joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10082ab
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push esi
call edi
test eax, eax
jne 0x10082fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10082fb
add esi, 3
push ebx
jmp 0x10082c6
xor eax, eax
mov al, byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
jne 0x10082bd
cmp byte [esi], 0x5c
je 0x10082cb
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0
jne 0x10082a9
mov bl, byte [esi]
push 0
push dword [ebp + 8]
mov byte [esi], 0
call edi
test eax, eax
jne 0x10082e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10082f1
test bl, bl
mov byte [esi], bl
je 0x10082fa
inc esi
jmp 0x10082c6
mov dword [ebp - 4], 0x80004005
mov byte [esi], bl
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x100899c
Capabilities:
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
xor esi, esi
inc esi
sub eax, 0
je 0x10089d7
dec eax
je 0x10089d1
dec eax
je 0x10089ab
dec eax
dec eax
jne 0x10089f4
cmp dword [ebp + 0xc], 0
je 0x10089f4
cmp dword [0x1016bd8], 2
jne 0x10089f4
mov eax, dword [0x1016bcc]
cmp eax, 5
ja 0x10089f2
jne 0x10089f4
cmp dword [0x1016bd0], 0
jbe 0x10089f4
jmp 0x10089f2
cmp dword [ebp + 0xc], 0
je 0x10089f4
cmp dword [0x1016bd8], 2
jne 0x10089e9
cmp dword [0x1016bcc], 5
jae 0x10089f2
call fcn.010080b5
test eax, eax
je 0x10089f4
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1008aae
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x1008a22
jle 0x1008a47
cmp eax, 2
jle 0x1008a7f
cmp eax, 3
je 0x1008a4e
cmp eax, 4
jne 0x1008a47
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x1008a47
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1008a47
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp dword [ebp + 0xc], ebx
je 0x1008a47
cmp dword [ebp + 0x10], ebx
je 0x1008a47
push ebx
push 0x80
push 4
push ebx
push 3
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1008a47
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008a47
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1008a47
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
je 0x1008aa6
and eax, 0xfffffffe
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xc], ebx
je 0x1008a47
cmp dword [ebp + 0x14], ebx
je 0x1008a47
call fcn.01006e83
test eax, eax
jne 0x1008a47
push 0xfffffffffffffffe
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push edi
push ebx
push dword [ebp + 0x14]
call fcn.01007f43
push 1
push edi
call esi
jmp 0x1008a47
Function at 0x100a7de
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x360
cmp dword [0x1016bd8], 2
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
jne 0x100a80c
push 1
push 0x1001d70
call fcn.0100d0a2
xor eax, eax
jmp 0x100aa02
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0x1001d4c
call fcn.0100d0a2
mov eax, 0x10165a8
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x35c], eax
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x354], eax
mov eax, ecx
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x324], eax
mov eax, ecx
mov dword [ebp - 0x31c], eax
mov eax, dword [0x1016c6c]
dec eax
mov dword [ebp - reloc.SHLWAPI.dll_wnsprintfA], 0x1001bf8
mov dword [ebp - reloc.KERNEL32.dll_GetEnvironmentStrings], 0x1001c3c
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x330], 0x1001c08
mov dword [ebp - 0x32c], ecx
mov dword [ebp - reloc.KERNEL32.dll_GetEnvironmentStrings], 0x1001c90
mov dword [ebp - 0x358], 0x1001cc8
mov dword [ebp - 0x350], 0x1001cd4
mov dword [ebp - 0x348], 0x1001ca0
mov dword [ebp - 0x328], 0x1001d3c
mov dword [ebp - 0x320], 0x1001d2c
je 0x100a917
dec eax
jne 0x100a9fd
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x100a8e5
mov eax, edi
jmp 0x100a9ff
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 3
call fcn.010094aa
cmp eax, 3
jne 0x100a9fd
lea esi, [ebp - 0x360]
mov dword [ebp - 0x314], 4
jmp 0x100a976
xor ebx, ebx
cmp dword [ebp + 8], ebx
push ebx
push ebx
je 0x100a950
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 3
call fcn.010094aa
cmp eax, 3
jne 0x100a9fd
lea esi, [ebp - 0x328]
mov dword [ebp - 0x314], 2
jmp 0x100a976
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.010094aa
cmp eax, edi
jne 0x100a9fd
lea esi, [ebp - 0x340]
mov dword [ebp - 0x314], 3
mov dword [ebp - 0x318], edi
xor edi, edi
cmp edi, dword [ebp - 0x314]
jge 0x100a9f5
push dword [esi + edi*8]
lea eax, [ebp - 0x310]
push dword [esi + edi*8 + 4]
push 0x100597c
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x100a9c1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100a9ec
push 1
push 0x1001d1c
call fcn.0100d0a2
push ebx
lea eax, [ebp - 0x310]
push eax
call fcn.0100d0a2
push 1
push 0x1001d08
call fcn.0100d0a2
mov dword [ebp - 0x318], ebx
inc edi
cmp dword [ebp - 0x318], ebx
jne 0x100a97e
mov eax, dword [ebp - 0x318]
jmp 0x100a9ff
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0100d528
leave
ret 4
Function at 0x100a847
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x360
cmp dword [0x1016bd8], 2
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
jne 0x100a80c
push 1
push 0x1001d70
call fcn.0100d0a2
xor eax, eax
jmp 0x100aa02
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0x1001d4c
call fcn.0100d0a2
mov eax, 0x10165a8
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x35c], eax
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x354], eax
mov eax, ecx
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x324], eax
mov eax, ecx
mov dword [ebp - 0x31c], eax
mov eax, dword [0x1016c6c]
dec eax
mov dword [ebp - reloc.SHLWAPI.dll_wnsprintfA], 0x1001bf8
mov dword [ebp - reloc.KERNEL32.dll_GetEnvironmentStrings], 0x1001c3c
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x330], 0x1001c08
mov dword [ebp - 0x32c], ecx
mov dword [ebp - reloc.KERNEL32.dll_GetEnvironmentStrings], 0x1001c90
mov dword [ebp - 0x358], 0x1001cc8
mov dword [ebp - 0x350], 0x1001cd4
mov dword [ebp - 0x348], 0x1001ca0
mov dword [ebp - 0x328], 0x1001d3c
mov dword [ebp - 0x320], 0x1001d2c
je 0x100a917
dec eax
jne 0x100a9fd
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x100a8e5
mov eax, edi
jmp 0x100a9ff
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 3
call fcn.010094aa
cmp eax, 3
jne 0x100a9fd
lea esi, [ebp - 0x360]
mov dword [ebp - 0x314], 4
jmp 0x100a976
xor ebx, ebx
cmp dword [ebp + 8], ebx
push ebx
push ebx
je 0x100a950
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 3
call fcn.010094aa
cmp eax, 3
jne 0x100a9fd
lea esi, [ebp - 0x328]
mov dword [ebp - 0x314], 2
jmp 0x100a976
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.010094aa
cmp eax, edi
jne 0x100a9fd
lea esi, [ebp - 0x340]
mov dword [ebp - 0x314], 3
mov dword [ebp - 0x318], edi
xor edi, edi
cmp edi, dword [ebp - 0x314]
jge 0x100a9f5
push dword [esi + edi*8]
lea eax, [ebp - 0x310]
push dword [esi + edi*8 + 4]
push 0x100597c
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x100a9c1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100a9ec
push 1
push 0x1001d1c
call fcn.0100d0a2
push ebx
lea eax, [ebp - 0x310]
push eax
call fcn.0100d0a2
push 1
push 0x1001d08
call fcn.0100d0a2
mov dword [ebp - 0x318], ebx
inc edi
cmp dword [ebp - 0x318], ebx
jne 0x100a97e
mov eax, dword [ebp - 0x318]
jmp 0x100a9ff
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0100d528
leave
ret 4
Function at 0x100a88f
Capabilities:
Check if file exists
Get file attributes
Get file version info
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x360
cmp dword [0x1016bd8], 2
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
jne 0x100a80c
push 1
push 0x1001d70
call fcn.0100d0a2
xor eax, eax
jmp 0x100aa02
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0x1001d4c
call fcn.0100d0a2
mov eax, 0x10165a8
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x35c], eax
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x354], eax
mov eax, ecx
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x324], eax
mov eax, ecx
mov dword [ebp - 0x31c], eax
mov eax, dword [0x1016c6c]
dec eax
mov dword [ebp - reloc.SHLWAPI.dll_wnsprintfA], 0x1001bf8
mov dword [ebp - reloc.KERNEL32.dll_GetEnvironmentStrings], 0x1001c3c
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x330], 0x1001c08
mov dword [ebp - 0x32c], ecx
mov dword [ebp - reloc.KERNEL32.dll_GetEnvironmentStrings], 0x1001c90
mov dword [ebp - 0x358], 0x1001cc8
mov dword [ebp - 0x350], 0x1001cd4
mov dword [ebp - 0x348], 0x1001ca0
mov dword [ebp - 0x328], 0x1001d3c
mov dword [ebp - 0x320], 0x1001d2c
je 0x100a917
dec eax
jne 0x100a9fd
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x100a8e5
mov eax, edi
jmp 0x100a9ff
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 3
call fcn.010094aa
cmp eax, 3
jne 0x100a9fd
lea esi, [ebp - 0x360]
mov dword [ebp - 0x314], 4
jmp 0x100a976
xor ebx, ebx
cmp dword [ebp + 8], ebx
push ebx
push ebx
je 0x100a950
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 3
call fcn.010094aa
cmp eax, 3
jne 0x100a9fd
lea esi, [ebp - 0x328]
mov dword [ebp - 0x314], 2
jmp 0x100a976
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.010094aa
cmp eax, edi
jne 0x100a9fd
lea esi, [ebp - 0x340]
mov dword [ebp - 0x314], 3
mov dword [ebp - 0x318], edi
xor edi, edi
cmp edi, dword [ebp - 0x314]
jge 0x100a9f5
push dword [esi + edi*8]
lea eax, [ebp - 0x310]
push dword [esi + edi*8 + 4]
push 0x100597c
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x100a9c1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100a9ec
push 1
push 0x1001d1c
call fcn.0100d0a2
push ebx
lea eax, [ebp - 0x310]
push eax
call fcn.0100d0a2
push 1
push 0x1001d08
call fcn.0100d0a2
mov dword [ebp - 0x318], ebx
inc edi
cmp dword [ebp - 0x318], ebx
jne 0x100a97e
mov eax, dword [ebp - 0x318]
jmp 0x100a9ff
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0100d528
leave
ret 4
Function at 0x100b78f
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
lea eax, [ebp - 4]
push eax
push 9
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100b6e5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x100b7a5
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x100b72b
cmp eax, 0xea
je 0x100b72b
cmp eax, 0x7a
je 0x100b72b
mov esi, eax
jmp 0x100b740
mov eax, dword [ebp - 0xc]
inc eax
push eax
lea eax, [ebp - 8]
push eax
call fcn.01006d75
test eax, eax
jne 0x100b74d
push 8
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100b7a4
xor esi, esi
mov eax, dword [ebp - 0xc]
inc eax
push eax
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100b774
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0100b6b0
test eax, eax
je 0x100b775
inc esi
cmp eax, 0x103
je 0x100b781
cmp esi, dword [ebp - 0x14]
jb 0x100b74f
mov eax, dword [0x1016c90]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
leave
ret 8
Function at 0x100bc60
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [0x1016c68], 1
push ebx
sete al
xor ebx, ebx
push ebx
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x18c]
push eax
call fcn.0100cb57
cmp dword [ebp - 0x18c], 7
jge 0x100bc97
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push edi
push dword [0x1016bc4]
mov edi, 0x10169b8
push edi
push 0x100597c
lea eax, [ebp - 0x188]
push 0x104
push eax
call esi
add esp, 0x14
cmp dword [ebp - 0x190], ebx
mov eax, 0x1005968
jne 0x100bc45
mov eax, 0x1005954
mov ecx, dword [ebp - 0x18c]
push dword [ecx*4 + 0x1005a84]
push eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call esi
mov eax, dword [ebp - 0x190]
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0xfffffff8
push ebx
add eax, 8
or eax, 5
push eax
push ebx
push 0x10167b0
push edi
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x188]
push eax
push ebx
call dword [0x1016c74]
pop edi
pop esi
cmp dword [ebp - 0x190], ebx
pop ebx
je 0x100bcc9
lea eax, [ebp - 0x194]
push eax
call fcn.0100cbad
test eax, eax
je 0x100bcc9
mov eax, dword [0x1016c6c]
dec eax
jne 0x100bcc9
push dword [ebp - 0x18c]
push dword [ebp - 0x194]
call fcn.0100b7ae
mov ecx, dword [ebp - 4]
call fcn.0100d528
leave
ret

Function at 0x100bdaa
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x1016c6c]
dec eax
jne 0x100bdb5
push 0
call fcn.0100d1cb
ret
Function at 0x100be6d
Capabilities:
Query environment variable
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x101200c]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
mov edi, 0x104
push edi
mov dword [ebp - 4], eax
push 0x10166ac
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x200
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x308]
push eax
push 0x3f4
push dword [0x1016c8c]
call ebx
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x310], edi
sub dword [ebp - 0x310], eax
push dword [ebp - 0x310]
lea ecx, [ebp - 0x308]
lea eax, [ebp + eax - 0x108]
push ecx
push eax
call esi
mov eax, dword [ebp - 0x314]
add eax, dword [ebp - 0x30c]
mov ecx, edi
sub ecx, eax
push ecx
push 0x100598c
lea eax, [ebp + eax - 0x108]
push eax
call esi
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x100be97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
lea eax, [ebp - 0x308]
push eax
push 0x3f3
push dword [0x1016c8c]
call ebx
push dword [ebp - 0x310]
mov ebx, eax
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 0x30c]
lea eax, [ebp + eax - 0x108]
push eax
call esi
add ebx, dword [ebp - 0x30c]
sub edi, ebx
push edi
push 0x10059b4
lea eax, [ebp + ebx - 0x108]
push eax
call esi
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x100bf15
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
call fcn.0100d528
leave
ret
Function at 0x100c0a3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push 4
pop ebx
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x1004fec
push 0x80000001
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100c15e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push 0x1005034
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x100c074
cmp eax, esi
jne 0x100c15e
cmp dword [ebp - 0x14], esi
je 0x100c15e
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x100c15e
mov eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 4]
push eax
call fcn.01006d75
test eax, eax
je 0x100c171
mov ecx, dword [ebp - 0x24]
mov edx, ecx
shr ecx, 2
push edi
mov edi, dword [ebp - 4]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [ebp - 0x20], esi
jbe 0x100c145
mov edi, 0x1005024
push dword [ebp - 0x24]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
inc dword [ebp - 0x10]
cmp eax, esi
jne 0x100c13d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100c13d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100c134
cmp dword [ebp - 0x1c], 3
jne 0x100c134
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jb 0x100c0cf
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x1005034
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
cmp dword [ebp - 4], esi
je 0x100c174
mov eax, dword [0x1016c90]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
pop esi
pop ebx
je 0x100c184
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x100c1b1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101200c]
push ebx
push esi
push edi
push 2
pop edi
cmp dword [0x1016bd8], edi
mov esi, 0x104
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push esi
jne 0x100c1cc
push 0x1005b2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x21c], edi
jmp 0x100c1dd
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x21c], 1
xor eax, eax
xor edi, edi
cmp dword [ebp + 8], edi
setne al
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1005b44
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp + 8], edi
mov eax, reloc.KERNEL32.dll_GetVersionExA
jne 0x100c215
mov eax, 0x100247c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x100c373
push esi
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
add eax, 0x40d
push eax
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push edi
push edi
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x1005b20
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 2
call esi
push 1
push 0x10025a4
push 1
push edi
push 0x1005b10
push dword [ebp - 0x210]
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1005b04
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100c312
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002281
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100c367
cmp dword [ebp + 8], edi
je 0x100c348
push 0x2e
push 0x1005aa8
jmp 0x100c34f
push 0x2c
push 0x1005ad8
push 1
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 4