joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040336
Capabilities:
Link many functions at runtime

Disassembly:
push 0xc
mov eax, 0x10164806
call fcn.10163eac
mov esi, ecx
mov dword [ebp - 0x14], esi
push 1
push 0x10018c60
lea ecx, [esi + 0x18]
call fcn.1003ff5c
xor edi, edi
push 0x10018c7c
mov dword [ebp - 4], edi
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018c94
push dword [esi + 0x1c]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018cac
push dword [esi + 0x1c]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018cc4
push dword [esi + 0x1c]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018ce0
push dword [esi + 0x1c]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018cfc
push dword [esi + 0x1c]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
cmp dword [esi], edi
je 0x100403e4
cmp dword [esi + 4], edi
je 0x100403e4
cmp dword [esi + 8], edi
je 0x100403e4
cmp dword [esi + 0xc], edi
je 0x100403e4
cmp dword [esi + 0x10], edi
je 0x100403e4
test eax, eax
je 0x100403e4
mov eax, esi
call fcn.10163e7a
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100403f9
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1004041f
test byte [eax + 0x44], 1
je 0x1004041f
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0xa
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0x10]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x10040c0c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x10164915
call fcn.10163eac
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1005dfbc
cmp dword [ebp - 0x10], ebx
je 0x10040c42
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x10018d70
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0x10040c6f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10040d55
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 0
je 0x10040c87
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x24]
push eax
push 0x18
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test esi, esi
jne 0x10040cf3
cmp dword [ebp - 0x18], 4
jne 0x10040cc1
cmp dword [ebp - 0x24], 4
jne 0x10040cc1
cmp dword [ebp - 0x1c], eax
jmp 0x10040cf6
mov eax, dword [0x101923c0]
mov esi, 0x8000ffff
cmp eax, 0x101923c0
je 0x10040d7b
test byte [eax + 0x44], 1
je 0x10040d7b
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x1a
jmp 0x10040d75
cmp esi, 2
je 0x10040d3e
test esi, esi
jle 0x10040d07
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x10040d2b
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10040d7b
test byte [eax + 0x44], 1
je 0x10040d7b
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x1b
jmp 0x10040d75
cmp dword [ebp - 0x10], 0
je 0x10040d3a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10040d4f
cmp dword [ebp - 0x10], 0
je 0x10040d4d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
call fcn.10163e7a
ret
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10040d7b
test byte [eax + 0x44], 1
je 0x10040d7b
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x19
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0x20]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x10040d92
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xc
mov eax, 0x10164940
call fcn.10163eac
mov bl, dl
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1005dfbc
cmp dword [ebp - 0x10], 0
je 0x10040dcc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push 0x10018d70
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x10040df6
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10040ed0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x10040e0f
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x10040e7c
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 4
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x10040e3f
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x10040ebb
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10040e67
test byte [eax + 0x44], 1
je 0x10040e67
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x1d
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0x14]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
jmp 0x10040f06
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jle 0x10040e97
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x10040ebb
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10040ef6
test byte [eax + 0x44], 1
je 0x10040ef6
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x1e
jmp 0x10040ef0
cmp dword [ebp - 0x10], 0
je 0x10040eca
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10163e7a
ret
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10040ef6
test byte [eax + 0x44], 1
je 0x10040ef6
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x1c
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0x18]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x10041c29
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
mov ebx, edx
push esi
push 0x8100080
push 2
push esi
push esi
push 0x40000000
push ecx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10041c7d
cmp eax, 0xffffffff
je 0x10041c7d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
push esi
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10041c7d
cmp dword [ebp - 4], edi
je 0x10041c92
mov esi, 0x80004004
jmp 0x10041c92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10041c92
movzx esi, si
or esi, 0x80070000
lea ecx, [ebp - 8]
call fcn.1003fe40
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x10041ca3
Capabilities:
Delete file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea ebx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x10041cb3
sub edi, ebx
sar edi, 1
lea eax, [edi*2 + 2]
push eax
push dword [ebp + 8]
push 1
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x10041cf8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
jg 0x10041cef
mov esi, edi
jmp 0x10041cf8
movzx esi, di
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10042b64
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x1019fbfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10042b9d
test byte [eax + 0x44], 4
je 0x10042b9d
push ecx
push edi
push dword [eax + 0x3c]
push dword [eax + 0x38]
call fcn.100402e0
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
mov esi, ebx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, 0x104
jb 0x10042bd6
mov esi, 0x8007007a
jmp 0x10042c13
test eax, eax
jne 0x10042bf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10042bf1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10042bf8
mov esi, 0x80004005
test esi, esi
js 0x10042c13
push 0x10019040
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.1003fcc9
mov esi, eax
push 0x410
lea eax, [ebp - 0x620]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
test esi, esi
js 0x10042c5f
mov eax, 0x10018c4c
cmp byte [ebp + 0xc], bl
jne 0x10042c3b
mov eax, 0x10019070
push edi
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10019078
lea eax, [ebp - 0x620]
push 0x208
push eax
call fcn.1003fd37
add esp, 0x18
mov esi, eax
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10042c90
test byte [eax + 0x44], 4
je 0x10042c90
lea ecx, [ebp - 0x620]
mov edx, 0x1001938c
push ecx
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x4d
pop ecx
call fcn.10040296
mov eax, dword [0x101923c0]
test esi, esi
js 0x10042d54
xor eax, eax
lea edi, [ebp - 0x630]
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x678]
pop edi
push edi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x678], edi
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x678]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10042d3a
push 0xea60
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x10042d0b
cmp eax, 0x102
jne 0x10042d20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10042d20
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x62c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10042d4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10042d4f
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10042d75
test byte [eax + 0x44], 4
je 0x10042d75
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x4e
pop ecx
call fcn.100401e4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101637b0
leave
ret 8
Function at 0x1004382a
Capabilities:
Compare security identifiers

Disassembly:
push 0xcc
mov eax, 0x10164c2c
call fcn.10163edf
mov esi, ecx
lea ecx, [ebp - 0x74]
call fcn.1003f97c
push ecx
push ecx
lea eax, [ebp - 0x74]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.10045284
test al, al
je 0x100438ce
push 0x12
push 1
lea eax, [ebp - 0xd4]
push 0x10018c14
push eax
call fcn.1003f9e2
add esp, 0x10
cmp byte [ebp - 0x2c], bl
je 0x100438b3
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x100438b3
cmp byte [ebp - 0x8c], bl
je 0x100438b3
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x100438b3
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne bl
lea ecx, [ebp - 0xd4]
call fcn.1003faad
lea ecx, [ebp - 0x74]
call fcn.1003faad
mov al, bl
call fcn.10163e8e
ret
mov eax, dword [0x101923c0]
mov esi, 0x8000ffff
cmp eax, 0x101923c0
je 0x100438f9
test byte [eax + 0x44], 1
je 0x100438f9
push esi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x5d
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0xd8]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x100472e1
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x1019fbfc]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.1003fc94
push 0x100195f4
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.1003fcc9
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x10047367
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100473a1
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x100195b8
call fcn.1004701a
mov edi, eax
jmp 0x100473a1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.100471c4
mov ebx, eax
test ebx, ebx
jns 0x10047393
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x100195b8
call fcn.10046ffd
mov edi, ebx
jmp 0x100473a1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x100473ab
push esi
call fcn.10047079
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101637b0
mov esp, ebp
pop ebp
ret 8

Function at 0x10050328
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
test edx, edx
je 0x10050382
xor eax, eax
mov edi, edx
mov dword [ebp - 4], eax
mov esi, eax
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x1005034c
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x10050344
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, 0x80004005
call fcn.1003f8e8
int3
Function at 0x1005038d
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x1019fbfc]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x14]
push esi
push edi
push eax
mov edi, ecx
xor ecx, ecx
push 0x2001f
push ecx
push ebx
push dword [edi]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10050471
cmp dword [esp + 0xc], esi
je 0x100503f3
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
test esi, esi
jne 0x10050471
lea ecx, [esp + 0x20]
push ecx
push esi
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x3c]
push ecx
push esi
push eax
jmp 0x10050440
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.1005038d
mov esi, eax
test esi, esi
jne 0x10050471
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10050415
cmp dword [esp + 0xc], 0
je 0x10050467
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
push ebx
mov ecx, edi
call fcn.10050256
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x10050482
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101637b0
mov esp, ebp
pop ebp
ret 4
Function at 0x1005080b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x10165a77
call fcn.10163f4b
mov edx, dword [ebp + 0x10]
xor esi, esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x420], esi
push 2
pop ecx
push ecx
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x1005086e
call fcn.1003f91e
mov esi, eax
jmp 0x100509a0
push esi
push ebx
push dword [ebp - 0x424]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
jne 0x1005088d
call fcn.1003f91e
jmp 0x10050997
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x430], eax
test eax, eax
je 0x10050883
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x100508e4
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x100508cf
lea ecx, [ebp - 0x420]
call fcn.10054aba
lea ecx, [ebp - 0x428]
call fcn.10044a3f
mov eax, 0x8007000e
jmp 0x100509c6
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x100509ce
jb 0x100508ff
cmp eax, 0xffffffff
ja 0x100509ce
cmp eax, 0x400
jbe 0x1005091a
push eax
lea ecx, [ebp - 0x420]
call fcn.1005556c
mov eax, dword [ebp - 0x420]
jmp 0x10050926
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], eax
mov dword [ebp - 4], 1
jmp 0x10050950
test eax, eax
jne 0x1005095b
mov esi, 0x8007000e
jmp 0x10050999
push ebx
push eax
push ebx
push dword [ebp - 0x430]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10050883
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x438]
push dword [ebp - 0x420]
call fcn.10051363
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x100509b9
lea ecx, [ebp - 0x420]
call fcn.10054aba
lea ecx, [ebp - 0x428]
call fcn.10044a3f
mov eax, esi
call fcn.10163e9d
ret 0x10
mov ecx, 0x80070057
call fcn.1003f8e8
int3
Function at 0x1005d35e
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [edx + 0x14], 8
push esi
jb 0x1005d36d
mov edx, dword [edx]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x1005d391
cmp esi, 2
je 0x1005d391
test esi, esi
jle 0x1005d38f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1005d394
pop esi
leave
ret
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1005d3ba
test byte [eax + 0x44], 1
je 0x1005d3ba
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b314
push dword [eax + 0x38]
push 0x21
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 4]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1005d498
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [edx + 0x14], 8
jb 0x1005d4a6
mov edx, dword [edx]
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x1005d4cb
cmp esi, 2
je 0x1005d4cb
test esi, esi
jle 0x1005d4c9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1005d4ce
pop esi
leave
ret
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1005d4f4
test byte [eax + 0x44], 1
je 0x1005d4f4
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b314
push dword [eax + 0x38]
push 0x24
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 4]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1005d6f6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x101665a8
call fcn.10163eac
mov edi, edx
mov ebx, ecx
xor edx, edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x1005d715
mov eax, dword [edi]
jmp 0x1005d717
mov eax, edi
lea ecx, [ebp - 0x14]
push ecx
push edx
push edx
push edx
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x1005d738
cmp byte [ebp + 8], 0
je 0x1005d7f4
cmp esi, 0xea
je 0x1005d755
test esi, esi
jle 0x1005d74f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1005d7fc
xor eax, eax
lea ecx, [ebp - 0xe]
mov word [ebp - 0xe], ax
xor esi, esi
mov eax, dword [ebp - 0x14]
shr eax, 1
push ecx
inc eax
mov dword [ebp - 0x28], esi
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.1005f6d7
mov dword [ebp - 4], esi
cmp dword [edi + 0x14], 8
jb 0x1005d784
mov edi, dword [edi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
push esi
push esi
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1005d7a7
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1005d7e1
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1005d7cf
test byte [eax + 0x44], 1
je 0x1005d7cf
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b314
push dword [eax + 0x38]
push 0x2a
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0x18]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
jmp 0x1005d832
push dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
call fcn.10045b1f
lea ecx, [ebp - 0x28]
call fcn.10044cdb
call fcn.10163e7a
ret 8
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1005d822
test byte [eax + 0x44], 1
je 0x1005d822
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b314
push dword [eax + 0x38]
push 0x29
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0x10]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1005d8a6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [edx + 0x10], 0
push esi
push edi
push 4
pop edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x1005d8c3
xor edx, edx
jmp 0x1005d8cb
cmp dword [edx + 0x14], 8
jb 0x1005d8cb
mov edx, dword [edx]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1005d8ef
cmp dword [ebp - 4], edi
jae 0x1005d90b
push 0xd
pop esi
cmp esi, 2
jne 0x1005d8fa
cmp byte [ebp + 8], 0
je 0x1005d90b
test esi, esi
jle 0x1005d909
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1005d911
pop edi
pop esi
leave
ret 8
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1005d937
test byte [eax + 0x44], 1
je 0x1005d937
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b314
push dword [eax + 0x38]
push 0x2b
pop ecx
call fcn.100401e4
push esi
lea ecx, [ebp - 0xc]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3