joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.1001d960
test eax, eax
mov eax, dword [ebp + 8]
setne bl
cmp eax, 0x64
ja case.0x10023c83.10
movzx eax, byte [eax + 0x10023e90]
jmp dword [eax*4 + 0x10023e60]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
call fcn.10023b20
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.1001bd40
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push eax
push esi
call fcn.1001bd40
add esp, 8
mov ecx, 0x10053070
call fcn.1001b4a0
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
push edx
push 0x10
call fcn.10028a90
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
push 1
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10023c83.10
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.LocalLow
push esi
call edi
mov ecx, 0x10053090
call fcn.1001b4a0
push eax
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
push 1
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10023c83.10
mov ecx, 0x10053080
call fcn.1001b4a0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
push esi
call edi
mov ecx, 0x10053090
call fcn.1001b4a0
push eax
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
push 1
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10023c83.10
mov ecx, 0x10053090
call fcn.1001b4a0
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
push 1
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10023c83.10
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test bl, bl
je 0x10023e40
push str.LocalLow
push esi
call edi
mov ecx, 0x100530a0
call fcn.1001b4a0
push eax
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10024350
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov ecx, 0x100538e8
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x108], esi
xor edi, edi
call fcn.1001b4a0
lea ecx, [ebp - 0x108]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100244f8
push 0x7e
lea eax, [ebp - 0x82]
xor edx, edx
push esi
push eax
mov word [ebp - 0x84], dx
call fcn.1000ae30
mov eax, dword [ebp - 0x108]
add esp, 0xc
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x84]
push edx
push esi
push eax
mov dword [ebp - 0x10c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x100243f1
cmp eax, 0xea
jne 0x100244eb
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x110]
push ecx
push 1
push 0
lea edx, [ebp - 0x84]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100244b4
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x102]
push edx
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x114], 0x40
mov word [ebp - 0x104], cx
call fcn.1000ae30
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
push str.DisplayName
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100244a7
push 0x100474f8
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100244a7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x84]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, 1
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x108]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x84]
push ecx
inc esi
push esi
push edx
mov dword [ebp - 0x10c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test edi, edi
je 0x100243e2
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10024510
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.10023fb0
mov esi, eax
test esi, esi
jne 0x1002453c
mov ecx, 0x10053918
call fcn.1001b4a0
mov esi, eax
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x28a]
push eax
mov word [ebp - 0x28c], dx
call fcn.1000ae30
lea ecx, [ebp - 0x84]
push 0x40
push ecx
call fcn.10024350
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x100245a0
push 0x40
mov ecx, 0x10053908
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x84]
push eax
mov ecx, 0x100538e8
call fcn.1001b4a0
push eax
push 0x10041304
lea ecx, [ebp - 0x28c]
push 0x103
push ecx
call fcn.1000c37d
add esp, 0x14
test edi, edi
jne 0x10024661
push str.CodePage
lea edx, [ebp - 0x28c]
push edx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 6
push 0x100474f8
push 1
push str.DisplayName
lea eax, [ebp - 0x28c]
push eax
push SysReAllocString
call edi
push 0x100474f8
push str.DisplayName:__s
push 6
call fcn.1001af20
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10024625
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0x100474d0
lea edx, [ebp - 0x28c]
push edx
push SysReAllocString
call edi
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xa8a]
push ecx
mov dword [ebp - 0xa90], 0x800
mov word [ebp - 0xa8c], ax
call fcn.1000ae30
add esp, 0xc
lea edx, [ebp - 0xa90]
push edx
lea eax, [ebp - 0xa8c]
push eax
lea ecx, [ebp - 0xa94]
push ecx
push 0x100474d0
lea edx, [ebp - 0x28c]
push edx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100246cb
push esi
lea eax, [ebp - 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10024715
push str.CodePage
lea ecx, [ebp - 0x28c]
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100246e7
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0x100474d0
lea eax, [ebp - 0x28c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10024730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
mov eax, dword [ebp + 8]
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
call fcn.10028b70
add esp, 0x18
test eax, eax
je 0x100247b6
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100247b6
push 0x104
lea edx, [ebp - 0x20c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x10024bf0
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
mov esi, dword [ebp + 8]
push 0x104
lea edx, [ebp - 0x20c]
push edx
push esi
call fcn.10028b20
add esp, 0x18
test eax, eax
jne 0x10024c4f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x10024cb5
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x412]
push edx
mov word [ebp - 0x414], cx
call fcn.1000ae30
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.10024730
add esp, 0x14
test eax, eax
je 0x10024cde
lea ecx, [ebp - 0x414]
push ecx
call ebx
test eax, eax
je 0x10024cde
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10024ed0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c358
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
lea eax, [ebp - 0x18]
push eax
push 0xa
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0xeff9e4d9
mov dword [ebp - 0x14], 0xfaf4f584
call fcn.1001b390
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.1001b4a0
mov esi, eax
call fcn.1001d960
cmp dword [ebp + 8], 0
jne 0x10024f66
mov ecx, 0x100539f8
call fcn.1001b4a0
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 4], 0xffffffff
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.1001b3d0
mov eax, esi
jmp 0x10024f7a
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.1001b3d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x10024ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.1000ae30
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
add esp, 0xc
push edi
push 0x10044d78
push esi
call ebx
push 0x40
lea edx, [ebp - 0x84]
push edx
push 0x10
call fcn.10028bf0
add esp, 0xc
cmp eax, 1
jne 0x1002506f
push edi
lea eax, [ebp - 0x84]
push eax
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, 0x10053a28
mov dword [ebp - 0x88], 0x80
call fcn.1001b4a0
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x84]
push edx
lea ecx, [ebp - 0x8c]
push ecx
push str.Version
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100250ce
push edi
lea edx, [ebp - 0x84]
push edx
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10025800
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 0x4b8], eax
test eax, eax
je 0x100259f5
test ebx, ebx
je 0x100259f5
xor eax, eax
push esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x4b2]
push edx
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov word [ebp - 0x4b4], cx
call fcn.1000ae30
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x2aa]
push ecx
mov word [ebp - 0x2ac], ax
call fcn.1000ae30
mov edx, dword [ebp + 8]
push edx
push str.file_d
lea eax, [ebp - 0x24]
push 0x1c
push eax
call fcn.1000c37d
add esp, 0x28
lea esi, [edi + 0x20c]
push esi
push 0x204
lea ecx, [ebp - 0x4b4]
push ecx
push 0x10044d78
push str.file
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1002597b
push 0x204
add edi, 4
lea eax, [ebp - 0x2ac]
push edi
push eax
call fcn.1000c11c
add esp, 0xc
lea ecx, [ebp - 0x4b4]
push ecx
lea edx, [ebp - 0x2ac]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002597b
lea ecx, [ebp - 0x2ac]
push ebx
push ecx
call fcn.1000c2f2
add esp, 8
test eax, eax
je 0x1002597b
xor edx, edx
push 0x7e
push edx
lea eax, [ebp - 0xa2]
push eax
mov word [ebp - 0xa4], dx
call fcn.1000ae30
push 0x7c
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x2ac]
push edx
call fcn.1001bc30
add esp, 0x18
test eax, eax
je 0x1002597b
mov eax, dword [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0xa4]
push ecx
call fcn.1001bb00
add esp, 8
test eax, eax
jns 0x10025999
lea edx, [ebp - 0x2ac]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
jne 0x100259b8
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push eax
push str.file
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x10025986
mov ecx, dword [ebp - 0x4b8]
push esi
push ecx
push 0x100478c4
lea edx, [ebp - 0x24]
push edx
call edi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10025a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
call fcn.1001d960
push 0x104
test eax, eax
je 0x10025a5e
lea edx, [ebp - 0x20c]
push edx
push 6
jmp 0x10025a67
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.10023c60
add esp, 0xc
push str.Update
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10025ab5
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.1001c500
add esp, 8
test eax, eax
jne 0x10025ab5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x100263e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.1000ae30
push esi
push str.CLSID_sInprocServer32
lea ecx, [ebp - 0x414]
push 0x103
push ecx
mov dword [ebp - 0x41c], 0x208
call fcn.1000c37d
add esp, 0x28
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x414]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
pop esi
test eax, eax
jne 0x100264a6
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100264b6
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100264d0
mov ecx, dword [ebp - 4]
sub eax, edx
sar eax, 1
cmp eax, 4
setae al
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10026610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x10053d6c
xor bl, bl
call fcn.1001b4a0
lea ecx, [ebp - 0x210]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100266ab
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.1000ae30
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push esi
push ecx
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002669e
mov bl, 1
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x100266c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x10053d7c
xor bl, bl
call fcn.1001b4a0
lea ecx, [ebp - 0x210]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1002675b
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.1000ae30
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push esi
push ecx
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002674e
mov bl, 1
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x10026ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
mov eax, 4
add esp, 0xc
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
test esi, esi
je 0x10026b73
push ebx
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.10026a00
add esp, 0xc
test eax, eax
je 0x10026b73
lea eax, [ebp - 0x214]
push eax
push esi
lea ecx, [ebp - 0x210]
push ecx
push edi
lea edx, [ebp - 0x20c]
push edx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret