joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a9360
Capabilities:
Get file size

Disassembly:
sub esp, 0x3c
lea eax, [esp + 4]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100a93ca
mov eax, dword [esp + 4]
xorps xmm0, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 4]
push eax
push 0x20
lea eax, [esp + 0x28]
movlpd qword [esp + 0x18], xmm0
push eax
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0
push eax
push 0x940cf
push dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100a93ca
cmp dword [esp], 0x10
setne al
add esp, 0x3c
ret
mov al, 1
add esp, 0x3c
ret

Function at 0x100a93d0
Capabilities:
Get file size

Disassembly:
sub esp, 0x3c
lea eax, [esp]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100a9404
lea eax, [esp + 8]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test dword [esp + 8], 0x200
je 0x100a9404
mov al, 1
add esp, 0x3c
ret
xor al, al
add esp, 0x3c
ret

Function at 0x100a95a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x40
lea eax, [esp]
push esi
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call sym.WMCommon.dll_public:_static_void___cdecl_WM::GMStringUtils::ConvertUInt64ToString_unsigned_long_long_unsigned___int64___wchar_t__
mov esi, dword [esp + 0x60]
add esp, 0xc
mov eax, dword [esp + 0x48]
cmp esi, eax
je 0x100a95d7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x100a95ce
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.1001a600
push 1
push 0x1026747c
mov ecx, esi
call fcn.1001a7c0
lea ecx, [esp + 4]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a95f0
sub ecx, edx
lea eax, [esp + 4]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001a7c0
push 1
push 0x10267488
mov ecx, esi
call fcn.1001a7c0
mov eax, dword [esp + 0x4c]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x100a9629
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.1001a7c0
cmp dword [esi + 0x14], 8
jb 0x100a963a
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop esi
setne al
add esp, 0x40
ret

Function at 0x100a97a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x100a97ac
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x100a9ac0
Capabilities:
Get common file path

Disassembly:
mov edx, dword [0x1031bf14]
sub esp, 0x620
test edx, edx
je 0x100a9b06
mov ecx, dword [esp + 0x624]
cmp ecx, sym.WMCommon.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___WM::GMFileSystemUtils::s_tempFolder
je 0x100a9bd0
cmp dword [0x1031bf18], 8
mov eax, sym.WMCommon.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___WM::GMFileSystemUtils::s_tempFolder
push edx
cmovae eax, dword [sym.WMCommon.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___WM::GMFileSystemUtils::s_tempFolder]
push eax
call fcn.1001a600
mov al, 1
add esp, 0x620
ret
push 0x20c
lea eax, [esp + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x100a9bd9
xor eax, eax
push 0x412
push eax
mov word [esp + 0x212], ax
lea eax, [esp + 0x214]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x20c]
push 0x208
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x100a9ba4
test eax, eax
je 0x100a9ba4
xor ecx, ecx
mov word [esp + eax*2 + 0x20c], cx
lea ecx, [esp + 0x20c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a9b90
lea eax, [esp + 0x20c]
jmp 0x100a9bbe
lea ecx, [esp]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a9bb0
lea eax, [esp]
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [esp + 0x628]
push eax
call fcn.1001a600
mov al, 1
add esp, 0x620
ret
xor al, al
add esp, 0x620
ret

Function at 0x100a9c80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push 0x20c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x100a9ce9
xor eax, eax
lea ecx, [esp]
mov word [esp + 0x20a], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a9cc0
sub ecx, edx
lea eax, [esp]
sar ecx, 1
push ecx
mov ecx, dword [esp + 0x214]
push eax
call fcn.1001a600
mov al, 1
add esp, 0x20c
ret
xor al, al
add esp, 0x20c
ret

Function at 0x100a9d00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push 0x20c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x100a9d69
xor eax, eax
lea ecx, [esp]
mov word [esp + 0x20a], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a9d40
sub ecx, edx
lea eax, [esp]
sar ecx, 1
push ecx
mov ecx, dword [esp + 0x214]
push eax
call fcn.1001a600
mov al, 1
add esp, 0x20c
ret
xor al, al
add esp, 0x20c
ret
Function at 0x100a9d80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
push esi
mov esi, dword [esp + 0x41c]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100a9d98
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], 0
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x100a9e26
cmp eax, 0x208
jae 0x100a9e26
lea eax, [esp + 4]
push eax
push 0x209
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x100a9e26
cmp eax, 0x208
jae 0x100a9e26
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100a9e00
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.1001a600
mov al, 1
pop esi
add esp, 0x414
ret
xor al, al
pop esi
add esp, 0x414
ret

Function at 0x100a9fb0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 8
jb 0x100a9fc8
mov edx, dword [edi]
xor eax, eax
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
mov eax, edx
mov dword [esp + 0x1c], 7
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100a9fe4
sub eax, esi
lea ecx, [esp + 8]
sar eax, 1
push eax
push edx
call fcn.1001a600
cmp dword [esp + 0x1c], 8
lea eax, [esp + 8]
push 0
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 8]
mov esi, eax
call fcn.1001a5a0
test esi, esi
je 0x100aa03f
cmp dword [edi + 0x14], 8
jb 0x100aa02c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100aa03f
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100aa050
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024c81b
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x100aa07a
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x100aa087
mov ecx, dword [edi]
push 0xb
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100aa112
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100aa09f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100aa136
push esi
lea ecx, [ebp - 0x24]
call fcn.1001a380
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFileSystemUtils::AutoRenamePath_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____
add esp, 4
test al, al
je 0x100aa12e
cmp dword [ebp - 0x10], 8
lea ecx, [ebp - 0x24]
mov eax, esi
cmovae ecx, dword [ebp - 0x24]
cmp dword [esi + 0x14], 8
jb 0x100aa0e4
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x100aa12e
push esi
push edi
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFileSystemUtils::MyMoveFile_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 8
test al, al
lea eax, [ebp - 0x24]
je 0x100aa124
push eax
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFileSystemUtils::DeleteFileAlways_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.1001a5a0
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push eax
call sym.WMCommon.dll_public:_static_bool___cdecl_WM::GMFileSystemUtils::MyMoveFile_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 8
lea ecx, [ebp - 0x24]
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100aa170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push 0x20c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esp + 0x220]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x100aa198
mov eax, dword [eax]
mov ecx, dword [esp + 0x210]
cmp dword [ecx + 0x14], 8
jb 0x100aa1a7
mov ecx, dword [ecx]
lea edx, [esp]
push edx
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100aa1f9
xor eax, eax
lea ecx, [esp]
mov word [esp + 0x20a], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100aa1d0
sub ecx, edx
lea eax, [esp]
sar ecx, 1
push ecx
mov ecx, dword [esp + 0x21c]
push eax
call fcn.1001a600
mov al, 1
add esp, 0x20c
ret
xor al, al
add esp, 0x20c
ret

Function at 0x100aa210
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x100aa21c
mov eax, dword [eax]
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x100ab410
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024c982
push eax
mov eax, 0x2000
mov dword fs:[0], esp
call fcn.1006fb30
push esi
mov esi, ecx
push 0x2000
lea eax, [ebp - 0x200c]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x100ab45a
mov esi, dword [esi]
cmp dword [ebp + 0x28], 8
lea edx, [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
cmovae edx, dword [ebp + 0x14]
cmp dword [ecx + 0x14], 8
jb 0x100ab470
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x100ab47b
mov eax, dword [eax]
push esi
push 0x1000
lea esi, [ebp - 0x200c]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x200c]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ab4b0
sub ecx, edx
lea eax, [ebp - 0x200c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001a600
lea ecx, [ebp + 0x14]
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x100ab970
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024c9e0
push eax
mov eax, 0x1224
mov dword fs:[0], esp
call fcn.1006fb30
push ebx
push esi
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1230]
push ebx
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x230]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
cmp dword [esi + 0x14], 8
jb 0x100ab9c7
mov esi, dword [esi]
push esi
push 0x800
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov eax, 1
nop
cmp word [ebp + eax*2 - 0x1232], bx
jne 0x100ab9f6
xor ecx, ecx
cmp cx, word [ebp + eax*2 - 0x1230]
je 0x100ab9fe
inc eax
cmp eax, 0x800
jl 0x100ab9e0
cmp eax, 1
jne 0x100aba17
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
inc eax
push edi
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 4]
mov esi, dword [ecx]
cmp esi, edi
je 0x100aba3e
mov ecx, esi
call fcn.1001a5a0
add esi, 0x18
cmp esi, edi
jne 0x100aba28
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov esi, dword [ecx]
xor edi, edi
mov dword [ecx + 4], esi
test eax, eax
jle 0x100abaeb
mov esi, dword [ebp + 8]
nop
movzx eax, word [ebp + edi*2 - 0x1230]
mov word [ebp + ebx*2 - 0x230], ax
inc ebx
test ax, ax
jne 0x100abadb
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100aba83
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.1001a600
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100313d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a5a0
push 0x104
lea eax, [ebp - 0x230]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x100aba50
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
sub esi, dword [ecx]
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0xc]
imul esi
pop edi
sar edx, 2
mov eax, edx
mov dword fs:[0], ecx
shr eax, 0x1f
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100abf10
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024ca22
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
push esi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100abf50
sub ecx, esi
push edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.1001a600
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae ecx, edi
push 0x12
push str.HKEY_LOCAL_MACHINE
push 0
call fcn.1001d720
add esp, 0xc
lea ecx, [ebp - 0x28]
test eax, eax
jne 0x100abf9f
push 0xb
jmp 0x100abfc2
mov edx, dword [ebp - 0x18]
cmp esi, 8
push 5
push str.HKEY_
cmovae ecx, edi
push 0
call fcn.1001d720
add esp, 0xc
test eax, eax
jne 0x100abfcf
push 5
lea ecx, [ebp - 0x28]
push 0
call fcn.1001d020
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
push ecx
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], 0
push ecx
push 0
push 0
push 4
cmp esi, 8
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x28]
cmovae eax, edi
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
pop edi
test eax, eax
jne 0x100ac0a8
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x104
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x25c]
push eax
movups xmmword [ebp - 0x54], xmm0
movups xmmword [ebp - 0x44], xmm0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x100ac0a8
push 3
push 2
push 0xf003f
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x54]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x100ac0a8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
push dword [ebp - 0x10]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
jne 0x100ac0a8
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x100ac09a
push eax
call esi
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x100ac0a4
push eax
call esi
xor esi, esi
jmp 0x100ac0ab
or esi, 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100ac130
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024ca3c
push eax
mov dword fs:[0], esp
sub esp, 0x250
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x100ac169
push 0
push dword [ebp + 0x10]
push ebx
push edi
call esi
jmp 0x100ac171
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x100ac186
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
or eax, 0x20019
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100ac1bc
mov ecx, 2
cmp eax, ecx
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ac1d5
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1001a600
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x2c]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x100ac21a
push 1
push 0x102665ac
lea ecx, [ebp - 0x2c]
call fcn.1001a7c0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x258]
push eax
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100ac2c3
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
call fcn.1001e9d0
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
push esi
push dword [ebp + 0x10]
cmovae eax, dword [ebp - 0x4c]
push eax
push edi
call sym.WMCommon.dll_private:_static_unsigned_long_int___cdecl_WM::GMRegFile::DeleteKeyExHelper_struct_HKEY_____wchar_t_const___unsigned_long_int__long_int____stdcall___struct_HKEY_____wchar_t_const___unsigned_long_int__unsigned_long_int__
add esp, 0x10
test eax, eax
jne 0x100ac2b7
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x258]
push eax
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.1001a5a0
test esi, esi
mov esi, dword [ebp + 0x14]
jmp 0x100ac243
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.1001a5a0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100ac2db
push 0
push dword [ebp + 0x10]
push ebx
push edi
call esi
jmp 0x100ac2e3
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.1001a5a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ac300
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024ca4e
push eax
mov eax, dword [ebp + 8]
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [eax + 0x10], 0
push esi
je 0x100ac3c7
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x100ac3c7
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x2c]
push eax
call sym.WMCommon.dll_public:_bool___thiscall_WM::GMRegFile::OpenKey_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_long_int__bool_
test al, al
jne 0x100ac369
mov esi, dword [ebp - 0x10]
jmp 0x100ac392
cmp dword [esi + 0x14], 8
jb 0x100ac371
mov esi, dword [esi]
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x100ac390
mov dword [ebp - 0x10], esi
cmp esi, 2
jne 0x100ac392
mov dword [ebp - 0x10], 0
xor esi, esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100ac3a7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], 0
call fcn.1001a5a0
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100ac4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024ca72
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
push esi
push edi
push 0x208
lea eax, [ebp - 0x25c]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x18], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea eax, [ebp - 0x54]
mov dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test edi, edi
je 0x100ac578
mov dword [esi + 0x1c], edi
cmp edi, 5
jne 0x100ac591
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x100ac5ac
mov dword [esi + 0x1c], edi
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x14]
xor ecx, ecx
inc dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x14], eax
mov edx, 2
mov dword [ebp - 0x20], eax
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006e70d
add esp, 4
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x100ac688
mov ecx, dword [ebp + 8]
call fcn.1001cdd0
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
call fcn.10033050
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x10], esi
jbe 0x100ac685
nop
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [ebx], ax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x100ac67b
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x4c], ax
mov eax, ebx
mov dword [ebp - 0x38], 7
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100ac640
sub eax, edx
lea ecx, [ebp - 0x4c]
sar eax, 1
push eax
push ebx
call fcn.1001a600
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], 0
call fcn.100313d0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a5a0
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x100ac600
mov esi, dword [ebp - 0x18]
push ebx
call fcn.1006e708
add esp, 4
pop ebx
test edi, edi
je 0x100ac699
mov dword [esi + 0x1c], edi
mov ecx, dword [ebp - 0xc]
sete al
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4