joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d7790
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x8bc
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x8b8], eax
cmp dword [0x10327390], 0
push edi
mov edi, dword [esp + 0x8c4]
jne 0x100d78fc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x100d77ff
cmp dword [esp + 0x2c], 5
mov byte [0x10327400], 1
mov byte [0x10327401], 0
jb 0x100d782c
cmp dword [esp + 0x30], 1
mov byte [0x10327400], al
jb 0x100d782c
mov byte [0x10327400], 3
jmp 0x100d782c
cmp eax, 1
jne 0x100d782c
cmp dword [esp + 0x34], 4
jb 0x100d782c
mov byte [0x10327401], al
mov eax, dword [esp + 0x30]
cmp eax, 0xa
jb 0x100d7820
mov byte [0x10327401], 2
cmp eax, 0x5a
jb 0x100d782c
mov byte [0x10327401], 3
push esi
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.E3_RELOAD_DRIVER
call esi
push str.E3_REPLACE_RENDERWINDOW
mov dword [0x10327384], eax
call esi
push str.E3_INIT_PICK
mov dword [0x1032738c], eax
call esi
push str.E3_REFINED
mov dword [0x10327388], eax
call esi
lea ecx, [esp + 8]
push ecx
mov dword [0x10327380], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
mov dword [0x101969b4], edx
call fcn.100d7f80
push 0x7fe
lea eax, [esp + 0xc6]
push 0
push eax
mov word [esp + 0xcc], 0
call sub.MSVCR80.dll_memset
mov edx, dword [0x103273f8]
push 0x400
lea ecx, [esp + 0xd0]
push ecx
push edx
call fcn.100d7ec0
lea eax, [esp + 0xd8]
push eax
call fcn.100d7740
add esp, 0x1c
xor eax, eax
pop esi
jmp 0x100d78d0
movzx ecx, word [eax + str.language.eng]
mov word [esp + eax + 0xbc], cx
add eax, 2
test cx, cx
jne 0x100d78d0
push 0
push 0
lea ecx, [esp + 0xc4]
push edi
push ecx
call fcn.100d7930
add esp, 0x10
mov ecx, dword [esp + 0x8bc]
mov eax, dword [0x10327408]
add dword [0x10327390], 1
pop edi
xor ecx, esp
call fcn.1013fce4
add esp, 0x8bc
ret
Function at 0x100d7d20
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x108
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x104], eax
cmp byte [0x10327400], 0
push ebx
mov ebx, dword [esp + 0x110]
push edi
mov edi, dword [esp + 0x118]
je 0x100d7d74
mov eax, dword [esp + 0x11c]
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1013fce4
add esp, 0x108
ret
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jle 0x100d7e14
cmp esi, 0x104
push ebp
jge 0x100d7d95
lea ebp, [esp + 0x10]
jmp 0x100d7da3
lea ecx, [esi + 1]
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
add esi, 1
push esi
push ebp
push ebx
mov byte [ebp], 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x100d7de3
mov edx, dword [esp + 0x124]
push edx
push edi
push ebp
call sym.rt3d.dll_int___stdcall_AtoWex_char_const___unsigned_short_int___int_
mov eax, edi
lea edx, [eax + 2]
jmp 0x100d7dd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100d7dd0
sub eax, edx
sar eax, 1
mov esi, eax
jmp 0x100d7de8
xor esi, esi
mov word [edi], si
lea eax, [esp + 0x10]
cmp ebp, eax
je 0x100d7df9
push ebp
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebp
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1013fce4
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
pop esi
mov word [edi], 0
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1013fce4
add esp, 0x108
ret

Function at 0x100d9050
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x108
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 8]
push str._s_s
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
mov eax, dword [0x10196870]
add esp, 0x10
lea edx, [esp]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1013fce4
add esp, 0x108
ret

Function at 0x100d90b0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x118]
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 0x10]
push str._s_s
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
mov eax, dword [0x10196870]
add esp, 0x10
test eax, eax
je 0x100d9129
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d911e
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.1013fce4
add esp, 0x10c
ret
Function at 0x100d9140
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
xor esi, esi
test eax, eax
mov dword [esp + 4], 0
je 0x100d91c5
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d91c5
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push esi
push edi
push ecx
call ebx
test eax, eax
jne 0x100d91b8
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor edx, edx
cmp dword [esp + 0xc], eax
mov dword [esp + 0xc], eax
setl dl
lea eax, [esp + 0xc]
push eax
push ecx
push 0
push 0
push edi
mov esi, edx
mov edx, dword [esp + 0x28]
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
pop ecx
ret

Function at 0x100d91d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
push 0x80000002
mov dword [esp + 0x24], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
jne 0x100d9259
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push ebx
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100d924a
mov edx, dword [esp + 0x24]
cmp dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push ebp
push eax
setl bl
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100d92c1
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x10196870]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d92c1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x24]
push ebp
push eax
call esi
test eax, eax
jne 0x100d92b6
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
xor ebx, ebx
cmp dword [esp + 0x20], edi
push ebp
push eax
setl bl
mov dword [esp + 0x28], edi
call esi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x100d92d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push esi
push edi
mov edi, dword [esp + 0x120]
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
mov eax, dword [0x10196870]
xor esi, esi
add esp, 0x10
cmp eax, esi
mov dword [esp + 0xc], esi
je 0x100d935f
lea edx, [esp + 8]
push edx
push 0x20019
push esi
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d935f
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push esi
push esi
push esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100d9354
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.1013fce4
add esp, 0x110
ret

Function at 0x100d9380
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
xor esi, esi
push esi
push 0xf003f
push esi
push 0x1014eb60
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100d93f8
mov edx, dword [esp + 0x1c]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100d93c0
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, 1
push eax
push edx
mov edx, dword [esp + 0xc]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
sbb esi, esi
push eax
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x100d9400
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
xor esi, esi
push esi
push 0xf003f
push esi
push 0x1014eb60
push esi
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x100d9477
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100d9447
sub eax, edx
add eax, 1
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push ebx
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push ecx
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
mov edx, dword [0x10196870]
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0x1014eb60
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100d94e0
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100d94b0
sub eax, edx
add eax, 1
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push ebx
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push ecx
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100d94f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x510
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x50c], eax
cmp byte [0x10327400], 0
push ebx
mov ebx, dword [esp + 0x518]
push ebp
mov ebp, dword [esp + 0x528]
push esi
mov esi, dword [esp + 0x528]
push edi
mov edi, dword [esp + 0x528]
jne 0x100d9552
push 0x104
lea eax, [esp + 0x1c]
push eax
push ebp
call sym.rt3d.dll_int___stdcall_WtoAex_unsigned_short_int_const___char___int_
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebx
call fcn.100d9380
add esp, 0x10
jmp 0x100d95d8
lea edx, [esp + 0x31c]
push edx
push edi
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
lea eax, [esp + 0x11c]
push eax
push esi
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
xor esi, esi
push esi
push 0xf003f
push esi
push 0x1014eb60
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100d95cc
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x10]
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push esi
lea ecx, [esp + 0x12c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0x10]
neg esi
sbb esi, esi
push eax
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100d95d6
push 1
call fcn.100d8ca0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1013fce4
add esp, 0x510
ret
Function at 0x100d9600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x510
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x50c], eax
cmp byte [0x10327400], 0
mov eax, dword [esp + 0x518]
push ebx
mov ebx, dword [esp + 0x524]
push esi
mov esi, dword [esp + 0x51c]
push edi
mov edi, dword [esp + 0x528]
jne 0x100d9697
push 0x104
lea ecx, [esp + 0x18]
push ecx
push edi
push eax
push esi
call fcn.100d9140
add esp, 0x14
test eax, eax
je 0x100d967d
push ebx
lea edx, [esp + 0x18]
push edx
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.1013fce4
add esp, 0x510
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.1013fce4
add esp, 0x510
ret
lea ecx, [esp + 0x318]
push ecx
push eax
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
lea edx, [esp + 0x118]
push edx
push edi
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
xor edi, edi
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x100d972e
lea eax, [esp + 0x10]
push eax
push 0x20019
push edi
lea ecx, [esp + 0x324]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d972e
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0xc]
push edx
push edi
push edi
push edi
lea eax, [esp + 0x128]
push eax
push ecx
call esi
test eax, eax
jne 0x100d9723
mov edx, dword [esp + 0x530]
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push edi
lea ecx, [esp + 0x128]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x20]
push ecx
push edx
call esi
mov edi, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x518]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1013fce4
add esp, 0x510
ret
Function at 0x100d9a10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd8
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0xdc]
push ebx
push esi
mov esi, dword [esp + 0xe8]
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 0x64]
push str._s_s
push ecx
mov dword [esp + 0x18], 4
xor ebx, ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
mov ecx, dword [0x10196870]
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x68]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d9b05
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push esi
push edx
call edi
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x100d9aa9
cmp eax, 4
je 0x100d9af0
cmp eax, 1
jne 0x100d9af5
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 0x40
call edi
test eax, eax
jne 0x100d9af5
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push 0x10150a24
push edx
call dword [sym.imp.MSVCR80.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne 0x100d9af5
mov ebx, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop edi
jne 0x100d9b23
mov eax, dword [esp + 0xec]
pop esi
pop ebx
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.1013fce4
add esp, 0xd8
ret
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0x14]
pop esi
pop ebx
xor ecx, esp
call fcn.1013fce4
add esp, 0xd8
ret

Function at 0x100d9b40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x90]
push esi
mov esi, dword [esp + 0x98]
push edi
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
xor edi, edi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0xc]
push edx
mov edx, dword [0x10196870]
lea eax, [esp + 0xc]
push eax
push edi
push 0xf003f
push edi
push 0x1014eb60
push edi
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100d9bf3
mov ecx, dword [esp + 8]
push 4
lea eax, [esp + 0xa4]
push eax
push 4
push edi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
mov esi, eax
neg esi
sbb esi, esi
push edx
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.1013fce4
add esp, 0x8c
ret
mov ecx, dword [esp + 0x90]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.1013fce4
add esp, 0x8c
ret
Function at 0x100d9ce0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x120]
push esi
push edi
mov edi, dword [esp + 0x124]
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x10196870]
lea eax, [esp + 0x10]
push eax
xor esi, esi
push esi
push 0xf003f
push esi
push 0x1014eb60
push esi
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100d9d76
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0xc]
push eax
push ebx
push 3
push esi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x118]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1013fce4
add esp, 0x110
ret

Function at 0x100d9da0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x1019c828]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x124]
push edi
push eax
mov eax, dword [0x103273e4]
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
xor edi, edi
test esi, esi
je 0x100d9def
mov byte [esi], 0
mov ecx, dword [0x10196870]
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d9e6b
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
call ebp
test eax, eax
jne 0x100d9e5f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x100d9e5d
test esi, esi
je 0x100d9e5f
cmp dword [esp + 0x130], eax
je 0x100d9e5f
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x130]
push ecx
push esi
push eax
push eax
push ebx
push edx
call ebp
mov edi, dword [esp + 0x130]
jmp 0x100d9e5f
xor edi, edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov ecx, dword [esp + 0x118]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1013fce4
add esp, 0x110
ret
Function at 0x100da720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1014d28b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1019c828]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call sym.rt3d.dll_public:_void___thiscall_e3_interface::constructor_void_
lea ecx, [esi + 0x1c]
mov dword [esi], vtable.E3_CONTEXT.0
call fcn.1010d999
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], 0xfffffffe
mov dword [esi + 8], 1
mov dword [esp + 0x14], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x41], al
lea eax, [esi + 0x31]
push eax
call sym.rt3d.dll_public:_void___stdcall_e3_GUID::SetNull_void_
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x100fec29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x100fec96
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100fec96
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100fec8c
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 4], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
setl bl
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x100fec9c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 0xf003f
push esi
push 0x1014eb60
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100fecf6
push dword [ebp + 0x14]
call sub.MSVCR80.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret