joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b11b8
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, 0x80070057
test ebx, ebx
jne 0x10b11ee
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b12bf
test byte [eax + 0x1c], 1
je 0x10b12bf
push 0x100ac18
push 0xc
jmp 0x10b1215
cmp dword [ebp + 0xc], 0
jne 0x10b1225
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b12bf
test byte [eax + 0x1c], 1
je 0x10b12bf
push 0x100ac18
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10b12bf
push esi
push 0x1001900
mov esi, 0x104
push esi
push ebx
call fcn.0104dd86
mov edi, eax
test edi, edi
jge 0x10b1259
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b12be
test byte [eax + 0x1c], 1
je 0x10b12be
push edi
push 0x100ac18
push 0xe
jmp 0x10b1283
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0104dd86
mov edi, eax
test edi, edi
jge 0x10b1290
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b12be
test byte [eax + 0x1c], 1
je 0x10b12be
push edi
push 0x100ac18
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
jmp 0x10b12be
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10b12bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10b12bc
test eax, eax
jle 0x10b12b8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10b12be
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10b19ea
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x22c], ax
xor ebx, ebx
lea eax, [ebp - 0x22a]
push ebx
push eax
call sub.msvcrt.dll_memset
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
xor eax, eax
mov dword [ebp - 0x238], ebx
lea edi, [ebp - 0x234]
push 0x100add0
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push 0x104
push eax
mov dword [ebp - 0x230], ebx
call fcn.010ad159
mov esi, eax
add esp, 0x1c
cmp esi, ebx
jge 0x10b1a94
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b1b9b
test byte [eax + 0x1c], 1
je 0x10b1b9b
push esi
push 0x100ac18
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x10b1b96
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push 0x10041cc
push 0x10
push eax
call fcn.010ad159
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x10b1ad4
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b1b9b
test byte [eax + 0x1c], 1
je 0x10b1b9b
push esi
push 0x100ac18
push 0x23
jmp 0x10b1a89
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
cmp dword [ebp + 0x18], ebx
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10b1b6a
cmp dword [ebp - 0x230], ebx
je 0x10b1b74
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x14]
push 8
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x238]
push eax
push 0xb
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10b1b66
jle 0x10b1b48
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b1b9b
test byte [ecx + 0x1c], 1
je 0x10b1b9b
push eax
push 0x100ac18
push 0x25
jmp 0x10b1b90
xor esi, esi
jmp 0x10b1b9b
jle 0x10b1b74
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b1b9b
test byte [ecx + 0x1c], 1
je 0x10b1b9b
push eax
push 0x100ac18
push 0x24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010294b2
cmp dword [ebp - 0x230], ebx
je 0x10b1baf
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0c4b
leave
ret 0x14
Function at 0x10b3f77
Capabilities:
Read http header
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 8], ebx
call fcn.010b0a95
push ebx
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov ecx, esi
mov edi, eax
call fcn.010b0ace
cmp edi, ebx
jne 0x10b3fd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010ae4eb
mov edi, eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b4144
test byte [eax + 0x1c], 1
je 0x10b4144
push edi
push 0x100ab68
push 0x3e
jmp 0x10b4006
mov ecx, esi
call fcn.010b367f
mov edi, eax
cmp edi, ebx
jge 0x10b4016
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b4144
test byte [eax + 0x1c], 1
je 0x10b4144
push edi
push 0x100ab68
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
jmp 0x10b4144
mov ecx, esi
mov dword [ebp - 8], 4
call fcn.010b0a95
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x2d8]
push eax
push ebx
push 0x20000013
push dword [esi + 8]
call edi
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
je 0x10b4104
xor eax, eax
cmp dword [ebp + 8], eax
je 0x10b4104
push eax
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
push 0x4000000b
push dword [esi + 8]
mov dword [ebp + 8], 0x10
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x10b40b4
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b40ab
test byte [eax + 0x1c], 1
je 0x10b40ab
call ebx
push eax
mov eax, dword [0x10ed030]
push 0x100ab68
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov dword [ebp - 4], 1
jmp 0x10b4104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x10b40f2
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b40f2
test byte [eax + 0x1c], 1
je 0x10b40f2
call ebx
push eax
mov eax, dword [0x10ed030]
push 0x100ab68
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x2e8], ecx
mov dword [esi + 0x2ec], eax
mov ecx, esi
call fcn.010b0ace
xor edi, edi
cmp dword [ebp - 4], edi
jne 0x10b4144
call ebx
push eax
call fcn.010ae4eb
mov edi, eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b4144
test byte [eax + 0x1c], 1
je 0x10b4144
push dword [ebp - 8]
push edi
push 0x100ab68
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cb22
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10b5e02
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x2c]
xor ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x10b5e39
cmp dword [eax + 0xc], 0
je 0x10b5e39
cmp dword [eax], 0
je 0x10b5e39
push dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push dword [ebp + 0xc]
call dword [eax + 0xc]
mov ebx, eax
mov esi, dword [esi + 0x28]
test esi, esi
je 0x10b5e6e
mov esi, dword [esi]
test esi, esi
je 0x10b5e6e
cmp dword [ebp + 0xc], 0
jl 0x10b5e6e
cmp dword [ebp + 8], 0xc8
je 0x10b5e67
cmp dword [ebp + 8], 0x193
je 0x10b5e67
cmp dword [ebp + 8], 0xc9
jne 0x10b5e6e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x10b5fd2
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, ecx
mov dword [ebp - 4], eax
cmp edi, eax
jne 0x10b6016
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b600c
test byte [eax + 0x1c], 1
je 0x10b600c
push 0x100b054
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, 0x80070057
jmp 0x10b61ed
push ebx
push eax
push 0x80
push 3
push eax
xor ebx, ebx
inc ebx
push ebx
push 0x80010000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10b606f
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b605c
test byte [eax + 0x1c], bl
je 0x10b605c
push edi
push 0x100b054
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010ae4eb
mov edi, eax
jmp 0x10b61d0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0x78
jae 0x10b60ae
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b60a4
test byte [eax + 0x1c], bl
je 0x10b60a4
push edi
push 0x100b054
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
mov edi, 0x8007000b
jmp 0x10b61c7
push eax
call fcn.010a0a62
pop ecx
mov dword [esi + 8], eax
test eax, eax
jne 0x10b60ec
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b60e2
test byte [eax + 0x1c], bl
je 0x10b60e2
push dword [esi + 0xc]
push 0x100b054
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov edi, 0x8007000e
jmp 0x10b61c7
push 0
lea ecx, [ebp - 4]
push ecx
push dword [esi + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10b6139
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b6126
test byte [eax + 0x1c], bl
je 0x10b6126
push 0x100b054
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010ae4eb
mov edi, eax
jmp 0x10b61c7
mov eax, dword [esi + 0xc]
cmp dword [ebp - 4], eax
je 0x10b615b
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b61be
test byte [eax + 0x1c], bl
je 0x10b61be
push 0x100b054
push 0x26
jmp 0x10b61b3
push eax
push dword [esi + 8]
call fcn.010bac8e
mov edi, eax
test edi, edi
jge 0x10b618f
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b61c7
test byte [eax + 0x1c], bl
je 0x10b61c7
push 0x100b054
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10b61c7
push dword [esi + 8]
call fcn.010bad24
test eax, eax
jne 0x10b61c5
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b61be
test byte [eax + 0x1c], bl
je 0x10b61be
push 0x100b054
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov edi, 0x80004005
jmp 0x10b61c7
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
test edi, edi
jge 0x10b61eb
mov eax, dword [esi + 8]
test eax, eax
je 0x10b61eb
push eax
call fcn.010a0a51
and dword [esi + 8], 0
and dword [esi + 0xc], 0
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x10ba4a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
add eax, eax
push ebx
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
je 0x10ba5b3
cmp word [eax], bx
je 0x10ba5b3
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x10ba598
cmp word [edi], bx
je 0x10ba598
cmp dword [ebp + 0x14], ebx
jne 0x10ba50c
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba5d7
test byte [eax + 0x1c], 1
je 0x10ba5d7
push 0x100b42c
push 0xc
jmp 0x10ba5cc
push esi
lea ecx, [ebp + 0x18]
push ecx
mov ecx, dword [0x10f1644]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x10ba585
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
jne 0x10ba585
cmp dword [ebp - 4], 1
je 0x10ba585
mov eax, dword [0x10ed030]
push 0xd
pop esi
cmp eax, 0x10ed030
je 0x10ba585
test byte [eax + 0x1c], 1
je 0x10ba585
push dword [ebp - 4]
push edi
push 0x100b42c
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
cmp dword [ebp + 0x18], ebx
je 0x10ba593
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10ba5da
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba5d7
test byte [eax + 0x1c], 1
je 0x10ba5d7
push 0x100b42c
push 0xb
jmp 0x10ba5cc
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba5d7
test byte [eax + 0x1c], 1
je 0x10ba5d7
push 0x100b42c
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x14
Function at 0x10ba5e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], edi
cmp eax, edi
je 0x10ba6fa
cmp word [eax], di
je 0x10ba6fa
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x10ba6df
cmp word [ebx], di
je 0x10ba6df
cmp dword [ebp + 0x14], edi
jne 0x10ba651
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba71e
test byte [eax + 0x1c], 1
je 0x10ba71e
push 0x100b42c
push 0x16
jmp 0x10ba713
push esi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10f1644]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10ba6cc
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
je 0x10ba6cc
cmp dword [ebp - 8], 4
je 0x10ba6cc
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba6c9
test byte [eax + 0x1c], 1
je 0x10ba6c9
push dword [ebp - 8]
push ebx
push 0x100b42c
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
push 0xd
pop esi
cmp dword [ebp - 4], edi
je 0x10ba6da
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10ba721
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba71e
test byte [eax + 0x1c], 1
je 0x10ba71e
push 0x100b42c
push 0x15
jmp 0x10ba713
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba71e
test byte [eax + 0x1c], 1
je 0x10ba71e
push 0x100b42c
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x10ba72c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x10ba820
cmp word [eax], di
je 0x10ba820
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
je 0x10ba805
cmp word [ebx], di
je 0x10ba805
push esi
push edi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10f1644]
push dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20006
push ecx
push edi
push edi
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
je 0x10ba7b3
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba7f2
test byte [eax + 0x1c], 1
je 0x10ba7f2
push esi
push dword [ebp + 0xc]
push 0x100b42c
push 0x1a
jmp 0x10ba7e7
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x10ba7f2
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba7f2
test byte [eax + 0x1c], 1
je 0x10ba7f2
push esi
push ebx
push 0x100b42c
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
cmp dword [ebp - 4], edi
je 0x10ba800
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10ba847
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba844
test byte [eax + 0x1c], 1
je 0x10ba844
push 0x100b42c
push 0x19
jmp 0x10ba839
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba844
test byte [eax + 0x1c], 1
je 0x10ba844
push 0x100b42c
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x14
Function at 0x10ba852
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x10ba966
cmp word [eax], di
je 0x10ba966
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x10ba94b
cmp word [ebx], di
je 0x10ba94b
cmp dword [ebp + 0x14], edi
jne 0x10ba8be
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba98a
test byte [eax + 0x1c], 1
je 0x10ba98a
push 0x100b42c
push 0x1e
jmp 0x10ba97f
push esi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10f1644]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10ba938
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x10ba938
cmp dword [ebp - 8], 0xb
je 0x10ba938
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba935
test byte [eax + 0x1c], 1
je 0x10ba935
push dword [ebp - 8]
push ebx
push 0x100b42c
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
push 0xd
pop esi
cmp dword [ebp - 4], edi
je 0x10ba946
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10ba98d
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba98a
test byte [eax + 0x1c], 1
je 0x10ba98a
push 0x100b42c
push 0x1d
jmp 0x10ba97f
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10ba98a
test byte [eax + 0x1c], 1
je 0x10ba98a
push 0x100b42c
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x10ba998
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x10baa8c
cmp word [eax], di
je 0x10baa8c
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
je 0x10baa71
cmp word [ebx], di
je 0x10baa71
push esi
push edi
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10f1644]
push dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20006
push ecx
push edi
push edi
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
je 0x10baa1f
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10baa5e
test byte [eax + 0x1c], 1
je 0x10baa5e
push esi
push dword [ebp + 0xc]
push 0x100b42c
push 0x22
jmp 0x10baa53
push 8
lea eax, [ebp + 0x18]
push eax
push 0xb
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x10baa5e
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10baa5e
test byte [eax + 0x1c], 1
je 0x10baa5e
push esi
push ebx
push 0x100b42c
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
cmp dword [ebp - 4], edi
je 0x10baa6c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x10baab3
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10baab0
test byte [eax + 0x1c], 1
je 0x10baab0
push 0x100b42c
push 0x21
jmp 0x10baaa5
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10baab0
test byte [eax + 0x1c], 1
je 0x10baab0
push 0x100b42c
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x18

Function at 0x10baabe
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x10bab4a
cmp word [eax], di
je 0x10bab4a
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x10bab2f
cmp word [esi], di
je 0x10bab2f
push ebx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x10f1644]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20006
push ecx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x10bab1c
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp dword [ebp - 4], edi
je 0x10bab2a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
jmp 0x10bab71
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bab6e
test byte [eax + 0x1c], 1
je 0x10bab6e
push 0x100b42c
push 0x25
jmp 0x10bab63
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bab6e
test byte [eax + 0x1c], 1
je 0x10bab6e
push 0x100b42c
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x10bb4e6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10bb650
cmp word [esi], bx
je 0x10bb650
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x10bb635
cmp word [eax], bx
je 0x10bb635
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x10bb61a
cmp word [edi], bx
je 0x10bb61a
lea eax, [ebp - 8]
push eax
push 0x7fffffff
push edi
call fcn.0104dde0
cmp eax, ebx
jge 0x10bb576
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10bb56e
test byte [ecx + 0x1c], 1
je 0x10bb56e
push eax
push 0x100b42c
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010294b2
push 0x57
pop esi
jmp 0x10bb608
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x10f1644]
push dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push ebx
push ebx
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x10bb5c4
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bb608
test byte [eax + 0x1c], 1
je 0x10bb608
push esi
push dword [ebp + 0xc]
push 0x100b42c
push 0x12
jmp 0x10bb5fd
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x10bb608
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bb608
test byte [eax + 0x1c], 1
je 0x10bb608
push esi
push edi
push 0x100b42c
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
cmp dword [ebp - 4], ebx
je 0x10bb616
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10bb677
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bb674
test byte [eax + 0x1c], 1
je 0x10bb674
push 0x100b42c
push 0x10
jmp 0x10bb669
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bb674
test byte [eax + 0x1c], 1
je 0x10bb674
push 0x100b42c
push 0xf
jmp 0x10bb669
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10bb674
test byte [eax + 0x1c], 1
je 0x10bb674
push 0x100b42c
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0x57
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x14