joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cd9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x100bffc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2e4]
push eax
push 0x2001f
xor edi, edi
push edi
push str.Control_PanelAppearanceSchemes
push 0x80000001
mov dword [ebp - 0x2e4], edi
xor ebx, ebx
mov dword [ebp - 0x2e0], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003ed7
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x304]
push eax
push edi
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x2e4]
mov dword [ebp - 0x300], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
je 0x1003d8d
cmp eax, 0xea
jne 0x1003ed7
inc dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2e8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push edi
call esi
push dword [ebp - 0x2f0]
mov dword [ebp - 0x2e0], eax
push edi
call esi
mov ebx, eax
cmp ebx, edi
je 0x1003ed7
cmp dword [ebp - 0x2e0], edi
je 0x1003ed7
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x2f4]
push eax
push ebx
lea eax, [ebp - 0x2fc]
push eax
push edi
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp - 0x2e0]
mov dword [ebp - 0x2ec], 1
push edi
jmp 0x1003ec3
cmp word [ebx], 1
jne 0x1003e81
push 0x1f
pop ecx
lea eax, [ebx + 2]
push eax
mov word [ebp - 0x2da], di
lea eax, [ebp - 0x2d8]
mov word [ebp - 0x2dc], 2
lea esi, [ebx + 0x188]
lea edi, [ebp - 0x88]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.01003c26
lea eax, [ebx + 0x156]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.01003b35
push 0x2d0
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 0x2fc]
push 0
push dword [ebp - 0x2e0]
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
mov eax, dword [ebp - 0x2e8]
lea ecx, [ebp - 0x2f4]
push ecx
push ebx
lea ecx, [ebp - 0x2fc]
push ecx
push edi
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x2f8]
push ecx
push dword [ebp - 0x2e0]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2ec]
inc dword [ebp - 0x2ec]
push eax
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1003e0f
cmp dword [ebp - 0x2e4], edi
je 0x1003eeb
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1003ef8
push ebx
call esi
cmp dword [ebp - 0x2e0], edi
je 0x1003f08
push dword [ebp - 0x2e0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009336
leave
ret
Function at 0x1004786
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x100483b
and dword [ebp - 4], eax
push 0x20a
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 8], eax
jne 0x10047c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100483b
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, 0x105
push ebx
push eax
push 0
jmp 0x1004818
lea eax, [ebp - 0xc]
push eax
push 0x60008
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x100482d
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call fcn.01004786
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100482d
inc dword [ebp - 4]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
je 0x10047d7
cmp esi, 0x103
jne 0x100482d
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1004ba0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100bffc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x414]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1004c74
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push esi
push 0x1001530
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004c2a
test al, 4
jne 0x1004c2a
or eax, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
push esi
push 0x100150c
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x1004c74
test al, 4
jne 0x1004c74
or eax, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
call fcn.01009336
leave
ret
Function at 0x1004c83
Capabilities:
Persist via screensaver registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100bffc]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 0x1b
mov dword [ebp - 4], eax
call esi
test eax, eax
je 0x1004d60
push 0x1a
call esi
test eax, eax
je 0x1004d60
push ebx
lea eax, [ebp - 0x210]
push eax
push 2
xor ebx, ebx
push ebx
push 0x10015dc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004d5f
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push 4
push 0x10015d8
push 1
push ebx
push 0x10015b4
push dword [ebp - 0x210]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x1001598
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004d52
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1001558
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1004d52
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01009336
leave
ret

Function at 0x10053ed
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100bffc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
shr eax, 0x10
movzx eax, al
push esi
mov esi, dword [ebp + 8]
push eax
movzx eax, byte [ebp + 0x11]
push eax
movzx eax, byte [ebp + 0x10]
push eax
lea eax, [ebp - 0x24]
push 0x1001dbc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x18
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push dword [eax*4 + 0x100b180]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01009336
leave
ret 0xc
Function at 0x10054b4
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x100bffc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, 0xc0c0c0
xor edi, edi
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x28]
push eax
push 0x2001b
push edi
mov ecx, 0x808080
mov edx, 0x800000
mov esi, 0xffffff
push 0x10015dc
mov ebx, 0x80000001
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x50], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
mov dword [ebp - 0xa8], 0x808000
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x4c], 0xe1ffff
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call edi
test eax, eax
jne 0x1005598
push 0x1001dfc
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push 0x2001b
push 0
push 0x1001dd0
push ebx
call edi
test eax, eax
jne 0x1005676
xor edi, edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push dword [edi + 0x100b180]
mov dword [ebp - 0x38], 0x20
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005611
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push 0x1001dbc
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
movzx ecx, byte [ebp - 0x30]
xor eax, eax
mov ah, byte [ebp - 0x34]
add esp, 0x14
mov al, byte [ebp - 0x2c]
shl eax, 8
or eax, ecx
mov dword [ebp + edi - 0xac], eax
add edi, 4
cmp edi, 0x74
jb 0x10055b5
xor edi, edi
mov edx, 0x100b1f8
xor eax, eax
mov ecx, edx
mov ebx, dword [ecx]
and ebx, esi
cmp dword [ebp + eax*4 - 0xac], ebx
jne 0x100563a
inc eax
add ecx, 4
cmp eax, 0x19
jl 0x1005624
cmp eax, 0x19
je 0x100564d
add edx, 0x74
inc edi
cmp edx, 0x100be34
jl 0x1005620
jmp 0x100566d
push edi
push dword [ebp - 0x28]
call fcn.01005461
cmp edi, 0x12
je 0x1005665
cmp edi, 0x17
je 0x1005665
cmp edi, 0x18
jne 0x100566d
push dword [ebp - 0x28]
call fcn.01005497
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009336
leave
ret
Function at 0x1005792
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 2
push esi
push edi
mov dword [ebp - 4], 0x80004005
jl 0x1005987
cmp ebx, 3
jg 0x1005987
mov edi, dword [ebp + 0xc]
xor esi, esi
push dword [esi*8 + 0x100be38]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10057d6
inc esi
cmp esi, 0x21
jb 0x10057bc
cmp esi, 0x21
jae 0x1005987
lea esi, [esi*8 + 0x100be3c]
cmp dword [esi], 0x2710
jl 0x1005801
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
mov dword [ebp - 4], eax
jl 0x1005987
mov eax, dword [esi]
mov ecx, 0x2711
cmp eax, ecx
jg 0x10058fe
je 0x10058f6
cmp eax, 0x12
ja case.default.0x1005908
jmp dword [eax*4 + 0x100598f]
call fcn.01003cd9
jmp case.0x1005908.10009
call fcn.01003f1a
jmp case.0x1005908.10009
call fcn.010041ba
jmp case.0x1005908.10009
call dword [sym.imp.USERENV.dll_Ordinal_128]
jmp case.0x1005908.10009
call fcn.01004aaa
jmp case.0x1005908.10009
call fcn.01004b19
jmp case.0x1005908.10009
call fcn.01004b57
jmp case.0x1005908.10009
call fcn.01004473
jmp case.0x1005908.10009
call dword [sym.imp.USERENV.dll_Ordinal_127]
jmp case.0x1005908.10009
call fcn.01006081
jmp case.0x1005908.10009
cmp ebx, 2
jle 0x1005896
mov eax, dword [edi + 8]
jmp 0x1005898
xor eax, eax
push eax
call fcn.01006150
jmp case.0x1005908.10009
call fcn.01004ba0
jmp case.0x1005908.10009
cmp ebx, 2
jle 0x10058b7
mov eax, dword [edi + 8]
jmp 0x10058b9
xor eax, eax
push eax
push dword [edi + 4]
call fcn.0100570c
jmp case.0x1005908.10009
call fcn.0100511e
jmp case.0x1005908.10009
call fcn.01004c83
jmp case.0x1005908.10009
call fcn.01005283
jmp case.0x1005908.10009
call fcn.01005398
jmp case.0x1005908.10009
call fcn.01007627
jmp case.0x1005908.10009
push 1
push 0
push 1
jmp 0x1005929
sub eax, 0x2712
cmp eax, 0xe
ja case.default.0x1005908
jmp dword [eax*4 + 0x10059db]
call fcn.01007a91
jmp case.0x1005908.10009
call fcn.01007b67
jmp case.0x1005908.10009
push 1
push 1
jmp 0x10058fa
push 1
push 0
push 0
call fcn.01007241
jmp case.0x1005908.10009
call fcn.01007196
jmp case.0x1005908.10009
push 1
push 0
push 1
jmp 0x100594b
push 1
push 1
jmp 0x100593b
push 1
push 0
push 0
call fcn.010074c5
jmp case.0x1005908.10009
call fcn.01007320
jmp case.0x1005908.10009
call fcn.010075b7
jmp case.0x1005908.10009
call fcn.01008a0f
jmp case.0x1005908.10009
call fcn.01008ea0
jmp case.0x1005908.10009
call fcn.01008eaa
cmp dword [ebp - 4], 0
jl 0x100597f
call dword [sym.imp.ole32.dll_OleUninitialize]
push 0
jmp 0x1005989
push 2
jmp 0x1005989
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1005a1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov edx, dword [ebp + 0x10]
mov eax, dword [0x100bffc]
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x2c], edx
lea edx, [ebp - 0x28]
push edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x30]
push edx
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x28], 0x18
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp - 0x24], eax
jne 0x1005ae3
cmp dword [ebp - 0x30], 1
jne 0x1005ae3
push esi
push edi
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], bl
mov byte [ebp - 0x1e], bl
lea esi, [ebp - 0x1c]
xor edi, edi
jmp 0x1005a82
cmp ax, 0x20
jne 0x1005a8a
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x1005a7a
mov eax, esi
jmp 0x1005a96
cmp word [esi], 0x20
je 0x1005a9b
inc esi
inc esi
cmp word [esi], bx
jne 0x1005a8e
cmp edi, 2
je 0x1005aa5
cmp word [esi], bx
je 0x1005abd
mov word [esi], bx
inc esi
push eax
inc esi
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov byte [ebp + edi - 0x20], al
inc edi
cmp edi, 3
jb 0x1005a82
jmp 0x1005ac4
mov dword [ebp - 0x24], 0xd
movzx eax, byte [ebp - 0x1e]
movzx ecx, byte [ebp - 0x1f]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x20]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp - 0x2c]
pop edi
mov dword [ecx], eax
pop esi
jmp 0x1005aea
mov dword [ebp - 0x24], 6
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
pop ebx
call fcn.01009336
leave
ret 0xc

Function at 0x1005aff
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100bffc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
push edi
mov edi, dword [ebp + 0xc]
push eax
movzx eax, byte [ebp + 0x11]
push eax
movzx eax, byte [ebp + 0x10]
push eax
lea eax, [ebp - 0x1c]
push 0x1001dbc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x18
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01009336
leave
ret 0xc
Function at 0x1005cff
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100bffc]
and dword [ebp - 0x64], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x68], eax
call fcn.01005ca1
test esi, esi
jne 0x1005d35
imul eax, eax, 0x5c
add eax, 0x1002340
jmp 0x1005d73
push 0x1002244
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005d71
push edi
push 0x17
pop ecx
lea eax, [ebp - 0x60]
lea edi, [ebp - 0x60]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.01005cd4
push 0x20
push 0x1002318
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x60]
pop edi
jmp 0x1005d73
xor eax, eax
test eax, eax
je 0x1005d8b
push 0x5c
push eax
push 3
push 0
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x64]
pop esi
pop ebx
call fcn.01009336
leave
ret 0xc

Function at 0x1005da1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100bffc]
push esi
lea ecx, [ebp - 0x64]
push ecx
push 0xf003f
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x10021b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1005e1c
push ebx
push edi
mov edi, dword [esi + 0x1002328]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x6c]
push eax
xor ebx, ebx
push ebx
push edi
push dword [ebp - 0x64]
mov dword [ebp - 0x68], 0x5c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005e06
cmp dword [ebp - 0x6c], 3
jne 0x1005e06
lea ebx, [ebp - 0x60]
push ebx
push edi
push dword [ebp - 0x64]
call fcn.01005cff
add esi, 4
cmp esi, 0x18
jb 0x1005dd3
pop edi
pop ebx
jmp 0x1005e23
cmp eax, 2
jne 0x1005e23
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.01009336
leave
ret 4
Function at 0x1005e35
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bffc]
mov ecx, dword [ebp + 0xc]
push esi
push edi
lea edx, [ebp - 0x2d4]
push edx
lea edx, [ebp - 0x2cc]
push edx
lea edx, [ebp - 0x2dc]
push edx
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
mov esi, 0x2c8
push eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2d4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1005f9a
push 3
pop ecx
cmp dword [ebp - 0x2dc], ecx
jne 0x1005f9a
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x304], eax
lea eax, [ebp - 0x1e8]
mov dword [ebp - 0x2fc], eax
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0xd4]
mov dword [ebp - 0x310], edi
mov dword [ebp - 0x308], 1
mov dword [ebp - 0x300], 2
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2f0], 4
mov dword [ebp - 0x2e8], 5
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2d0], edi
push ebx
mov eax, dword [ebp - 0x2d0]
mov edi, dword [ebp + eax*8 - 0x30c]
push 0x1002244
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005f55
push edi
call fcn.01005cd4
push 0x20
push 0x1002260
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc dword [ebp - 0x2d0]
cmp dword [ebp - 0x2d0], 6
jb 0x1005f21
cmp dword [ebp - 0x2d4], esi
pop ebx
jae 0x1005f7c
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0x2cc]
push eax
push 3
push 0
push dword [ebp - 0x2d8]
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01009336
leave
ret 8

Function at 0x1005fad
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100bffc]
push esi
lea ecx, [ebp - 0x210]
push ecx
push 0xf003f
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1002170
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1006041
push ebx
xor ebx, ebx
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
inc ebx
test esi, esi
jne 0x1006034
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.01005e35
jmp 0x1005fe7
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp esi, 2
jne 0x1006048
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01009336
leave
ret 4
Function at 0x100637e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100bffc]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x210]
push edx
push 3
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006449
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call fcn.01006228
cmp dword [ebp + 0x18], esi
je 0x100640d
cmp dword [ebp + 0x1c], esi
jne 0x1006400
cmp eax, esi
jne 0x1006400
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01006333
test eax, eax
je 0x100643d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push edi
jmp 0x100642e
cmp dword [ebp + 0x1c], esi
jne 0x1006428
cmp eax, esi
jne 0x100643d
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x100643d
push esi
push 0x10013ac
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009336
leave
ret 0x18

Function at 0x10064a7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
xor esi, esi
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10064f7
cmp dword [ebp + 0x10], esi
push 4
setne al
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc