joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100247a9
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], eax
test ebx, ebx
jne 0x100247ee
push 0x15b3c8
call fcn.100b86e6
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x100247e7
and dword [ebp - 0x4c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10024952
cmp dword [0x10140c64], eax
je 0x10024805
mov eax, dword [0x1013b658]
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x10024952
push edi
mov dword [ebx], eax
lea eax, [ebp - 0x4c]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10024833
push 0x15b3c9
call fcn.100b86e6
xor edi, edi
jmp 0x1002493d
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x10024853
push 0x15b3ca
jmp 0x10024827
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10024865
push 0x15b3cb
jmp 0x10024827
push esi
push dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
call fcn.100bc301
mov esi, dword [ebp - 0x50]
test al, al
jne 0x10024889
push 0x15b3cc
call fcn.100b86e6
xor edi, edi
jmp 0x10024931
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
jne 0x100248a3
push 0x15b3cd
jmp 0x1002487d
push 0x43
lea eax, [ebp - 0x47]
push 0
push eax
mov byte [ebp - 0x48], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x100248db
push 0x15b3ce
jmp 0x1002487d
and dword [ebp - 0x58], 0
xor edi, edi
inc edi
cmp dword [esi], 0
jbe 0x10024924
lea eax, [esi + 4]
mov dword [ebp - 0x50], eax
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1002490c
mov eax, dword [ebp - 0x50]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10024922
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
inc ecx
add eax, 8
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], eax
cmp ecx, dword [esi]
jae 0x10024924
jmp 0x100248ed
mov dword [ebx], edi
mov dword [0x10140c64], edi
mov eax, dword [ebx]
mov dword [0x1013b658], eax
test esi, esi
je 0x1002493c
push esi
call fcn.10024981
pop ecx
pop esi
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x1002494f
and dword [ebp - 0x4c], 0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret 4
Function at 0x10024b66
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x1013e224
push ebx
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1013e23c], 0
je 0x10024b90
mov esi, 0x100001
jmp 0x10024c1c
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x10024b9e
mov esi, 0x8ff00003
jmp 0x10024c1c
mov eax, dword [ecx]
mov dword [0x1013e1e4], eax
cmp dword [ecx], 0
push edi
jne 0x10024c3d
cmp dword [ecx + 4], 0
je 0x10024c16
mov eax, dword [ecx + 0x10]
mov dword [0x1013e28c], eax
mov eax, dword [ecx + 8]
mov dword [0x1010ab6c], eax
mov eax, dword [ecx + 0xc]
mov dword [0x1010ab70], eax
push dword [ecx + 4]
call fcn.100cd301
mov edx, eax
pop ecx
mov dword [0x1013e1e0], edx
test edx, edx
jne 0x10024c2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x10024c16
cmp eax, 3
jbe 0x10024c11
cmp eax, 0x1f
je 0x10024c11
cmp eax, 0x7e
je 0x10024c11
cmp eax, 0xc1
je 0x10024c11
cmp eax, 0x3ee
je 0x10024c11
cmp eax, 0x485
jne 0x10024c16
mov esi, 0x8ff00004
call fcn.100b591a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
leave
ret 4
mov eax, dword [0x1010ab6c]
mov edi, dword [0x1010ab70]
mov ecx, 0x315
jmp 0x10024c68
cmp dword [ecx], 1
jne 0x10024c1b
mov eax, dword [ecx + 0x14]
mov dword [0x1013e28c], eax
mov eax, dword [ecx + 0xc]
mov dword [0x1010ab6c], eax
mov edi, dword [ecx + 0x10]
mov dword [0x1010ab70], edi
mov edx, dword [ecx + 4]
mov dword [0x1013e1e0], edx
movzx ecx, word [ecx + 8]
test eax, eax
je 0x10024c16
test edi, edi
je 0x10024c16
mov edi, dword [0x1013e26c]
lea eax, [ebp - 4]
push eax
movzx eax, cx
push 0xa
push eax
push edx
call fcn.100cd312
mov ecx, eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov dword [0x1013e26c], ecx
cmp eax, 6
jae 0x10024ca4
mov dword [0x1013e26c], edi
jmp 0x10024c16
lea edx, [ecx + eax]
mov ax, word [0x10024d0c]
mov dword [0x1013e270], edx
cmp ax, word [ecx]
jne 0x10024c16
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
add eax, 4
cmp eax, edx
jae 0x10024ccc
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.10024d10
mov esi, eax
test esi, esi
js 0x10024c16
call fcn.10025076
mov esi, eax
test esi, esi
js 0x10024c16
push 7
xor eax, eax
pop ecx
mov edi, 0x1013e1e8
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [0x1013e23c], 1
jmp 0x10024c1b
Function at 0x100251c4
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x214], 1
call sub.MSVCR100.dll_memset
mov ecx, 0x10140548
add esp, 0xc
mov dword [ebp - 0x210], 0x208
xor esi, esi
mov eax, ecx
cmp dword [eax], 0
je 0x10025231
add eax, 0x14
inc esi
cmp eax, 0x10140570
jge 0x1002538f
jmp 0x1002521b
imul esi, esi, 0x14
add esi, ecx
je 0x1002538f
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002536f
cmp dword [ebp - 0x214], 1
jne 0x1002536f
cmp word [ebp - 0x20c], ax
je 0x1002536f
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x1002536f
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x100252b4
add eax, eax
cmp eax, 0x208
jae 0x100252af
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x100252ba
call fcn.100c170c
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.100c2190
mov dword [esi], eax
test eax, eax
je 0x1002536f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100253a0
push eax
call edi
test eax, eax
jne 0x100252e7
mov eax, dword [ebp + 0x10]
jmp 0x100252e9
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x1002530d
push 0x100253bc
push dword [esi]
call edi
push 0x100253c8
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x100253dc
jmp 0x10025341
cmp eax, 2
jne 0x10025322
push 0x100253bc
push dword [esi]
call edi
push 0x100253ec
jmp 0x100252ff
cmp eax, 3
jne 0x1002534b
push 0x10025400
push dword [esi]
call edi
push 0x10025410
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x10025428
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x1002536f
cmp dword [esi + 0x10], 0
je 0x1002536f
cmp dword [esi + 0xc], 0
je 0x1002536f
push dword [0x10140570]
push esi
call fcn.10025439
test eax, eax
js 0x1002536f
xor esi, esi
test esi, esi
je 0x1002538f
cmp dword [esi], 0
je 0x10025380
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret 0xc
Function at 0x10025b52
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x100d18a8
call fcn.10022400
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
and dword [ebx], 0
push ebx
push eax
mov dword [ebp - 0x18], eax
call fcn.10025bfd
test al, al
je 0x10025b88
test edi, edi
je 0x10025b84
mov dword [edi], 4
xor eax, eax
jmp 0x10025bf5
mov ecx, esi
call fcn.100259da
test al, al
je 0x10025bc8
cmp byte [esi + 0x18], 0
je 0x10025bc3
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x24]
push eax
call fcn.1003ee25
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003dcb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.1003d652
push 2
pop eax
jmp 0x10025bf5
mov dword [ebp - 0x14], 4
test esi, esi
je 0x10025bd8
lea eax, [esi + 4]
jmp 0x10025bda
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push 0
push dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10025ac8
call fcn.10022631
ret 0xc

Function at 0x100303e3
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
Function at 0x1003f760
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x80
lea eax, [ebp - 0x104]
push eax
push 2
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x1003f799
lea eax, [ebp - 0x104]
jmp 0x1003f79b
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10025860
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
lea ecx, [ebp - 0x108]
call fcn.100258cf
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002238e
leave
ret 4

Function at 0x10042070
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x24]
test eax, eax
jne 0x100420cd
push 2
lea eax, [ebp - 8]
push eax
push 0x100c
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x100420bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100420b2
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756c
call fcn.1003d69d
movzx eax, word [ebp - 8]
sub eax, 0x2f
cdq
push 7
pop ecx
idiv ecx
lea eax, [edx + 1]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002238e
leave
ret

Function at 0x100420d9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x100d
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1004211f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10042114
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756e
call fcn.1003d69d
movzx eax, word [ebp - 8]
sub eax, 0x30
sub eax, 0
je 0x10042139
dec eax
je 0x10042135
dec eax
jne 0x10042139
mov al, 4
jmp 0x1004213b
mov al, 7
jmp 0x1004213b
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002238e
leave
ret

Function at 0x1004372e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x20001009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [ebp - 8]
cmp eax, 8
ja 0x10043772
je 0x1004377c
test eax, eax
je 0x1004377c
cmp eax, 5
jbe 0x1004377f
cmp eax, 6
je 0x1004377c
cmp eax, 7
jne 0x1004377c
jmp 0x1004377f
cmp eax, 9
jb 0x1004377c
cmp eax, 0xc
jbe 0x1004377f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002238e
leave
ret
Function at 0x10043dd8
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x100d1084
call fcn.10022400
push 2
lea eax, [ebp - 0x24]
push eax
push 0x23
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10043e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10043e0d
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7664
lea eax, [ebp - 0x30]
push eax
call fcn.1003ee25
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003dcb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1003d652
cmp word [ebp - 0x24], 0x30
je 0x10043e3e
xor al, al
jmp 0x10043e5c
push 9
lea eax, [ebp - 0x24]
push eax
push 0x28
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10043e3a
xor eax, eax
cmp word [ebp - 0x24], ax
setne al
call fcn.10022631
ret 4
Function at 0x10044a31
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x10044bad
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x10044a67
mov eax, dword [ebp + 0xc]
jmp 0x10044a8f
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x10044a84
call edi
push eax
push 0x2e6e776a
call fcn.1003d69d
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x10044aaf
call edi
push eax
push 0x2e6e776b
call fcn.1003d69d
movzx eax, word [ebp - 0x18]
push 0x30
pop ecx
sub eax, ecx
push 0xa
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
push dword [esi]
call ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jg 0x10044ade
call edi
push eax
push 0x2e6e776c
call fcn.1003d69d
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [esi + 0x18], edx
cmp eax, 2
jl 0x10044b33
add eax, 0xfffffffe
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x10044b15
cmp word [ebp + edx*2 - 0x18], 0x3b
je 0x10044b10
mov ecx, dword [esi + 0x18]
movzx eax, word [ebp + edx*2 - 0x18]
imul ecx, ecx, 0xa
add ecx, 0xffffffd0
add eax, ecx
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1c]
inc edx
cmp edx, eax
jl 0x10044af2
movzx eax, word [ebp + eax*2 - 0x18]
push 0x30
pop ecx
cmp ax, cx
je 0x10044b33
mov ecx, dword [esi + 0x18]
imul ecx, ecx, 0xa
add ecx, 0xffffffd0
add eax, ecx
imul eax, eax, 0xa
mov dword [esi + 0x18], eax
push 5
lea eax, [esi + 0x48]
push eax
push 0xe
push dword [esi]
call ebx
test eax, eax
jne 0x10044b50
call edi
push eax
push 0x2e6e776d
call fcn.1003d69d
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x52]
push eax
push 0xf
push dword [esi]
call ebx
test eax, eax
jne 0x10044b73
call edi
push eax
push 0x2e6e776e
call fcn.1003d69d
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 0x1010
push dword [esi]
call ebx
test eax, eax
jne 0x10044b99
call edi
push eax
push 0x2e6e776f
call fcn.1003d69d
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
pop edi
mov dword [esi + 0x24], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002238e
leave
ret 8
Function at 0x10044c2f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x10044da3
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x10044c65
mov eax, dword [ebp + 0xc]
jmp 0x10044c8d
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x10044c82
call edi
push eax
push 0x2e6e7771
call fcn.1003d69d
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x10044cad
call edi
push eax
push 0x2e6e7772
call fcn.1003d69d
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 0xa
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x18]
push eax
push 0x18
push dword [esi]
call ebx
test eax, eax
jne 0x10044cd4
call edi
push eax
push 0x2e6e7773
call fcn.1003d69d
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 5
mov dword [esi + 0x30], eax
lea eax, [esi + 0x48]
push eax
push 0x16
push dword [esi]
call ebx
test eax, eax
jne 0x10044cfb
call edi
push eax
push 0x2e6e7774
call fcn.1003d69d
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x34], eax
lea eax, [esi + 0x52]
push eax
push 0x17
push dword [esi]
call ebx
test eax, eax
jne 0x10044d1e
call edi
push eax
push 0x2e6e7775
call fcn.1003d69d
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x38], eax
lea eax, [ebp - 0x18]
push eax
push 0x1c
push dword [esi]
call ebx
test eax, eax
jne 0x10044d41
call edi
push eax
push 0x2e6e7776
call fcn.1003d69d
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x18]
push eax
push 0x1b
push dword [esi]
call ebx
test eax, eax
jne 0x10044d6c
call edi
push eax
push 0x2e6e7777
call fcn.1003d69d
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 7
mov dword [esi + 0x40], eax
lea eax, [esi + 0x5c]
push eax
push 0x14
push dword [esi]
call ebx
test eax, eax
jne 0x10044d97
call edi
push eax
push 0x2e6e7778
call fcn.1003d69d
lea eax, [esi + 0x5c]
pop edi
mov dword [esi + 0x44], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002238e
leave
ret 8
Function at 0x10046a03
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
push edx
mov dword [edi], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046a7a
cmp dword [ebp - 8], 1
je 0x10046a52
cmp dword [ebp - 8], 2
je 0x10046a52
push 0xd
pop eax
jmp 0x10046a7a
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x10046a74
test ecx, ecx
je 0x10046a6f
test cl, 1
jne 0x10046a4d
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x10046a4d
jmp 0x10046a74
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret 0xc

Function at 0x10047aa6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d17e8
mov eax, dword fs:[0]
push eax
mov eax, 0x1060
call fcn.10001719
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 0x1060], eax
call fcn.100258cf
push ebx
push dword [ebp - 0x1060]
mov ecx, esi
call fcn.10048066
test al, al
je 0x10047b13
test edi, edi
je 0x10047b0c
mov dword [edi], 1
xor eax, eax
jmp 0x10047bc9
mov ecx, esi
call fcn.100259da
test al, al
je 0x10047b59
cmp byte [esi + 0x18], 0
je 0x10047b54
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x106c]
push eax
call fcn.1003ee25
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003dcb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x106c]
call fcn.1003d652
push 2
pop eax
jmp 0x10047bc9
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x1058], ax
lea eax, [ebp - 0x1056]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x105c], 0x1048
test esi, esi
je 0x10047b8a
lea eax, [esi + 4]
jmp 0x10047b8c
xor eax, eax
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push edi
push 0
push dword [ebp - 0x1060]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10025ac8
mov esi, eax
test esi, esi
jne 0x10047bc7
lea eax, [ebp - 0x1058]
push eax
mov ecx, ebx
call fcn.10025878
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002238e
leave
ret 0xc
Function at 0x10047be5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d184a
mov eax, dword fs:[0]
push eax
mov eax, 0x1064
call fcn.10001719
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax - 4], ebx
mov eax, dword [edi]
xor edx, edx
mov byte [edi + 8], bl
mov word [eax], dx
mov dword [ebp - 0x1064], ecx
mov dword [ebp - 0x105c], ebx
lea eax, [ebp - 0x105c]
push eax
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.10048066
test al, al
je 0x10047c5d
push dword [ebp - 0x105c]
jmp 0x10047d06
mov ecx, esi
call fcn.100259da
test al, al
je 0x10047ca2
cmp byte [esi + 0x18], 0
je 0x10047c9d
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x1070]
push eax
call fcn.1003ee25
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1003dcb5
lea ecx, [ebp - 0x1070]
mov byte [ebp - 4], bl
call fcn.1003d652
push 2
pop ebx
jmp 0x10047d0d
xor eax, eax
push 0x1046
mov word [ebp - 0x1058], ax
lea eax, [ebp - 0x1056]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x1060], 0x1048
lea eax, [esi + 4]
test esi, esi
jne 0x10047cd3
mov eax, ebx
lea ecx, [ebp - 0x1060]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push ebx
push ebx
push dword [ebp - 0x1064]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10025ac8
mov ebx, eax
test ebx, ebx
jne 0x10047d0d
lea eax, [ebp - 0x1058]
push eax
mov ecx, edi
call fcn.10042d8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x105c]
call fcn.100258cf
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002238e
leave
ret 8

Function at 0x10047d3a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x100d18a8
call fcn.10022400
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
call fcn.100259da
test al, al
je 0x10047d92
cmp byte [esi + 0x18], 0
je 0x10047d8d
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x24]
push eax
call fcn.1003ee25
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1003dcb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.1003d652
push 2
pop eax
jmp 0x10047dbc
and dword [ebp - 0x14], 0
test esi, esi
je 0x10047d9f
lea eax, [esi + 4]
jmp 0x10047da1
xor eax, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ebx
push ecx
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10025ac8
call fcn.10022631
ret 0xc