joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010e61
Capabilities:
Create directory

Disassembly:
push 4
mov eax, 0x101cb045
call fcn.10096f31
mov eax, dword [0x1020db10]
xor esi, esi
mov dword [ebp - 0x10], eax
and dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x10010e92
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.10010a5f
pop ecx
pop ecx
test eax, eax
je 0x10010e92
inc esi
cmp dword [0x10265fe8], 0
je 0x10010eb8
push dword [ebp - 0x10]
push esi
push str.COverlongPathApi::CreateDirectoryW_bChangeToLongPath__d__wstrLongPath__s_
push str.COverlongPathApi
push 0xffffffffffffffff
push 0x10265f7c
call fcn.10024f9f
add esp, 0x18
push dword [ebp + 0xc]
test esi, esi
jne 0x10010ede
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100cc680
mov eax, esi
call fcn.10097009
ret
push dword [ebp - 0x10]
jmp 0x10010ec2

Function at 0x100112da
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100112e9
xor eax, eax
jmp 0x10011337
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001130f
test al, 0x10
jne 0x10011327
push 0x80
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10011327
push edi
call fcn.10010f8b
pop ecx
test eax, eax
je 0x10011336
cmp dword [ebp + 0xc], 0
je 0x10011333
push dword [ebp + 0xc]
push edi
call esi
xor eax, eax
inc eax
pop esi
pop edi
pop ebp
ret

Function at 0x10014e11
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10246460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
lea esi, [eax + 0x18]
mov eax, dword [esi]
cmp dword [eax - 8], 0
jne 0x10014e70
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10097040
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.100cc900
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10096f22
leave
ret
Function at 0x10014f23
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0
mov eax, 0x101cbc1c
call fcn.10096f31
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor ebx, ebx
cmp dword [eax - 8], ebx
je 0x10014fc2
cmp dword [ebp + 0x10], ebx
je 0x10014fc2
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
call fcn.100cbee0
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 0xc]
push edi
mov ecx, esi
call fcn.100cc810
mov dword [ebp + 0x10], ebx
mov ebx, 0x3e8
cmp dword [ebp + 0x10], 0
push dword [ebp + 8]
jne 0x10014f80
push dword [edi]
push 0x101e78cc
push esi
call fcn.100cf610
add esp, 0x10
jmp 0x10014f93
push dword [ebp + 0x10]
push dword [edi]
push 0x101e8844
push esi
call fcn.100cf610
add esp, 0x14
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10014fa8
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], ebx
jb 0x10014f65
xor eax, eax
cmp dword [ebp + 0x10], ebx
setne al
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100cc680
mov eax, esi
jmp 0x10014fc4
xor eax, eax
call fcn.10097009
ret 0xc
Function at 0x1001c2cd
Capabilities:
Read .ini file

Disassembly:
push 0xe1c
mov eax, 0x101ccf69
call fcn.10096f9a
xor ebx, ebx
cmp dword [0x1025df34], ebx
jne 0x1001c504
push 0x3ff
lea eax, [ebp - 0x617]
push ebx
push eax
mov dword [0x1025df34], 1
mov byte [ebp - 0x618], bl
call fcn.10097040
xor eax, eax
push 0x7fe
mov word [ebp - 0xe18], ax
lea eax, [ebp - 0xe16]
push ebx
push eax
mov dword [ebp - 0xe1c], ebx
call fcn.10097040
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.10097040
add esp, 0x24
push str.OAgent.ini
call fcn.10001f61
push eax
lea eax, [ebp - 0x218]
push 0x101e3850
push eax
call fcn.100987f3
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
mov esi, 0x400
push esi
lea eax, [ebp - 0xe18]
push eax
push 0x101e3ae4
push 0x101e9108
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
jbe 0x1001c3bd
cmp word [ebp - 0x61a], bx
jne 0x1001c3bd
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0xe18]
push eax
call fcn.100dff30
add esp, 0xc
mov dword [ebp - 0xe1c], eax
cmp dword [ebp - 0xe1c], ebx
jne 0x1001c4cb
lea ecx, [ebp - 0xe24]
call fcn.100db540
mov dword [ebp - 4], ebx
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xe24]
call fcn.100db6b0
mov edi, 0x101e919c
test eax, eax
je 0x1001c449
lea eax, [ebp - 0xe1c]
push eax
push edi
lea ecx, [ebp - 0xe24]
call fcn.100dbad0
mov dword [ebp - 0xe28], eax
cmp eax, ebx
je 0x1001c449
cmp dword [ebp - 0xe1c], esi
jae 0x1001c437
push dword [ebp - 0xe1c]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.100970c0
add esp, 0xc
jmp 0x1001c43d
mov dword [ebp - 0xe1c], ebx
push dword [ebp - 0xe28]
call fcn.100639b7
pop ecx
lea ecx, [ebp - 0xe24]
call fcn.100db700
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe24]
call fcn.100db630
cmp dword [ebp - 0xe1c], ebx
jne 0x1001c4cb
push 0x800
lea eax, [ebp - 0xe18]
push ebx
push eax
call fcn.10097040
add esp, 0xc
push esi
lea eax, [ebp - 0xe18]
push eax
push 0x101e3ae4
push edi
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x1001c4c3
cmp word [ebp - 0x61a], bx
jne 0x1001c4c3
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0xe18]
push eax
call fcn.100dff30
add esp, 0xc
mov dword [ebp - 0xe1c], eax
cmp dword [ebp - 0xe1c], ebx
je 0x1001c504
cmp dword [ebp - 0xe1c], 4
jbe 0x1001c504
cmp dword [ebp - 0x618], 1
je 0x1001c504
movzx eax, word [ebp - 0x5fc]
lea eax, [eax + eax + 0x22]
cmp eax, ebx
je 0x1001c504
mov ecx, dword [ebp - 0xe1c]
add ecx, 0xfffffffc
cmp eax, ecx
ja 0x1001c504
mov eax, dword [ebp - 0x610]
mov dword [0x1025df30], eax
call fcn.1009701d
ret
Function at 0x1001ce7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x1001cea3
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
jmp 0x1001cea6
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x1001cf74
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1001cf65
mov eax, dword [ebp - 8]
cmp eax, 4
jne 0x1001cf12
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1001cf65
call fcn.1001ca70
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
je 0x1001cf0e
push eax
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001cf76
cmp eax, 1
je 0x1001cf2b
cmp eax, 2
je 0x1001cf2b
cmp eax, 6
je 0x1001cf2b
cmp eax, 7
je 0x1001cf2b
cmp eax, 3
jne 0x1001cf65
push dword [ebp - 4]
call fcn.1009968a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1001cf65
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1001cf5e
call fcn.1001ca70
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
jmp 0x1001ceff
push ebx
call fcn.10099533
pop ecx
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
je 0x1001cf74
push eax
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001cf7b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
je 0x1001cfa0
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov edi, eax
jmp 0x1001cfa3
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x1001cff6
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push edi
call esi
test eax, eax
jne 0x1001cfea
cmp dword [ebp + 0xc], 4
jne 0x1001cfea
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x10]
push edi
call esi
test eax, eax
jne 0x1001cfea
cmp edi, dword [ebp + 8]
je 0x1001cfe6
push edi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001cff8
cmp edi, dword [ebp + 8]
je 0x1001cff6
push edi
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001cffd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
je 0x1001d022
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov edi, eax
jmp 0x1001d025
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x1001d080
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push edi
call esi
test eax, eax
jne 0x1001d074
cmp dword [ebp - 4], 3
jne 0x1001d074
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0xc]
jb 0x1001d074
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x10]
push edi
call esi
test eax, eax
jne 0x1001d074
cmp edi, dword [ebp + 8]
je 0x1001d070
push edi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d082
cmp edi, dword [ebp + 8]
je 0x1001d080
push edi
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d087
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
je 0x1001d0ac
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov ebx, eax
jmp 0x1001d0af
mov ebx, dword [ebp + 8]
cmp ebx, esi
je 0x1001d125
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
call esi
test eax, eax
jne 0x1001d119
cmp dword [ebp - 4], 3
jne 0x1001d119
push dword [ebp + 0xc]
call fcn.1009968a
mov edi, eax
pop ecx
test edi, edi
je 0x1001d119
lea eax, [ebp + 0xc]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push ebx
call esi
test eax, eax
jne 0x1001d112
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, dword [ebp + 8]
je 0x1001d10e
push ebx
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d127
push edi
call fcn.10099533
pop ecx
cmp ebx, dword [ebp + 8]
je 0x1001d125
push ebx
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001d12c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
je 0x1001d151
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov edi, eax
jmp 0x1001d154
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x1001d1c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push edi
call esi
test eax, eax
jne 0x1001d1b4
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x1001d189
cmp eax, 2
je 0x1001d189
cmp eax, 6
je 0x1001d189
cmp eax, 7
jne 0x1001d1b4
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0xc]
jb 0x1001d1b4
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x10]
push edi
call esi
test eax, eax
jne 0x1001d1b4
cmp edi, dword [ebp + 8]
je 0x1001d1b0
push edi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d1c2
cmp edi, dword [ebp + 8]
je 0x1001d1c0
push edi
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d1c7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
je 0x1001d1ec
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov ebx, eax
jmp 0x1001d1ef
mov ebx, dword [ebp + 8]
cmp ebx, esi
je 0x1001d27e
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
call esi
test eax, eax
jne 0x1001d272
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x1001d228
cmp eax, 2
je 0x1001d228
cmp eax, 6
je 0x1001d228
cmp eax, 7
jne 0x1001d272
push dword [ebp + 0xc]
call fcn.1009968a
mov edi, eax
pop ecx
test edi, edi
je 0x1001d272
lea eax, [ebp + 0xc]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push ebx
call esi
test eax, eax
jne 0x1001d26b
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1001d25b
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
cmp ebx, dword [ebp + 8]
je 0x1001d267
push ebx
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d280
push edi
call fcn.10099533
pop ecx
cmp ebx, dword [ebp + 8]
je 0x1001d27e
push ebx
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001d319
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
je 0x1001d33e
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov ebx, eax
jmp 0x1001d341
mov ebx, dword [ebp + 8]
cmp ebx, esi
je 0x1001d3e9
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
call esi
test eax, eax
jne 0x1001d3dd
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x1001d37a
cmp eax, 2
je 0x1001d37a
cmp eax, 6
je 0x1001d37a
cmp eax, 7
jne 0x1001d3dd
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.100639c2
mov edi, eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
push 0
push edi
call fcn.10097040
add esp, 0x10
lea eax, [ebp + 0xc]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push ebx
call esi
push edi
test eax, eax
jne 0x1001d3c9
mov ecx, dword [ebp + 0x14]
call fcn.100cc900
cmp ebx, dword [ebp + 8]
je 0x1001d3be
push ebx
call fcn.1001ce68
pop ecx
push edi
call fcn.100639cd
pop ecx
mov al, 1
jmp 0x1001d3eb
call fcn.100639cd
mov ecx, dword [ebp + 0x14]
mov dword [esp], 0x101e3ae4
call fcn.100cc900
cmp ebx, dword [ebp + 8]
je 0x1001d3e9
push ebx
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d3f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, eax
je 0x1001d412
push 0x20006
push dword [ebp + 8]
push ebx
call fcn.1001ce3b
add esp, 0xc
mov edi, eax
jmp 0x1001d414
mov edi, ebx
test edi, edi
je 0x1001d470
mov eax, dword [esi]
cmp eax, 4
jne 0x1001d426
push eax
add esi, eax
push esi
push eax
jmp 0x1001d446
cmp eax, 1
je 0x1001d43f
cmp eax, 2
je 0x1001d43f
cmp eax, 6
je 0x1001d43f
cmp eax, 7
je 0x1001d43f
cmp eax, 3
jne 0x1001d465
push dword [esi + 8]
push dword [esi + 4]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001d465
cmp edi, ebx
je 0x1001d461
push edi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d472
cmp edi, ebx
je 0x1001d470
push edi
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebp
ret

Function at 0x1001d476
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x1001d495
push 0x20006
push dword [ebp + 8]
push edi
call fcn.1001ce3b
add esp, 0xc
mov esi, eax
jmp 0x1001d497
mov esi, edi
test esi, esi
je 0x1001d4cd
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001d4c2
cmp esi, edi
je 0x1001d4be
push esi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d4cf
cmp esi, edi
je 0x1001d4cd
push esi
call fcn.1001ce68
pop ecx
xor al, al
pop esi
pop ebp
ret
Function at 0x1001d4d2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x1001d4f1
push 0x20006
push dword [ebp + 8]
push edi
call fcn.1001ce3b
add esp, 0xc
mov esi, eax
jmp 0x1001d4f3
mov esi, edi
test esi, esi
je 0x1001d529
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001d51e
cmp esi, edi
je 0x1001d51a
push esi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d52b
cmp esi, edi
je 0x1001d529
push esi
call fcn.1001ce68
pop ecx
xor al, al
pop esi
pop ebp
ret

Function at 0x1001d52e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x1001d54d
push 0x20006
push dword [ebp + 8]
push edi
call fcn.1001ce3b
add esp, 0xc
mov esi, eax
jmp 0x1001d54f
mov esi, edi
test esi, esi
je 0x1001d590
push dword [ebp + 0x10]
call fcn.10097626
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001d585
cmp esi, edi
je 0x1001d581
push esi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d592
cmp esi, edi
je 0x1001d590
push esi
call fcn.1001ce68
pop ecx
xor al, al
pop esi
pop ebp
ret
Function at 0x1001d5da
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x1001d5fe
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
jmp 0x1001d601
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x14], edi
jbe 0x1001d62a
push dword [ebx + esi*4]
call fcn.10097626
push eax
push 0x20
push dword [ebx + esi*4]
call fcn.10097040
add esp, 0x10
inc esi
cmp esi, dword [ebp + 0x14]
jb 0x1001d60e
cmp dword [ebp + 0xc], edi
je 0x1001d6da
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x14]
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp + 0x14], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1001d6cb
cmp dword [ebp + 0x14], edi
jbe 0x1001d6cb
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100639c2
mov esi, eax
pop ecx
cmp esi, edi
je 0x1001d6cb
cmp dword [ebp + 0x14], edi
jbe 0x1001d6b1
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
inc eax
push eax
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1001d6a9
mov eax, dword [ebp - 8]
push esi
push dword [eax]
call fcn.10097591
add dword [ebp - 8], 4
pop ecx
pop ecx
inc edi
cmp edi, dword [ebp + 0x14]
jb 0x1001d683
jmp 0x1001d6b4
mov ebx, dword [ebp + 0xc]
push esi
call fcn.100639cd
pop ecx
cmp ebx, dword [ebp + 8]
je 0x1001d6c7
push ebx
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d6dc
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
je 0x1001d6da
push eax
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d6e1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1001d780
cmp dword [ebp - 8], ebx
je 0x1001d775
inc dword [ebp - 4]
push dword [ebp - 4]
call fcn.1009968a
mov esi, eax
pop ecx
cmp esi, ebx
je 0x1001d780
push dword [ebp - 4]
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1001d779
push 0x2001f
push esi
push dword [ebp + 8]
call fcn.1001ce17
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x1001d779
push edi
call fcn.1001d6e1
pop ecx
push edi
test al, al
je 0x1001d787
call fcn.1001ce68
pop ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1001d779
dec dword [ebp - 8]
jne 0x1001d720
push esi
call fcn.10099533
pop ecx
mov al, 1
jmp 0x1001d782
push esi
call fcn.10099533
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
call fcn.1001ce68
push esi
call fcn.10099533
pop ecx
jmp 0x1001d77f
Function at 0x1001d795
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x1001d7b4
push 0x2001f
push dword [ebp + 8]
push edi
call fcn.1001ce17
add esp, 0xc
mov esi, eax
jmp 0x1001d7b6
mov esi, edi
test esi, esi
je 0x1001d80f
cmp dword [ebp + 0xc], 0
je 0x1001d7dd
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1001d804
cmp esi, edi
je 0x1001d7d9
push esi
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001d811
push esi
call fcn.1001d6e1
pop ecx
test al, al
je 0x1001d804
cmp esi, edi
je 0x1001d7f3
push esi
call fcn.1001ce68
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
jmp 0x1001d811
cmp esi, edi
je 0x1001d80f
push esi
call fcn.1001ce68
pop ecx
xor al, al
pop esi
pop ebp
ret

Function at 0x1001dfa6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
je 0x1001dfcb
push 0x20019
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001ce17
add esp, 0xc
mov ebx, eax
jmp 0x1001dfce
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
call fcn.100d2020
cmp ebx, esi
je 0x1001e070
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push ebx
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1001e064
cmp dword [ebp + 0xc], esi
jbe 0x1001e064
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100639c2
mov edi, eax
pop ecx
cmp edi, esi
je 0x1001e064
cmp dword [ebp + 0xc], esi
jbe 0x1001e04d
mov eax, dword [ebp - 4]
inc eax
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1001e047
mov ecx, dword [ebp + 0x10]
push edi
call fcn.1000575c
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x1001e02c
push edi
call fcn.100639cd
pop ecx
cmp ebx, dword [ebp + 8]
je 0x1001e060
push ebx
call fcn.1001ce68
pop ecx
mov al, 1
jmp 0x1001e072
cmp ebx, dword [ebp + 8]
je 0x1001e070
push ebx
call fcn.1001ce68
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001fac7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1001fafd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x1001fafc
push dword [edi + 0xc]
call esi
push eax
call fcn.10067c2e
pop esi
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
leave
ret