
ret 8
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
Function at 0x100c38d
Capabilities:
Query environment variable
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x21c]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1005494
push 0x80000002
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c502
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x10054e0
push dword [ebp - 0x21c]
mov esi, 0x104
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100c4f5
cmp dword [ebp - 0x220], 2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
jne 0x100c465
push 0x41
pop ecx
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
jmp 0x100c46e
mov eax, dword [ebp - 0x210]
sub eax, 5
mov ecx, esi
sub ecx, eax
push ecx
mov dword [ebp - 0x210], eax
push 0x10058e0
lea eax, [ebp + eax - 0x20c]
push eax
call ebx
xor edi, edi
inc edi
cmp dword [0x1016bf8], edi
pop ebx
jne 0x100c4a9
push dword [ebp + 0xc]
push dword [ebp - 0x214]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x108]
push eax
push 0x1002574
push dword [ebp - 0x214]
push 0x10058d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, edi
jbe 0x100c4f5
push 0x1005a2c
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x106], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x100c4f5
mov dword [ebp - 0x218], edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
call fcn.0100d038
leave
ret 8
Function at 0x100c5bb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101203c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
push eax
push 1
xor ebx, ebx
push ebx
push dword [0x1016be0]
mov dword [ebp - 0x28], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c65a
push edi
push 0x14
cmp esi, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop edi
je 0x100c628
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x1004fa0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], edi
call esi
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
call fcn.0100c560
cmp dword [ebp - 0x24], ebx
je 0x100c650
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x1004fb0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], edi
call esi
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push eax
call fcn.0100c560
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100d038
leave
ret 8

Function at 0x100c6c3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c71e
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 4
push esi
push esi
push 0x1004fa8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 4