joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001358e
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 0x18]
xor edi, edi
push str.AIL:CreateService:path_s
push 3
mov dword [ebp - 4], edi
call fcn.101d1209
push edi
push dword [ebp + 0xc]
push 0x27dd
call fcn.10018d5b
add esp, 0x18
push 2
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
je 0x10013642
push esi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
cmp esi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x10013616
push dword [ebp + 0xc]
push str.AIL:CreateService__s_ok
push 4
call fcn.101d1209
add esp, 0xc
push esi
call edi
jmp 0x1001363a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x431
je 0x1001363a
call esi
push eax
push str.AIL:CreateService_err_d
push 1
mov dword [ebp - 4], eax
call fcn.101d1209
add esp, 0xc
push ebx
call edi
xor edi, edi
pop esi
jmp 0x1001365b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AIL:CreateService:Open_SCM_err_d
push 1
mov dword [ebp - 4], eax
call fcn.101d1209
add esp, 0xc
cmp dword [ebp - 4], edi
je 0x10013671
push edi
push dword [ebp - 4]
push 0x3281014b
call fcn.10019470
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x1001369e
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
push esi
push edi
xor edi, edi
push edi
push ebx
push 0x27de
xor esi, esi
call fcn.10018d5b
add esp, 0xc
xor ebp, ebp
inc ebp
push ebp
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x10013819
push 0x14
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x100137f5
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10013723
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x100137e7
call edi
mov esi, eax
push esi
push ebx
push str.AIL:StartService__s__err_d
push ebp
call fcn.101d1209
add esp, 0x10
jmp 0x100137e7
mov ebp, dword [esp + 0x5c]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
imul ebp, ebp, 5
and dword [esp + 0x10], esi
cmp ebp, 0xffffffff
je 0x10013743
cmp dword [esp + 0x10], ebp
jae 0x100137d7
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100137ba
cmp dword [esp + 0x3c], 2
jne 0x100137d7
jmp 0x10013775
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0xf
push 0xf
push 0
lea eax, [esp + 0x2c]
push eax
call edi
test eax, eax
jne 0x1001376a
mov eax, dword [esp + 0x10]
push 0x19
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x100137b1
mov eax, dword [esp + 0x10]
push 5
pop ecx
div ecx
push eax
push ebx
push str.AIL:StartService:Pending__s___d_
push 3
call fcn.101d1209
add esp, 0x10
inc dword [esp + 0x10]
jmp 0x10013734
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
push str.AIL:StartService:Quert_Status__s__err_d
push 1
call fcn.101d1209
add esp, 0x10
test esi, esi
jne 0x100137e7
push ebx
push str.AIL:StartService__s_ok
push 4
call fcn.101d1209
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
jmp 0x1001380d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
push str.AIL:StartService:Open_Service__s__err_d
push ebp
call fcn.101d1209
add esp, 0x10
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10013830
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.AIL:StartService:Open_SCM_err_d
push ebp
call fcn.101d1209
add esp, 0xc
cmp esi, edi
je 0x10013843
push edi
push esi
push 0x3281014c
call fcn.10019470
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x1001384d
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x44
push esi
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0xc], eax
cmp eax, esi
je 0x100139eb
push ebx
push edi
mov edi, dword [esp + 0x54]
push 0x24
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, esi
je 0x100139a7
push ebp
push esi
push edi
push 0x27df
call fcn.10018d5b
mov ebp, dword [esp + 0x68]
add esp, 0xc
imul ebp, ebp, 5
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x100138dd
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x426
je 0x1001399a
call ebx
mov esi, eax
push esi
push edi
push str.AIL:StopService__s__err_d
push 1
call fcn.101d1209
add esp, 0x10
jmp 0x1001399a
and dword [esp + 0x10], esi
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
cmp ebp, 0xffffffff
je 0x100138f6
cmp dword [esp + 0x10], ebp
jae 0x1001398a
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1001396d
cmp dword [esp + 0x20], 3
jne 0x1001398a
jmp 0x10013928
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0xf
push 0xf
push 0
lea eax, [esp + 0x48]
push eax
call ebx
test eax, eax
jne 0x1001391d
mov eax, dword [esp + 0x10]
push 0x19
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x10013964
mov eax, dword [esp + 0x10]
push 5
pop ecx
div ecx
push eax
push edi
push str.AIL:StopService:Pending__s___d_
push 3
call fcn.101d1209
add esp, 0x10
inc dword [esp + 0x10]
jmp 0x100138e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str.AIL:StopService:Quert_Status__s__err_d
push 1
call fcn.101d1209
add esp, 0x10
test esi, esi
jne 0x1001399a
push edi
push str.AIL:StopService__s_ok
push 4
call fcn.101d1209
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
jmp 0x100139dd
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x424
jne 0x100139c8
push edi
push str.AIL:StopService:the__s_does_not_exist
push 3
call fcn.101d1209
add esp, 0xc
jmp 0x100139dd
call ebx
mov esi, eax
push esi
push edi
push str.AIL:StopService:Open_Service__s__err_d
push 1
call fcn.101d1209
add esp, 0x10
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
jmp 0x10013a03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.AIL:StopService:Open_SCM_err_d
push 1
call fcn.101d1209
add esp, 0xc
test esi, esi
je 0x10013a17
push 0
push esi
push 0x3281014d
call fcn.10019470
add esp, 0xc
mov eax, esi
pop esi
add esp, 0x44
ret
Function at 0x10013a1e
Capabilities:
Delete service

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
push esi
push edi
push 0x27e0
call fcn.10018d5b
add esp, 0xc
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 8], eax
cmp eax, esi
je 0x10013af4
push ebx
push ebp
push 0x10000
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
cmp ebp, esi
je 0x10013ac2
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10013aa9
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x430
jne 0x10013a92
push edi
push str.AIL:DeleteService__s_ERROR_SERVICE_MARKED_FOR_DELETE
push 3
call fcn.101d1209
add esp, 0xc
call sym.AhnIEx.dll_AhnIEx_SetReboot
jmp 0x10013ab9
call ebx
mov esi, eax
push esi
push edi
push str.AIL:DeleteService__s__err_d
push 1
call fcn.101d1209
add esp, 0x10
jmp 0x10013ab9
push edi
push str.AIL:DeleteService__s_ok
push 4
call fcn.101d1209
add esp, 0xc
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10013ae6
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x424
je 0x10013ae6
call ebx
mov esi, eax
push esi
push edi
push str.AIL:DeleteService:Open_Service__s__err_d
push 1
call fcn.101d1209
add esp, 0x10
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
pop ebx
jmp 0x10013b0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.AIL:DeleteService:Open_SCM_err_d
push 1
call fcn.101d1209
add esp, 0xc
test esi, esi
je 0x10013b20
push 0
push esi
push 0x3281014e
call fcn.10019470
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x10013b26
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1a8
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push ebx
push esi
push edi
mov dword [ebp - 0x118], eax
push 1
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor ebx, ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x11
pop ecx
lea eax, [ebp - 0x138]
push 0x7c
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xd0]
push ebx
mov esi, str.Global_Mutex_AIL_SingleInstance_
lea edi, [ebp - 0x114]
push eax
mov dword [ebp - 0x124], 0xc
mov dword [ebp - 0x11c], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.101d19d0
push 0xd
pop ecx
mov esi, str._Mutex_AIL_SingleInstance_
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
push 0x8a
lea eax, [ebp - 0x1e]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.101d19d0
push 0x60
push dword [ebp - 0x118]
lea eax, [ebp - 0x114]
push eax
call fcn.10016bb3
push 0x60
push dword [ebp - 0x118]
lea eax, [ebp - 0x54]
push eax
call fcn.10016bb3
add esp, 0x30
call sym.AhnIEx.dll_AhnIEx_IsWinNT
cmp dword [ebp + 0x7c], ebx
je 0x10013c3a
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x10013c13
lea eax, [ebp - 0x114]
push eax
push ebx
lea eax, [ebp - 0x124]
push eax
call esi
cmp eax, ebx
jne 0x10013c21
lea eax, [ebp - 0x54]
push eax
push ebx
lea eax, [ebp - 0x124]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x10013cb9
cmp eax, 0xb7
jne 0x10013c80
xor eax, eax
jmp 0x10013c80
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, 0x20000
test eax, eax
je 0x10013c58
lea eax, [ebp - 0x114]
push eax
push ebx
push edi
call esi
cmp eax, ebx
jne 0x10013c64
lea eax, [ebp - 0x54]
push eax
push ebx
push edi
call esi
cmp eax, ebx
je 0x10013c6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10013c84
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10013c7d
cmp eax, 0x7b
jne 0x10013c80
or eax, 0xffffffff
cmp eax, ebx
jne 0x10013c9e
push dword [ebp - 0x118]
push str.AIL:Already_running.___s_
push 3
call fcn.101d1209
xor eax, eax
add esp, 0xc
inc eax
jmp 0x10013cbb
cmp eax, 0xffffffff
je 0x10013cb9
push eax
push dword [ebp - 0x118]
push str.AIL:IsAnotherInstanceRunning__s__err_d
push 2
call fcn.101d1209
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d14d7
add ebp, 0x70
leave
ret
Function at 0x10014109
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x65c
lea ebp, [esp - 4]
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x65c], eax
push 8
mov eax, 0x101ecedf
call fcn.101d1901
mov esi, dword [ebp + 0x668]
push str.AIL:ExecWebLink
lea ecx, [ebp]
mov dword [ebp - 0x10], esi
call fcn.100010f3
push esi
push str.URL_s
xor edi, edi
push 3
mov dword [ebp - 4], edi
call fcn.101d1209
add esp, 0xc
lea eax, [ebp + 0x44]
push eax
mov esi, 0x104
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1001424b
push esi
push str.Atmphtm.html
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x454]
push eax
call fcn.10016b70
add esp, 0x10
push edi
push 0x80
push 4
push edi
push edi
push 0x40000000
lea eax, [ebp + 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp esi, 0xffffffff
je 0x10014223
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x24c]
push eax
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x454]
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov ebx, eax
cmp ebx, 0x20
jle 0x1001421b
lea eax, [ebp + 0x24c]
push eax
push str.Browser_s
push 3
call fcn.101d1209
add esp, 0xc
push 1
push edi
push dword [ebp - 0x10]
lea eax, [ebp + 0x24c]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
jg 0x10014233
push ebx
push str.Exec_Open__err_d
jmp 0x10014229
push ebx
push str.FindExecutable_err_d
jmp 0x10014229
push eax
push str.Create_temp_file_err_d
push 2
call fcn.101d1209
add esp, 0xc
cmp dword [ebp - 0x14], 0xb7
je 0x10014261
lea eax, [ebp + 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10014261
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Get_temp_path_err_d
push 2
call fcn.101d1209
add esp, 0xc
cmp ebx, 0x20
jg 0x100142a0
push 5
push edi
push edi
push dword [ebp - 0x10]
push str.explorer
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
jle 0x10014290
push str.Exec_explorer_ok
push 4
call fcn.101d0efc
pop ecx
pop ecx
jmp 0x100142a0
push ebx
push str.Exec_explorer__d
push 1
call fcn.101d1209
add esp, 0xc
xor eax, eax
cmp ebx, 0x20
setg al
or dword [ebp - 4], 0xffffffff
mov dword [ebp], vtable.CLogFunc.0
mov esi, eax
lea eax, [ebp + 4]
push eax
call fcn.101d12b4
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x65c]
xor ecx, ebp
call fcn.101d14d7
add ebp, 0x660
leave
ret
Function at 0x10014818
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x18], edi
je 0x1001487e
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
push edi
or eax, 2
push eax
push dword [ebp + 0x10]
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10014885
push closesocket
push dword [ebp + 0x18]
call fcn.1001661b
pop ecx
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10014881
push 0x57
pop esi
cmp esi, edi
je 0x100148b8
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x14], edi
jne 0x10014892
mov eax, 0x101eeb08
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegSetStr__x___s___d___s__d
push 1
call fcn.101d1209
push edi
push esi
push 0x32810146
call fcn.10019470
add esp, 0x28
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x100148f4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
push esi
or eax, 2
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10014946
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push esi
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x10014979
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x14], esi
jne 0x10014953
mov eax, 0x101eeb08
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegSetDW__x___s___d___s__d
push 1
call fcn.101d1209
push esi
push edi
push 0x32810146
call fcn.10019470
add esp, 0x28
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x100149b5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0x18], esi
je 0x10014a0a
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
push esi
or eax, 2
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10014a11
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 3
push esi
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10014a0d
push 0x57
pop edi
cmp edi, esi
je 0x10014a44
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x14], esi
jne 0x10014a1e
mov eax, 0x101eeb08
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegSetBin__x___s___d___s__d
push 1
call fcn.101d1209
push esi
push edi
push 0x32810146
call fcn.10019470
add esp, 0x28
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10014a86
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
je 0x10014ae7
cmp dword [ebp + 0x18], 0
je 0x10014ae7
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x14]
push eax
mov eax, dword [0x1027ad84]
or eax, 1
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10014aee
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x14]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10014aea
push 0x57
pop edi
test edi, edi
je 0x10014b11
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10014afa
mov eax, 0x101eeb08
push edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegGetStr__x___s___s__d
push 2
call fcn.101d1209
add esp, 0x18
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x10014b17
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
push esi
push edi
cmp eax, ebx
je 0x10014bed
cmp dword [ebp + 0x18], ebx
je 0x10014bed
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
or eax, 1
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov esi, eax
cmp esi, ebx
jne 0x10014b84
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
je 0x10014b96
cmp esi, 3
je 0x10014b96
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
jne 0x10014bf0
call sym.AhnIEx.dll_AhnIEx_IsWow64Process
test eax, eax
je 0x10014bf0
xor eax, eax
inc eax
cmp dword [0x1027ad84], ebx
jne 0x10014baf
mov eax, 0x101
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov esi, eax
cmp esi, ebx
jne 0x10014bf4
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10014bf0
push 0x57
pop esi
cmp esi, ebx
je 0x10014c17
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x10014c00
mov eax, 0x101eeb08
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegGetStr__x___s___s__d
push 2
call fcn.101d1209
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x10014c1e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
or eax, 1
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10014c72
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10014c9c
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 0x10]
jne 0x10014c80
mov eax, 0x101eeb08
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegGetDW__x___s___s__d
push 2
call fcn.101d1209
mov eax, dword [ebp + 0x14]
add esp, 0x18
jmp 0x10014c9f
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x10014ca2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0x14], 0
push esi
push edi
je 0x10014cfc
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x10014cfc
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
or eax, 1
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10014d03
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 8], edi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10014cff
push 0x57
pop esi
test esi, esi
je 0x10014d26
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10014d0f
mov eax, 0x101eeb08
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegGetBin__x___s___s__d
push 2
call fcn.101d1209
add esp, 0x18
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10014d2c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
or eax, 2
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10014d6d
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10014da9
cmp esi, 2
je 0x10014da9
cmp esi, 3
je 0x10014da9
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 0x10]
jne 0x10014d85
mov eax, 0x101eeb08
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegDeleteValue__x___s___s__d
push 1
call fcn.101d1209
push 0
push esi
push 0x3281014f
call fcn.10019470
add esp, 0x24
mov eax, esi
pop esi
leave
ret

Function at 0x10014e16
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1027ad84]
or eax, 1
push eax
xor edi, edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10014e6b
mov eax, dword [ebp + 0x18]
push edi
push edi
push edi
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x10014e8c
cmp esi, 0x103
je 0x10014e8c
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AIL:RegEnumValue__x___s___d__d
push 1
call fcn.101d1209
add esp, 0x18
pop edi
mov eax, esi
pop esi
leave
ret