joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1028190
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [eax + 0x14]
push 0
push eax
lea ecx, [eax + 0x98]
push ecx
lea edx, [eax + 0xbc]
mov dword [eax + 0x9c], 2
add eax, 0x18
push eax
mov dword [ecx], 0x80
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [edx], 0xf6
mov esi, dword [esi]
push edx
push esi
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x1028253
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3e5
je 0x1028253
test byte [0x103a4fc], 2
je 0x102823e
mov edx, dword [0x103b3fc]
test edx, edx
je 0x102823e
push 0x101a378
call esi
push eax
mov eax, dword [0x103b3fc]
mov ecx, dword [0x103b1e8]
push eax
push 0x80800
push ecx
call fcn.01024ec0
add esp, 0x14
push 0
push 0
push 0xc04e0008
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10286e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
xor esi, esi
push ecx
mov dword [ebp - 0x21c], 0x105
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x218], esi
call sub.instapi.dll_GetVerSpecificRootRegPath
test eax, eax
je 0x1028743
mov word [ebp - 8], si
mov ecx, 0x105
lea eax, [ebp - 0x210]
cmp word [eax], si
je 0x1028780
add eax, 2
sub ecx, 1
jne 0x1028734
jmp 0x10287a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x214]
push edx
push 4
push 0xc04e0001
mov dword [ebp - 0x214], eax
call fcn.010240e0
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret
cmp ecx, esi
je 0x10287a5
mov eax, 0x105
sub eax, ecx
push 0x101d110
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [ebp + eax*2 - 0x210]
push edx
call fcn.0101ed00
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
lea ecx, [ebp - 0x210]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x102882e
lea edx, [ebp - 0x21c]
push edx
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x214]
push ecx
push esi
push ebx
push edx
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x1028807
cmp eax, 0xea
jne 0x102881d
cmp dword [ebp - 0x214], 4
je 0x102881d
push 0x70c
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x102882e
cmp eax, esi
jne 0x102882e
cmp dword [ebp - 0x220], esi
je 0x102882e
mov esi, 1
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01029f27
mov esp, ebp
pop ebp
ret
Function at 0x10289c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call esi
test eax, eax
mov dword [0x103a508], eax
jne 0x1028a34
test byte [0x103a4fc], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1028a18
mov eax, dword [0x103b404]
test eax, eax
je 0x1028a18
call esi
mov ecx, dword [0x103b404]
mov edx, dword [0x103b1f0]
push eax
push ecx
push 0x41800
push edx
call fcn.01024ec0
add esp, 0x10
call esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0xc04e000b
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push 1
push 0
call esi
test eax, eax
mov dword [0x103a50c], eax
jne 0x1028a99
test byte [0x103a4fc], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1028a7d
mov ecx, dword [0x103b408]
test ecx, ecx
je 0x1028a7d
call esi
mov edx, dword [0x103b408]
push eax
mov eax, dword [0x103b1f4]
push edx
push 0x44000
push eax
call fcn.01024ec0
add esp, 0x10
call esi
lea ecx, [ebp - 8]
push ecx
push 4
push 0xc04e000b
mov dword [ebp - 8], eax
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0
call esi
test eax, eax
mov dword [edi + 0x20], eax
je 0x1028aca
lea edx, [ebp - 0xc]
push edx
push 0
push edi
push 0x1028270
push 0
push 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x24], eax
cmp dword [edi + 0x20], 0
je 0x1028ae0
cmp dword [edi + 0x24], 0
je 0x1028ae0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
test byte [0x103a4fc], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1028b16
mov eax, dword [0x103b40c]
test eax, eax
je 0x1028b16
call esi
mov ecx, dword [0x103b40c]
mov edx, dword [0x103b1f8]
push eax
push ecx
push 0x49400
push edx
call fcn.01024ec0
add esp, 0x10
call esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push 0xc04e000b
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1028b40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [edi + 0x34], eax
je 0x1028c26
push 0x94
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x1028be1
mov ecx, dword [edi + 0x34]
push ecx
mov esi, eax
call fcn.01028370
test eax, eax
mov dword [0x103a510], eax
jne 0x1028bed
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [0x103a4fc], 2
je 0x1028bcc
mov edx, dword [0x103b410]
test edx, edx
je 0x1028bcc
cmp dword [0x10390bc], 0xffffffff
je 0x1028bcc
mov eax, dword [0x103b410]
mov ecx, dword [0x103b1fc]
mov edx, dword [0x10390bc]
push 0
push eax
push 0x4ec00
push ecx
push edx
call dword [0x1039080]
push 0
push 0
push 0xc04e0004
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x103a510], 0
jmp 0x1028b87
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1029cf0
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [edi + 0x34]
push 0xffffffffffffffff
mov dword [edi + 0x30], eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [edi + 0x30], 0
jne 0x1028c7e
test byte [0x103a4fc], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1028c62
mov ecx, dword [0x103b414]
test ecx, ecx
je 0x1028c62
call esi
mov edx, dword [0x103b414]
push eax
mov eax, dword [0x103b200]
push edx
push 0x54c00
push eax
call fcn.01024ec0
add esp, 0x10
call esi
lea ecx, [ebp - 8]
push ecx
push 4
push 0xc04e000a
mov dword [ebp - 8], eax
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x404e0010
call fcn.01024160
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1028ca0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 0
push 0
push 0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 0x2c], eax
je 0x1028cf9
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x1027320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0x2c]
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x10]
push edx
push 2
mov dword [esi + 0x28], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [esi + 0x28], 0
jne 0x1028d51
test byte [0x103a4fc], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1028d35
mov eax, dword [0x103b418]
test eax, eax
je 0x1028d35
call esi
mov ecx, dword [0x103b418]
mov edx, dword [0x103b204]
push eax
push ecx
push 0x5d400
push edx
call fcn.01024ec0
add esp, 0x10
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0xc04e0009
call fcn.010240e0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1029f27
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1039004]
jne 0x1029f38
test ecx, 0xffff0000
jne 0x1029f38
ret
jmp fcn.01029f42

Function at 0x102a622
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1037438
call fcn.0102a9b0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x103a538
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x102a3a7
cmp eax, esi
jne 0x102a39a
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x102a3aa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x102a381
xor esi, esi
inc esi
mov eax, dword [0x103a534]
cmp eax, esi
jne 0x102a3bd
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x102a3f8
mov eax, dword [0x103a534]
test eax, eax
jne 0x102a3f2
mov dword [0x103a534], esi
push 0x1001308
push 0x1001300
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x102a3f8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x102a4cf
mov dword [0x1039468], esi
mov eax, dword [0x103a534]
cmp eax, esi
jne 0x102a41c
push 0x10012fc
push 0x10012ec
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x103a534], 2
cmp dword [ebp - 0x1c], ebx
jne 0x102a429
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x103a544], ebx
je 0x102a44a
push 0x103a544
call fcn.0102a927
pop ecx
test eax, eax
je 0x102a44a
push ebx
push 2
push ebx
call dword [0x103a544]
mov eax, dword [0x1039450]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x1039450]
push dword [0x1039454]
push dword [0x103944c]
call fcn.01024900
add esp, 0xc
mov dword [0x1039464], eax
cmp dword [0x1039458], ebx
jne 0x102a4b5
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1039468], ebx
jne 0x102a4c3
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1039464]
call fcn.0102a9f5
ret
call fcn.0102a020
jmp 0x102a35f
Function at 0x102b9f0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1039030]
mov dword [eax], ecx
cmp dword [0x10394a0], 0
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x234], 0x101a2f0
mov dword [ebp - 0x230], 0x102b490
mov dword [ebp - 0x22c], 0x101a2e4
mov dword [ebp - 0x228], 0x102b750
mov dword [ebp - 0x224], 0x101a2d4
mov dword [ebp - 0x220], fcn.0101e400
je 0x102ba76
movzx edx, word [ebp + 8]
mov eax, dword [edx*8 + 0x103901c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x102bba3
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCR80.dll_strcpy_s]
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push 0x10c
push edx
call edi
mov ebx, dword [sym.imp.MSVCR80.dll_strcat_s]
push 0x101a318
lea eax, [ebp - 0x110]
push 0x10c
push eax
call ebx
add esp, 0x18
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x102baf4
push 0x101a2f0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x102bb4d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push 0x10c
push eax
call edi
push 0x101a320
lea ecx, [ebp - 0x110]
push 0x10c
push ecx
call ebx
add esp, 0x18
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x102bba0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101a2f0
push esi
call ebx
test eax, eax
jne 0x102bb53
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x102bba0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov eax, dword [ebp + edi*8 - 0x234]
push eax
push esi
call ebx
test eax, eax
mov dword [ebp + edi*8 - 0x230], eax
je 0x102bb44
add edi, 1
cmp edi, 3
jl 0x102bb55
mov ecx, dword [ebp - 0x230]
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x220]
mov dword [0x103901c], ecx
mov dword [0x1039024], edx
mov dword [fcn.0101e400], eax
mov dword [0x1039030], 0
pop edi
pop esi
pop ebx
mov ecx, dword [0x1039030]
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + 8]
mov dword [0x10394a0], 1
mov dword [edx], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [eax*8 + 0x103901c]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
Function at 0x102bf70
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ecx + 4]
push esi
lea eax, [ebp - 4]
push eax
or edx, 1
push edx
push 0
lea eax, [ecx + 8]
mov ecx, dword [ecx + 0x408]
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x102bfd7
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push esi
push edx
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x102bfd7
cmp dword [ebp - 0xc], 4
je 0x102bfd7
mov esi, 0xd
mov eax, dword [ebp - 4]
test eax, eax
je 0x102bfe5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x102c000
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
jne 0x102c050
cmp dword [edi], 7
jne 0x102c050
call fcn.010247e0
push eax
push ebx
push 0x1018350
call dword [sym.imp.MSVCR80.dll__wcsicmp_l]
add esp, 0xc
test eax, eax
jne 0x102c050
lea eax, [ebp + 0x10]
push eax
push ebx
mov ecx, edi
call fcn.0102bf70
mov esi, eax
test esi, esi
je 0x102c0ab
cmp esi, 2
jne 0x102c092
mov eax, dword [edi + 4]
lea edx, [ebp - 4]
push edx
mov edx, dword [edi + 0x408]
or eax, 0x20006
push eax
push 0
lea ecx, [edi + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x102c092
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push esi
push ebx
push edx
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x102c0a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x10]
je 0x102c050
mov esi, 0x1779
jmp 0x102c092
Function at 0x102c120
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ecx + 4]
push esi
lea eax, [ebp - 8]
push eax
or edx, 1
push edx
push 0
lea eax, [ecx + 8]
mov ecx, dword [ecx + 0x408]
push eax
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x102c210
mov ecx, dword [ebp - 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
lea ebx, [edi + 4]
push ebx
push edi
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [edi]
cmp edi, 1
mov esi, eax
jne 0x102c1c2
test esi, esi
jne 0x102c1b7
mov eax, dword [ebp - 4]
cmp eax, 0x1000
jbe 0x102c1a3
mov esi, 0x6f
mov word [ebx + 0xffe], 0
jmp 0x102c20e
cmp eax, 2
jb 0x102c1b2
shr eax, 1
cmp word [ebx + eax*2 - 2], 0
je 0x102c20e
mov esi, 0xd
mov word [ebx + 0xffe], 0
jmp 0x102c20e
cmp edi, 7
jne 0x102c20e
xor edx, edx
cmp esi, edx
jne 0x102c200
mov ecx, dword [ebp - 4]
cmp ecx, 0x1000
jbe 0x102c1df
mov esi, 0x6f
jmp 0x102c200
cmp ecx, 2
jb 0x102c1fb
mov eax, ecx
shr eax, 1
cmp word [ebx + eax*2 - 2], dx
jne 0x102c1fb
cmp ecx, 4
jb 0x102c20e
cmp word [ebx + eax*2 - 4], dx
je 0x102c20e
mov esi, 0xd
mov word [ebx + 0xffe], dx
mov word [ebx + 0xffc], dx
pop edi
pop ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x102c21e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x102c230
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0
push esi
mov dword [ebp - 0x208], 0x100
mov word [ebp - 6], 0
call sub.instapi.dll_GetInstRegPathByName
test eax, eax
je 0x102c380
cmp word [ebp - 6], 0
je 0x102c299
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
push edi
push 0x20019
lea edx, [ebp - 0x204]
push edx
call sub.instapi.dll_GetRegKeyAccessMask
test eax, eax
jne 0x102c2c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
and dword [edi], 0xfffdffe6
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102c2d6
sub eax, edx
sar eax, 1
cmp eax, 0x100
jae 0x102c406
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102c300
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x204]
push ecx
lea esi, [edi + 4]
push esi
call sub.MSVCR80.dll_memcpy
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102c330
sub eax, edx
sar eax, 1
add eax, 0x12
cmp eax, 0x100
jae 0x102c406
add esi, 0xfffffffe
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x102c350
mov edi, esi
mov ecx, 9
mov esi, 0x1018468
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x102c36e
test esi, esi
mov word [edi + 0x202], 0
je 0x102c3dc
cmp word [esi], 0
je 0x102c3dc
call fcn.010247e0
push eax
push 0x1018450
push esi
call dword [sym.imp.MSVCR80.dll__wcsicmp_l]
add esp, 0xc
test eax, eax
je 0x102c3dc
push esi
push 0x1018428
call fcn.010247e0
push eax
push 0x10183b8
push 0xff
add edi, 4
push edi
call dword [sym.imp.MSVCR80.dll__snwprintf_l]
add esp, 0x18
jmp 0x102c3fe
push 0x1018428
call fcn.010247e0
push eax
push 0x1018360
push 0xff
add edi, 4
push edi
call dword [sym.imp.MSVCR80.dll__snwprintf_l]
add esp, 0x14
test eax, eax
jge 0x102c36c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x6f
pop esi
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
Function at 0x102c430
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x25c], 0x100
mov word [ebp - 0x20c], 0
call fcn.010247e0
mov ebx, dword [sym.imp.MSVCR80.dll__snwprintf_l]
push eax
push 0x1018490
lea eax, [ebp - 0x258]
push 0x26
push eax
call ebx
add esp, 0x14
test eax, eax
jl 0x102c63f
lea ecx, [ebp - 0x25c]
push ecx
add eax, 1
lea edx, [ebp - 0x204]
push edx
mov dword [ebp - 0x208], eax
push 0
lea eax, [ebp - 0x258]
push eax
mov word [ebp - 6], 0
call sub.instapi.dll_GetInstRegPathByID
test eax, eax
je 0x102c5c1
cmp word [ebp - 6], 0
je 0x102c4db
pop edi
pop esi
mov eax, 0xd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
push edi
push 0x20019
lea ecx, [ebp - 0x204]
push ecx
call sub.instapi.dll_GetRegKeyAccessMask
test eax, eax
jne 0x102c50a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
and dword [edi], 0xfffdffe6
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102c520
sub eax, edx
sar eax, 1
cmp eax, 0x100
jae 0x102c63f
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102c543
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x204]
push eax
lea esi, [edi + 4]
push esi
call sub.MSVCR80.dll_memcpy
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102c570
sub eax, edx
sar eax, 1
add eax, 0x12
cmp eax, 0x100
jae 0x102c63f
add esi, 0xfffffffe
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x102c590
mov edi, esi
mov ecx, 9
mov esi, 0x1018468
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x102c5ae
test esi, esi
mov word [edi + 0x202], 0
je 0x102c619
cmp word [esi], 0
je 0x102c619
call fcn.010247e0
push eax
push 0x1018450
push esi
call dword [sym.imp.MSVCR80.dll__wcsicmp_l]
add esp, 0xc
test eax, eax
je 0x102c619
push esi
push 0x1018428
call fcn.010247e0
push eax
push 0x10183b8
push 0xff
add edi, 4
push edi
call ebx
add esp, 0x18
jmp 0x102c637
push 0x1018428
call fcn.010247e0
push eax
push 0x1018360
push 0xff
add edi, 4
push edi
call ebx
add esp, 0x14
test eax, eax
jge 0x102c5ac
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x6f
pop ebx
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
Function at 0x102cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x414], eax
mov dword [eax], esi
mov eax, dword [edi + 4]
push 0x101b148
lea ecx, [edi + 8]
push ecx
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x208], eax
mov word [ebp - 6], si
call fcn.010247e0
push eax
push 0x1018498
lea edx, [ebp - 0x204]
push 0xff
push edx
call dword [sym.imp.MSVCR80.dll__snwprintf_l]
lea eax, [ebp - 0x204]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x102cdd5
sub eax, edx
sar eax, 1
cmp eax, 0x100
jb 0x102cdf5
mov esi, 0x6f
jmp 0x102cece
lea eax, [ebp - 0x204]
push 0x10184f4
push eax
call dword [sym.imp.MSVCR80.dll_wcsstr]
add esp, 8
cmp eax, esi
je 0x102cec9
lea ecx, [ebp - 0x40c]
push ecx
push 0x101a41c
lea edx, [ebp - 0x208]
push edx
mov word [eax], si
call fcn.0102c790
mov esi, eax
test esi, esi
jne 0x102cece
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x410]
push eax
mov eax, dword [edi + 0x408]
or ecx, 1
push ecx
push esi
lea edx, [ebp - 0x408]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x102ce78
cmp esi, 2
jne 0x102cece
mov ecx, dword [ebp - 0x414]
mov dword [ecx], 0
xor esi, esi
jmp 0x102cece
mov ecx, dword [ebp - 0x410]
mov esi, dword [ebp + 0x10]
lea edx, [ebp + 0x10]
push edx
push ebx
lea eax, [ebp - 0x418]
push eax
push 0
push 0x10184e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [ebp + 0x10]
push edi
push esi
push ebx
push eax
call fcn.0102be50
mov esi, eax
test esi, esi
jne 0x102cece
cmp dword [ebp - 0x418], 1
jne 0x102cec9
cmp edi, 1
jb 0x102cec9
mov edx, dword [ebp - 0x414]
mov dword [edx], 1
jmp 0x102cece
mov esi, 0xd
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x102cedf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01029f27
mov esp, ebp
pop ebp
ret 0xc