joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014cb40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x101c1b88]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.1011e8d0
add esp, 0xc
mov dword [ebp - 0x114], 0
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x114], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xffff
movzx eax, ax
and eax, 0xff
movzx ecx, al
cmp ecx, 6
jb 0x1014ccc6
call fcn.10154b60
test eax, eax
je 0x1014ccc6
push 0x101c7cb8
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
push edx
call fcn.1014e560
add esp, 0xc
test eax, eax
je 0x1014ccc6
mov dword [ebp - 0x52c], 0
xor eax, eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
mov word [ebp - 0x520], 0
push 0x406
push 0
lea ecx, [ebp - 0x51e]
push ecx
call fcn.1011e8d0
add esp, 0xc
push 0xc
lea edx, [ebp - 0x52c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1014ccc6
push 0x101c7cc4
push 0x101c7cdc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0
je 0x1014ccc6
push 0
push 0x408
lea ecx, [ebp - 0x520]
push ecx
push 2
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x530]
push 0x101c7ce8
movzx eax, word [ebp - 0x520]
shr eax, 1
push eax
mov ecx, dword [ebp - 0x51c]
push ecx
call fcn.1014e410
add esp, 0xc
test eax, eax
je 0x1014ccc6
push 0x101c7cfc
push 0x101c7d08
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
push edx
call fcn.1014ec80
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1014cce1
cmp dword [ebp - 0x114], 0x104
jae 0x1014cce1
cmp dword [ebp - 0x114], 4
jae 0x1014cce8
xor eax, eax
jmp 0x1014cd80
mov eax, dword [ebp - 0x114]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x1014ccff
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x1014cd7d
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x110]
cmp eax, 0x5c
je 0x1014cd25
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x110]
cmp edx, 0x2f
jne 0x1014cd78
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1011c900
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
cmp dword [ebp - 4], 2
jne 0x1014cd76
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 1]
cmp edx, 0x3a
jne 0x1014cd76
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0x5c
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov byte [ecx + 1], 0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x1014cd7d
jmp 0x1014ccf6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1011a380
mov esp, ebp
pop ebp
ret
Function at 0x1014cd90
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x101c1b88]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.1011e8d0
add esp, 0xc
mov byte [ebp - 0x468], 0
push 0x103
push 0
lea ecx, [ebp - 0x467]
push ecx
call fcn.1011e8d0
add esp, 0xc
mov byte [ebp - 0x360], 0
push 0x103
push 0
lea edx, [ebp - 0x35f]
push edx
call fcn.1011e8d0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.1014e1e0
add esp, 0xc
push 0x101c7f80
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.1014e0f0
add esp, 0xc
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0xffffffff
jne 0x1014ce7a
xor eax, eax
jmp 0x1014cfcf
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1014cfa4
lea edx, [ebp - 0x22c]
push edx
push 0x101c7f84
call fcn.1011e950
add esp, 8
test eax, eax
je 0x1014cf9f
lea eax, [ebp - 0x22c]
push eax
push 0x101c7f88
call fcn.1011e950
add esp, 8
test eax, eax
je 0x1014cf9f
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x468]
push edx
call fcn.1014e1e0
add esp, 0xc
push 0x101c7f8c
push 0x104
lea eax, [ebp - 0x468]
push eax
call fcn.1014e0f0
add esp, 0xc
lea ecx, [ebp - 0x22c]
push ecx
push 0x104
lea edx, [ebp - 0x468]
push edx
call fcn.1014e0f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x360]
push ecx
call fcn.1014e1e0
add esp, 0xc
push 0x101c7f90
push 0x104
lea edx, [ebp - 0x360]
push edx
call fcn.1014e0f0
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push 0x104
lea ecx, [ebp - 0x360]
push ecx
call fcn.1014e0f0
add esp, 0xc
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x1014cf89
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x468]
push ecx
call fcn.1014cd90
add esp, 8
jmp 0x1014cf9f
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x468]
push eax
call fcn.1014c9a0
add esp, 8
jmp 0x1014ce7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x114], 0x12
je 0x1014cfca
xor eax, eax
jmp 0x1014cfcf
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a380
mov esp, ebp
pop ebp
ret
Function at 0x1014cfe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0x20019
cmp dword [ebp + 0x14], 0
je 0x1014d013
mov eax, dword [ebp - 4]
or eax, 0x100
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1014d070
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1014d066
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1014d072
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1014d080
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1014d0e6
xor eax, eax
jmp 0x1014d1df
cmp dword [ebp + 0xc], 0xffffffff
je 0x1014d0f2
cmp dword [ebp + 0x10], 0
jne 0x1014d0fa
mov eax, dword [ebp - 0x1c]
jmp 0x1014d1df
cmp dword [ebp - 0x1c], 0
je 0x1014d1dc
mov dword [ebp - 0x14], pe_nt_image_headers32
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1014d1d8
cmp dword [ebp + 0x18], 0
je 0x1014d1c8
cmp dword [ebp - 4], 4
jne 0x1014d194
mov dword [ebp - 0xc], 4
cmp dword [ebp + 0x1c], 0
je 0x1014d15d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
jmp 0x1014d163
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x20]
push eax
push 0x101c823c
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.1011a63e
add esp, 0xc
jmp 0x1014d1c8
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x1c], 0
je 0x1014d1a8
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
jmp 0x1014d1ae
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp + 0x18]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp + 0x14], 0
je 0x1014d1d6
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x1014d1dc
xor eax, eax
jmp 0x1014d1df
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1014d1f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1014d23c
xor eax, eax
jmp 0x1014d276
cmp dword [ebp - 8], 0
je 0x1014d273
cmp dword [ebp + 0x10], 0
je 0x1014d273
push 0
push 0
push 0
push 0
lea eax, [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1014d273
xor eax, eax
jmp 0x1014d276
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1014d370
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x1014d394
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1014d39b
xor eax, eax
jmp 0x1014d41c
cmp dword [ebp + 0xc], 0
je 0x1014d3fa
mov dword [ebp - 4], 0xf003f
cmp dword [ebp + 0x14], 0
je 0x1014d3ba
mov edx, dword [ebp - 4]
or edx, 0x100
mov dword [ebp - 4], edx
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1014d3f8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call fcn.1014d2d0
add esp, 4
jmp 0x1014d40b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1014d41a
mov eax, 1
jmp 0x1014d41c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1014d420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x1014d44f
xor eax, eax
jmp 0x1014d526
mov dword [ebp - 4], 0x20019
cmp dword [ebp + 0x20], 0
je 0x1014d467
mov eax, dword [ebp - 4]
or eax, 0x100
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x1014d495
lea ecx, [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1014d495
xor eax, eax
jmp 0x1014d526
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1014d4b8
jmp 0x1014d511
cmp dword [ebp + 0x14], 0
je 0x1014d4c4
cmp dword [ebp + 0x18], 0
jne 0x1014d4c9
mov eax, dword [ebp - 8]
jmp 0x1014d526
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jbe 0x1014d4d9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
jmp 0x1014d4df
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1014d511
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x1014d523
mov edx, dword [ebp + 8]
push edx
call fcn.1014d2d0
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1014d530
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x1014d545
xor eax, eax
jmp 0x1014d5b9
cmp dword [ebp + 0xc], 0
je 0x1014d58d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1014d280
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x1014d58b
push 4
lea edx, [ebp + 0x14]
push edx
push 4
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
call fcn.1014d2d0
add esp, 4
jmp 0x1014d5a8
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1014d5b7
mov eax, 1
jmp 0x1014d5b9
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1014d5c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x1014d5e0
cmp dword [ebp + 0x14], 0
jne 0x1014d5e7
xor eax, eax
jmp 0x1014d697
cmp dword [ebp + 0x1c], 0xffffffff
jne 0x1014d5ff
mov eax, dword [ebp + 0x14]
push eax
call fcn.1011e3a0
add esp, 4
add eax, 1
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0xc], 0
je 0x1014d65d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1014d280
add esp, 8
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x1014d65b
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
push edx
call fcn.1014d2d0
add esp, 4
jmp 0x1014d67c
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1014d68b
mov eax, 1
jmp 0x1014d697
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1014d6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x1014d6c2
or eax, 0xffffffff
jmp 0x1014d74c
cmp dword [ebp + 0xc], 0
je 0x1014d721
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1014d71f
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.1014d2d0
add esp, 4
jmp 0x1014d73c
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1014d749
mov eax, dword [ebp - 4]
jmp 0x1014d74c
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x1014d750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
jne 0x1014d778
xor eax, eax
jmp 0x1014d862
cmp dword [ebp + 0xc], 0
je 0x1014d7a7
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1014d7a7
xor eax, eax
jmp 0x1014d862
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1014d7cd
jmp 0x1014d84d
cmp dword [ebp + 0x14], 0
jne 0x1014d7de
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1014d84d
mov ecx, dword [ebp + 0x18]
sub ecx, 1
cmp dword [ebp - 4], ecx
jbe 0x1014d7f4
mov edx, dword [ebp + 0x18]
sub edx, 1
mov dword [ebp - 0x10], edx
jmp 0x1014d7fa
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xea
jne 0x1014d840
cmp dword [ebp + 0xc], 0
je 0x1014d838
mov eax, dword [ebp + 8]
push eax
call fcn.1014d2d0
add esp, 4
mov eax, dword [ebp + 0x18]
sub eax, 1
jmp 0x1014d862
cmp dword [ebp - 8], 0
je 0x1014d84d
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x1014d85f
mov ecx, dword [ebp + 8]
push ecx
call fcn.1014d2d0
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1014d870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], 0
jne 0x1014d899
or eax, 0xffffffff
jmp 0x1014d927
cmp dword [ebp + 0xc], 0
je 0x1014d8fa
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1014d8f8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1014d2d0
add esp, 4
jmp 0x1014d917
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1014d924
mov eax, dword [ebp - 4]
jmp 0x1014d927
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x1014d930
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], 0
jne 0x1014d945
xor eax, eax
jmp 0x1014d9a5
cmp dword [ebp + 0xc], 0
je 0x1014d983
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1014d330
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x1014d981
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1014d2d0
add esp, 4
jmp 0x1014d994
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1014d9a3
mov eax, 1
jmp 0x1014d9a5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1014d9b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x101c1b88]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.1011e8d0
add esp, 0xc
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1014d330
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1014dad7
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.1014d1f0
add esp, 0x10
test eax, eax
jbe 0x1014da7c
lea edx, [ebp - 0x110]
test edx, edx
je 0x1014da64
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1014d9b0
add esp, 8
push pe_nt_image_headers32
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.1011e8d0
add esp, 0xc
jmp 0x1014da29
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x114], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x114], 0
jne 0x1014daba
mov edx, dword [ebp - 8]
push edx
call fcn.1014d2d0
add esp, 4
mov eax, 1
jmp 0x1014dad9
mov eax, dword [ebp - 8]
push eax
call fcn.1014d2d0
add esp, 4
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1014dad9
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1011a380
mov esp, ebp
pop ebp
ret
Function at 0x1014daf0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x101c1b88]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x810], 0
push 0x7ff
push 0
lea eax, [ebp - 0x80f]
push eax
call fcn.1011e8d0
add esp, 0xc
mov dword [ebp - 8], 0x800
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.1014d6a0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x1014db5a
cmp dword [ebp - 4], 0xffffffff
je 0x1014db5a
xor eax, eax
jmp 0x1014dbd8
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.1014d6a0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1014db79
xor eax, eax
jmp 0x1014dbd8
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1014dba5
xor eax, eax
jmp 0x1014dbd8
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1014dbd6
mov eax, 1
jmp 0x1014dbd8
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011a380
mov esp, ebp
pop ebp
ret