joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d7de
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1001ce8
push eax
call fcn.010027cc
lea ecx, [ebp - 0x210]
push ecx
push 2
push 0
push 0
push eax
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100da4a
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
je 0x100da30
push ebx
push esi
push edi
dec dword [0x105d104]
push 0x5c
call fcn.01002309
test eax, eax
je 0x100d852
mov esi, 0x100da68
jmp 0x100d861
cmp word [0x1001ce8], 0
mov esi, 0x1001ce8
je 0x100d87a
movzx eax, word [esi]
push eax
call fcn.01002309
inc esi
inc esi
test eax, eax
je 0x100da14
cmp word [esi], 0
jne 0x100d861
push 0x5c
call fcn.01002309
mov edi, eax
test edi, edi
je 0x100da14
xor esi, esi
jmp 0x100d8b6
mov ecx, dword [ebp - 0x208]
cmp cx, 0x20
je 0x100d8ca
push ecx
call fcn.01001fe0
test eax, eax
jne 0x100d8ca
cmp esi, 0xff
jae 0x100d8c8
mov word [ebp + esi*2 - 0x204], cx
inc esi
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
je 0x100d8ca
jmp 0x100d88f
xor edi, edi
test edi, edi
je 0x100da14
xor eax, eax
mov edi, 0x100
mov dword [ebp - 0x20c], edi
mov word [ebp + esi*2 - 0x204], ax
call fcn.01002928
push 0x3d
call fcn.01002309
test eax, eax
je 0x100d8fe
push 0x20
call fcn.01002309
push edi
push 0x40
xor ebx, ebx
call dword [fcn.01001188]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov edi, eax
jmp 0x100d991
test edi, edi
je 0x100d9fb
push dword [ebp - 0x208]
call fcn.01001fe0
test eax, eax
jne 0x100d9a8
mov eax, dword [ebp - 0x20c]
lea ecx, [eax - 1]
cmp ebx, ecx
jb 0x100d985
and dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x100
push eax
call fcn.0100e39f
test eax, eax
jl 0x100d9a6
push 2
push dword [ebp - 0x20c]
push esi
call dword [0x1001194]
xor ecx, ecx
test eax, eax
setne cl
mov edi, ecx
test edi, edi
je 0x100d9fb
mov esi, eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x20c], eax
mov ax, word [ebp - 0x208]
mov word [esi + ebx*2], ax
inc ebx
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
je 0x100d9a8
jmp 0x100d916
xor edi, edi
test edi, edi
je 0x100d9fb
lea eax, [ebp - 0x214]
push eax
push 2
pop ecx
mov eax, ebx
mul ecx
push edx
push eax
call fcn.0100d4a6
test eax, eax
jl 0x100d9f7
push dword [ebp - 0x214]
xor eax, eax
push esi
mov word [esi + ebx*2], ax
push 1
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
je 0x100da05
mov dword [0x101d068], 0x84
jmp 0x100da05
xor edi, edi
jmp 0x100da05
mov dword [0x101d068], 0x132
test esi, esi
je 0x100da10
push esi
call dword [fcn.01001184]
test edi, edi
jne 0x100da19
call fcn.0100d73f
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
jne 0x100d83a
pop edi
pop esi
pop ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100da54
mov dword [0x101d068], 0x83
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100160d
leave
ret 4
Function at 0x100dd21
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x24
push 0x100df78
call fcn.01004000
push 0x5b
call fcn.0100d78a
push dword [ebp + 0xc]
call fcn.0100dabc
push 0x100df6c
call fcn.0100dabc
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, 0x105de20
mov dword [ebp - 0x2c], 0x100
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
push ecx
push esi
lea ecx, [ebp - 0x24]
push ecx
push esi
lea ecx, [ebp - 0x2c]
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, esi
je 0x100de8e
push 0xa
call fcn.0100d78a
cmp edi, 0x103
je 0x100dd99
mov dword [0x101d068], 0x8c
push dword [ebp + 0xc]
call dword [fcn.01001190]
mov ebx, eax
lea edi, [ebx + 0x100]
mov dword [ebp - 4], esi
lea eax, [edi + edi]
call fcn.01004057
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 0xfffffffe
push dword [ebp + 0xc]
push edi
push esi
call fcn.01002d3f
lea esi, [esi + ebx*2]
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
xor eax, eax
mov word [esi], ax
mov dword [ebp - 0x20], 1
mov ebx, 0xff
push ebx
push esi
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x100de43
lea eax, [ebp - 0x30]
push eax
push 9
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100de30
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call fcn.0100dd21
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x101d068], 0x8d
jne 0x100de3a
jmp 0x100df61
mov dword [0x101d068], 0x8b
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push ebx
push esi
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x100ddf5
cmp eax, 0x103
je 0x100df61
mov dword [0x101d068], 0x8c
jmp 0x100df61
cmp dword [ebp - 0x24], 1
je 0x100dea4
cmp dword [ebp - 0x24], 2
je 0x100dea4
cmp dword [ebp - 0x24], 7
je 0x100dea4
xor eax, eax
jmp 0x100dea7
push 2
pop eax
mov ecx, dword [ebp - 0x28]
add eax, ecx
push eax
push 0x40
call dword [fcn.01001188]
mov edi, eax
cmp edi, esi
je 0x100df47
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push dword [ebp + 8]
call fcn.01003313
test eax, eax
je 0x100dee2
mov dword [0x101d068], 0x8d
jmp 0x100df3e
cmp dword [ebp - 0x2c], esi
je 0x100deef
push ebx
call fcn.0100dae4
jmp 0x100def6
push 0x40
call fcn.0100d78a
push 0x3d
call fcn.0100d78a
mov eax, dword [ebp - 0x24]
dec eax
je 0x100df31
sub eax, 3
jne 0x100df23
cmp dword [ebp - 0x28], 4
jne 0x100df23
push 0x1001f10
call fcn.0100dabc
push 1
push dword [edi]
call fcn.0100db5f
jmp 0x100df37
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push edi
call fcn.0100dc43
jmp 0x100df37
push edi
call fcn.0100dae4
push 0xa
call fcn.0100d78a
push edi
call dword [fcn.01001184]
jmp 0x100df51
mov dword [0x101d068], 0x8d
cmp dword [0x101d068], 0x8d
jne 0x100dd50
lea esp, [ebp - 0x44]
call fcn.01004048
ret 8
Function at 0x100df99
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 9
push 0x110a
push dword [0x101d090]
call dword [fcn.01001388]
mov dword [ebp - 0x258], eax
mov dword [0x101d068], 0x88
cmp ebx, esi
je 0x100e009
push esi
push ebx
lea ecx, [ebp - 0x25c]
push ecx
push eax
call fcn.010086ed
push eax
call fcn.01002732
test eax, eax
je 0x100e009
mov dword [0x101d068], 0x89
jmp 0x100e135
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push edi
call dword [0x1001100]
mov dword [0x105d100], eax
cmp eax, 0xffffffff
je 0x100e11b
push esi
lea ecx, [ebp - 0x260]
push ecx
push 2
push 0x100e148
push eax
mov dword [0x105d104], esi
mov dword [0x105d108], esi
call dword [0x1001164]
push 0x1001ed0
call fcn.0100dabc
push 0x1005540
call fcn.0100dabc
push 0x100e150
call fcn.0100dabc
push 0x100e15c
call fcn.0100dabc
cmp ebx, esi
je 0x100e09c
push ebx
push 0x128
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
jmp 0x100e103
push dword [ebp - 0x258]
call fcn.010086ed
push 0x1001654
mov dword [ebp - 0x258], eax
mov edi, 0x128
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push eax
push dword [ebp - 0x258]
call fcn.010027cc
push eax
call fcn.0100dd21
push 0x100163c
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push eax
push dword [ebp - 0x258]
call fcn.010027cc
push eax
call fcn.0100dd21
call fcn.0100d6a5
push dword [0x105d100]
call dword [fcn.01001148]
jmp 0x100e125
mov dword [0x101d068], 0x8a
cmp ebx, esi
je 0x100e135
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x100f081
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], ebx
cmp dword [0x105dbe0], ebx
je 0x100f201
push esi
mov esi, 0x105de20
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x208]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x20c]
mov edi, 0x100
push dword [ebp - 0x214]
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x20c]
test eax, eax
jne 0x100f1ff
push 0x1fa8
call fcn.0100e7b8
mov eax, dword [ebp - 0x20c]
dec eax
push eax
push 0x1005678
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.010062be
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.0100e774
call fcn.0100e7a7
push 0x1fa9
call fcn.0100e7b8
cmp dword [ebp - 0x218], ebx
je 0x100f150
push esi
call fcn.0100e774
jmp 0x100f15a
push 0x1fad
call fcn.0100e7b8
call fcn.0100e7a7
push dword [ebp - 0x208]
call fcn.0100e7e4
cmp dword [ebp - 0x208], 1
je 0x100f189
cmp dword [ebp - 0x208], 2
je 0x100f189
cmp dword [ebp - 0x208], 7
je 0x100f189
xor eax, eax
jmp 0x100f18c
push 2
pop eax
mov ecx, dword [ebp - 0x210]
add eax, ecx
push eax
push 0x40
call dword [fcn.01001188]
mov edi, eax
cmp edi, ebx
je 0x100f1f5
lea eax, [ebp - 0x210]
push eax
push edi
lea eax, [ebp - 0x208]
push eax
push ebx
push esi
push dword [ebp - 0x214]
call fcn.01003313
test eax, eax
jne 0x100f1d7
push dword [ebp - 0x208]
push dword [ebp - 0x210]
push edi
call fcn.0100ee2d
jmp 0x100f1e1
mov dword [0x105dbe4], 0x92
push edi
call dword [fcn.01001184]
cmp dword [0x105dbe0], ebx
je 0x100f1ff
jmp 0x100f0bb
mov dword [0x105dbe4], 0x90
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4
Function at 0x100f24a
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x18
push 0x100f348
call fcn.01004000
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100f215
push dword [ebp + 8]
call fcn.0100f081
xor ebx, ebx
cmp dword [0x105dbe4], ebx
jne 0x100f336
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
call dword [fcn.01001190]
mov esi, eax
lea edi, [esi + 0x100]
mov dword [ebp - 4], ebx
lea eax, [edi + edi]
call fcn.01004057
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
push dword [ebp + 0xc]
push edi
push ebx
call fcn.01002d3f
lea esi, [ebx + esi*2]
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
xor eax, eax
mov word [esi], ax
call fcn.0100e7a7
xor edi, edi
jmp 0x100f309
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push 0xff
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x100f336
lea eax, [ebp - 0x24]
push eax
push 9
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f309
push ebx
push dword [ebp - 0x24]
call fcn.0100f24a
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x105dbe0], edi
je 0x100f336
jmp 0x100f2c8
lea esp, [ebp - 0x38]
call fcn.01004048
ret 8

Function at 0x100f91d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4000
push 0x40
call dword [fcn.01001188]
xor esi, esi
mov dword [0x105dc0c], eax
cmp eax, esi
je 0x100f9de
mov ecx, 0xfeff
mov word [eax], cx
xor eax, eax
inc eax
push edi
mov dword [0x105dc10], 0x2000
mov dword [0x105dc14], eax
mov dword [0x105dbe0], eax
mov dword [0x105dbe4], esi
mov dword [0x105dc18], 0x100f9f0
call fcn.0100f369
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [0x1001100]
mov edi, eax
cmp edi, 0xffffffff
je 0x100f9c7
push esi
lea eax, [ebp + 8]
push eax
mov eax, dword [0x105dc14]
add eax, eax
push eax
push dword [0x105dc0c]
mov dword [ebp + 8], esi
push edi
call dword [0x1001164]
test eax, eax
jne 0x100f9be
mov dword [0x105dbe4], 0x8d
push edi
call dword [fcn.01001148]
jmp 0x100f9d1
mov dword [0x105dbe4], 0x8a
push dword [0x105dc0c]
call dword [fcn.01001184]
pop edi
push dword [0x105dbe4]
call fcn.0100e47c
pop esi
pop ebp
ret 8
Function at 0x100fb8e
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [0x105d4d4], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x208], ebx
cmp dword [esi + 0x20], edi
je 0x100fd5e
lea eax, [ebp - 0x204]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x258]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x250], edi
push 0x1073
push dword [0x101d094]
mov dword [ebp - 0x240], 0x100
call dword [fcn.01001388]
mov eax, dword [esi + 0x20]
cmp word [eax], di
jne 0x100fc20
mov dword [ebp - 0x210], 0x4b
mov dword [ebp - 0x208], edi
jmp 0x100fd37
lea ecx, [ebp - 0x218]
push ecx
push edi
push ecx
push edi
push eax
push dword [0x101d0a8]
call fcn.01003313
mov dword [ebp - 0x208], edi
cmp eax, 2
je 0x100fc50
mov dword [ebp - 0x210], 0x4a
jmp 0x100fd37
lea eax, [ebp - 0x214]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call fcn.01003313
cmp dword [ebp - 0x20c], ebx
je 0x100fc90
cmp dword [ebp - 0x20c], 2
je 0x100fc90
cmp dword [ebp - 0x20c], 7
je 0x100fc90
xor eax, eax
jmp 0x100fc93
push 2
pop eax
mov ecx, dword [ebp - 0x214]
add eax, ecx
push eax
push 0x40
call dword [fcn.01001188]
mov ebx, eax
cmp ebx, edi
je 0x100fd25
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
mov dword [ebp - 0x210], 0x49
call fcn.01003313
test eax, eax
jne 0x100fd1c
push dword [ebp - 0x214]
push ebx
push dword [ebp - 0x20c]
push edi
push dword [esi + 0x20]
push dword [0x101d0a8]
call dword [entry0]
test eax, eax
jne 0x100fd1c
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x100fd1c
mov dword [ebp - 0x208], 1
push ebx
call dword [fcn.01001184]
jmp 0x100fd2f
mov dword [ebp - 0x210], 0x76
cmp dword [ebp - 0x208], edi
jne 0x100fd5e
lea eax, [ebp - 0x204]
push eax
movzx eax, word [ebp - 0x210]
push 0x10
push 0x48
push eax
push dword [ebp - 0x21c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x101059b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x218], eax
cmp dword [0x101d0a8], edi
je 0x1010778
push ebx
mov dword [ebp - 0x214], 1
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push dword [0x101d0d0]
push 0x100
push eax
call fcn.010062be
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
push edi
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [0x101d0a8]
call fcn.01003313
mov ebx, dword [ebp + 0xc]
push 3
pop esi
test eax, eax
jne 0x101065f
inc dword [ebp - 0x214]
cmp dword [ebp - 0x214], 0x64
jb 0x10105d4
cmp dword [ebp - 0x214], 0x64
jne 0x10106e1
mov eax, 0xaa
push 0x10
movzx eax, ax
push 0xa8
push eax
push dword [ebp - 0x218]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
jmp 0x1010776
cmp ebx, edi
jbe 0x10106b0
push 2
pop ecx
cmp ebx, ecx
jbe 0x10106a4
cmp ebx, esi
je 0x101069c
push 4
pop eax
cmp ebx, eax
je 0x1010691
cmp ebx, 7
je 0x10106a4
cmp ebx, 0xb
jne 0x10106b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x210], 8
jmp 0x10106b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x210], eax
jmp 0x10106b0
mov dword [ebp - 0x210], edi
jmp 0x10106b0
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x210]
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [0x101d0a8]
call dword [entry0]
test eax, eax
je 0x1010629
mov eax, 0xa9
jmp 0x101063b
push edi
push edi
push 0x1004
push dword [0x101d094]
mov dword [ebp - 0x258], esi
mov esi, dword [fcn.01001388]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x244], eax
call esi
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], edi
cmp ebx, 1
je 0x101072d
cmp ebx, 2
je 0x101072d
mov dword [ebp - 0x23c], 5
cmp ebx, 7
jne 0x1010737
mov dword [ebp - 0x23c], 4
lea eax, [ebp - 0x258]
push eax
push edi
push 0x104d
push dword [0x101d094]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x1010776
push ebx
push dword [ebp - 0x210]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [0x101d094]
call fcn.01010222
push esi
push dword [0x101d094]
call fcn.0100fde7
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 8
Function at 0x1010b49
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [fcn.01001388]
push edi
mov edi, dword [0x101d094]
xor ebx, ebx
push ebx
push ebx
push 0x1032
push edi
mov dword [ebp - 0x20c], eax
call esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 0x34
push 0x34
movzx eax, ax
push 0x33
push eax
push dword [ebp - 0x20c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
cmp eax, 6
jne 0x1010c9d
push ebx
push ebx
push 0xb
push edi
call esi
or dword [ebp - 0x208], 0xffffffff
push 2
mov dword [ebp - 0x210], ebx
push 0xffffffffffffffff
jmp 0x1010c5e
test ebx, ebx
je 0x1010c02
and dword [ebp - 0x244], 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x24c]
push eax
push ebx
push 0x1073
push edi
mov dword [ebp - 0x234], 0x100
call esi
jmp 0x1010c0b
xor eax, eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1010c46
cmp ebx, eax
je 0x1010c32
push eax
push ebx
push 0x1008
push edi
call esi
jmp 0x1010c56
push 1
push eax
push eax
push eax
push edi
call fcn.01010222
and dword [ebp - 0x208], 0
jmp 0x1010c56
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x208], ebx
push 2
push dword [ebp - 0x208]
push 0x100c
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1010bcf
push 0
push 1
push 0xb
push edi
call esi
cmp dword [ebp - 0x210], 0
je 0x1010c9d
push 0x10
push 0x58
push 0x59
push dword [ebp - 0x20c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4

Function at 0x1010cb3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push 0
push 0x1032
push dword [0x101d094]
call dword [fcn.01001388]
test eax, eax
jbe 0x1010cde
cmp eax, 1
je 0x1010ce2
push 0
call dword [fcn.010013d0]
pop ebp
ret 8
pop ebp
jmp fcn.0101078c
Function at 0x1012c94
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x220], eax
push edi
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x214], esi
call fcn.010129d8
mov ebx, eax
cmp ebx, esi
jl 0x1012d5c
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push eax
call fcn.01011956
mov ebx, eax
cmp ebx, esi
jl 0x1012d42
cmp dword [ebp - 0x218], esi
je 0x1012d3e
push 0x104
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
call fcn.01011956
mov ebx, eax
cmp ebx, esi
jge 0x1012d5c
cmp ebx, 0x80070005
je 0x1012d5c
cmp dword [edi], esi
je 0x1012d62
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1012d62
mov esi, dword [ebp - 0x214]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], esi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 0xc

Function at 0x101a29f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x101a388
push 0x80000000
call dword [0x1001104]
test eax, eax
jne 0x101a374
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [0x1001108]
test eax, eax
jne 0x101a363
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x101a34d
push edi
push dword [ebp - 0x110]
push eax
call dword [0x100110c]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x101a363
push eax
push edi
push dword [ebp - 0x110]
call fcn.0101a237
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x101a376
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 4
Function at 0x67e190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47feb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00679090
test eax, eax
jne 0x67e1fc
push ebp
push 0x55af6c
mov ecx, edi
call fcn.0067d410
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.00678c10
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0066f1b0
push ebx
mov dword [esp + 0x4c], ebp
call fcn.00679240
add esp, 4
test eax, eax
je 0x67e29f
add esi, 0x18
push esi
call fcn.006b8620
add esi, eax
push esi
call fcn.006b8620
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x67e5a2
jmp dword [ecx*4 + 0x41f5e0]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.0067d550
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.006b8620
add esi, eax
push esi
call fcn.006b8620
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x67e2f0
mov ecx, dword [esi + 0x1c]
push ecx
call dword [0x484538]
test eax, eax
je 0x67e2f0
mov eax, 1
jmp 0x67e2f2
xor eax, eax
cmp ebx, 8
jge 0x67e557
cmp ebx, 7
ja 0x67e5a2
jmp dword [ebx*4 + 0x41f5f0]
test eax, eax
jne 0x67e56a
mov ecx, dword [esp + 0x10]
push eax
push 0x55af58
call fcn.0067d410
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.0067eab0
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x543f40
call fcn.0066f3b0
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10