joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008318
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.01001c0d
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 0x101c], eax
call dword [0x1001228]
xor edi, edi
cmp eax, edi
je 0x100859f
push ebx
push dword [ebp + 0xc]
push eax
call dword [0x10013b8]
mov ebx, eax
mov dword [ebp - 0x1010], ebx
cmp ebx, edi
je 0x100859e
push esi
push 0x30
pop esi
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call fcn.01001761
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push edi
push 0x500
push ebx
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x1044], 3
call dword [0x1001360]
push 0x400
push 2
push ebx
call dword [0x1001220]
test eax, eax
jne 0x10083aa
lea eax, [ebp - 0x100c]
push eax
push 0x1005438
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1008591
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x804]
push eax
push edi
push dword [ebp - 0x100c]
mov dword [ebp - 0x1008], edi
mov dword [ebp - 0x1014], 0x400
mov dword [ebp - 0x1018], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1008585
mov ebx, dword [0x100121c]
cmp dword [ebp - 0x1008], edi
jne 0x10084ba
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call fcn.01001761
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push edi
push 0x500
push dword [ebp - 0x1010]
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x1044], edi
call dword [0x1001360]
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call fcn.01001761
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push 2
push 0xffffffffffffffff
push dword [ebp - 0x1010]
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 0x10
mov dword [ebp - 0x1048], 0x800
call ebx
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call fcn.01001761
mov eax, dword [ebp - 0x1008]
add eax, 0x502
mov dword [ebp - 0x1040], eax
lea eax, [ebp - 0x804]
add esp, 0xc
push eax
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 0x13
mov dword [ebp - 0x1048], edi
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1044], edi
call dword [fcn.01001190]
mov dword [ebp - 0x1028], eax
lea eax, [ebp - 0x1050]
push eax
mov eax, dword [ebp - 0x1008]
push edi
add eax, 0x502
push eax
push dword [ebp - 0x1010]
call ebx
inc dword [ebp - 0x1008]
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
mov dword [ebp - 0x1014], 0x400
push dword [ebp - 0x100c]
mov dword [ebp - 0x1018], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1008434
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x101c]
call dword [0x1001218]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 8
Function at 0x10087f9
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [fcn.01001388]
push edi
push 0x5c
mov dword [ebp - 0x438], eax
pop eax
push 8
pop ecx
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], ax
xor eax, eax
push 0
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
push 9
mov edi, 0x110a
push edi
push dword [0x101d090]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x440], eax
call esi
push eax
push 3
push edi
push dword [0x101d090]
mov dword [ebp - 0x434], eax
call esi
push dword [ebp - 0x434]
mov dword [ebp - 0x43c], eax
call fcn.010086ed
mov ebx, eax
push 0x101
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x434]
call fcn.0100b314
xor eax, eax
cmp ebx, dword [0x101d0e8]
setne al
mov dword [ebp - 0x444], eax
test eax, eax
je 0x10088b2
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.0100b314
jmp 0x10088cd
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x448], 0x10
call dword [0x100118c]
cmp dword [ebp - 0x43c], ebx
jne 0x10088df
xor esi, esi
mov dword [ebp - 0x440], esi
jmp 0x100891d
push dword [ebp - 0x43c]
push 3
push edi
push dword [0x101d090]
call esi
cmp eax, ebx
jne 0x10088f8
xor esi, esi
jmp 0x100891d
push 0
push 0x101
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x43c]
push dword [0x101d090]
call fcn.01002c60
lea esi, [ebp - 0x430]
push dword [ebp - 0x434]
call fcn.0100871c
lea ecx, [ebp - 0x44c]
push ecx
push dword [ebp - 0x438]
push 0
push eax
push dword [ebp - 0x444]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0x440]
call fcn.01012f91
pop edi
pop esi
pop ebx
test eax, eax
jne 0x100897b
push dword [ebp - 0x44c]
push dword [ebp - 0x438]
call dword [0x10014f4]
push dword [0x101d090]
call fcn.01003ad2
jmp 0x100899d
push 0
push 0x10
push 0x1b58
push 0x1b8c
push dword [ebp - 0x438]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100160d
leave
ret 4
Function at 0x100979a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.01001c0d
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1008]
push eax
push 0x1005438
push 0x80000001
mov dword [ebp - 0x1010], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100991c
push esi
push 3
mov esi, 0x400
push esi
lea eax, [ebp - 0x1004]
push eax
push 0
push 9
push 0x110a
push dword [0x101d090]
call dword [fcn.01001388]
push eax
push dword [0x101d090]
call fcn.01002c60
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], eax
push 0x5c
push dword [ebp - 0x100c]
call dword [0x1001434]
pop ecx
pop ecx
test eax, eax
je 0x1009837
inc eax
inc eax
mov dword [ebp - 0x100c], eax
jne 0x1009819
push ebx
push dword [ebp - 0x100c]
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.01002d3f
lea eax, [ebp - 0x804]
push eax
mov ebx, 0x100800f
push ebx
push edi
mov edi, dword [fcn.01001214]
jmp 0x10098cd
xor eax, eax
cmp word [ebp - 0x804], ax
je 0x10098ac
push eax
push eax
lea ecx, [ebp - 0x1014]
push ecx
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call fcn.01003313
test eax, eax
jne 0x10098de
push 0x10
push 0xac
push 0xab
push dword [ebp - 0x1010]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
push dword [ebp - 0x100c]
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.01002d3f
lea eax, [ebp - 0x804]
push eax
push ebx
push dword [ebp - 0x1010]
push 0x70
push dword [0x101d054]
call edi
cmp eax, 1
jne 0x100990e
jmp 0x1009861
lea eax, [ebp - 0x1004]
push eax
call dword [fcn.01001190]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x1004]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call dword [entry0]
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 4
Function at 0x1009930
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.01001c0d
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
cmp ax, word [0x105d668]
jne 0x1009999
push 0x104
mov esi, 0x105d668
push esi
push 0x22
push dword [0x101d054]
call dword [0x1001264]
test eax, eax
jne 0x1009980
mov word [0x105d668], ax
jmp 0x1009b37
push esi
call dword [fcn.01001190]
mov dword [0x105d870], eax
cmp word [0x105d668], di
je 0x1009b37
lea eax, [ebp - 0x180c]
push eax
push 0x1005438
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1009b37
lea eax, [ebp - 0x1808]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1818]
push eax
push edi
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x1804]
push eax
push edi
push dword [ebp - 0x180c]
mov esi, 0x400
mov dword [ebp - 0x1810], esi
mov dword [ebp - 0x1808], 0x800
mov dword [ebp - 0x1814], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1009b2b
push ebx
cmp dword [ebp - 0x1818], 1
jne 0x1009b2a
cmp dword [ebp - 0x1808], edi
jbe 0x1009b2a
push 0x5c
lea eax, [ebp - 0x1004]
push eax
call dword [0x100145c]
mov ebx, eax
push 0x105d668
lea eax, [ebp - 0x1004]
push eax
call dword [0x1001470]
cmp eax, edi
je 0x1009ad5
lea ecx, [ebp - 0x1004]
cmp eax, ecx
jne 0x1009ad5
cmp ebx, edi
je 0x1009ad5
mov ecx, dword [0x105d870]
lea eax, [eax + ecx*2]
cmp eax, ebx
jne 0x1009ad5
push esi
lea eax, [ebp - 0x804]
push eax
push 0x13
push dword [0x101d054]
call dword [0x1001264]
push edi
push edi
push esi
lea eax, [ebp - 0x804]
push eax
call fcn.01008d83
add ebx, 2
push ebx
push esi
lea eax, [ebp - 0x804]
push eax
call fcn.0101278a
lea eax, [ebp - 0x804]
push eax
call dword [fcn.01001190]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push 1
push edi
lea eax, [ebp - 0x1804]
push eax
push dword [ebp - 0x180c]
call dword [entry0]
mov eax, dword [ebp - 0x1814]
inc dword [ebp - 0x1814]
lea ecx, [ebp - 0x1808]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
lea ecx, [ebp - 0x1818]
push ecx
push edi
lea ecx, [ebp - 0x1810]
push ecx
lea ecx, [ebp - 0x1804]
push ecx
push eax
push dword [ebp - 0x180c]
mov dword [ebp - 0x1810], esi
mov dword [ebp - 0x1808], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1009a11
pop ebx
push dword [ebp - 0x180c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret
Function at 0x1009ff7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi - 0x380]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x7f
ja 0x100a040
mov eax, dword [0x101d09c]
cmp eax, dword [0x101d090]
jne 0x100a039
push ebx
push esi
push edi
call fcn.0100c548
jmp 0x100a040
push esi
push edi
call fcn.01010ced
mov eax, 0x29f
cmp esi, eax
jg 0x100a183
je 0x100a17d
lea eax, [esi - 0x280]
cmp eax, 0x1e
ja case.0x100a1a5.673
movzx eax, byte [eax + 0x100a2f9]
jmp dword [eax*4 + 0x100a2bd]
push edi
call fcn.01011890
jmp 0x100a2ac
push edi
call fcn.010115b0
jmp 0x100a2ac
push edi
call fcn.0100ceaa
jmp 0x100a2ac
push edi
call fcn.0100f411
jmp 0x100a2ac
push ebx
push ebx
push 0x10
push edi
call dword [0x1001284]
jmp 0x100a2ac
push 1
push edi
call fcn.0100a859
jmp 0x100a2ac
push ebx
push 9
push 0x110a
push dword [0x101d090]
call dword [fcn.01001388]
push eax
push edi
call fcn.0100b5f4
jmp 0x100a2ac
push 1
push edi
call fcn.0101059b
jmp 0x100a2ac
push 3
jmp 0x100a0db
mov eax, dword [0x101d0b0]
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
push eax
push dword [0x101d098]
mov dword [0x101d0b0], eax
call dword [0x1001254]
push ebx
push edi
call fcn.01003c81
jmp 0x100a2ac
push edi
call fcn.01009f50
jmp 0x100a2ac
push edi
call fcn.0100be3d
jmp 0x100a2ac
push 0x10
call fcn.01003915
pop ecx
push 0x64
push dword [0x101d054]
mov esi, eax
call dword [fcn.01001280]
push eax
push 0x105da78
push esi
push edi
call dword [0x10014d4]
push esi
call dword [fcn.01001184]
jmp 0x100a2ac
mov eax, dword [0x101d090]
cmp dword [0x101d09c], eax
jne 0x100a171
mov eax, dword [0x101d094]
push eax
call dword [fcn.010013b0]
jmp 0x100a2ac
push ebx
jmp 0x100a0ae
mov eax, 0x2b0
cmp esi, eax
jg 0x100a272
je 0x100a26b
lea eax, [esi - 0x2a0]
cmp eax, 9
ja case.0x100a1a5.673
jmp dword [eax*4 + 0x100a319]
push edi
call fcn.01011467
jmp 0x100a2ac
push edi
call fcn.01010fd2
jmp 0x100a2ac
push 4
jmp 0x100a0db
push 7
jmp 0x100a0db
push 2
jmp 0x100a0db
push edi
call fcn.0101000d
jmp 0x100a2ac
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [0x100117c]
test eax, eax
je 0x100a2ac
push ebx
push 0x100a3c4
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100974a
test eax, eax
jl 0x100a2ac
push ebx
push 0x100a348
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100974a
test eax, eax
jl 0x100a2ac
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [0x100127c]
push eax
call fcn.0101a3c9
jmp 0x100a2ac
push ebx
push 9
push 0x110a
push dword [0x101d090]
call dword [fcn.01001388]
push eax
push edi
call fcn.0100bd6d
jmp 0x100a2ac
push edi
call fcn.010087f9
jmp 0x100a2ac
push 0xb
jmp 0x100a0db
mov eax, esi
sub eax, 0x300
je 0x100a2a6
sub eax, 0x200
je 0x100a29e
dec eax
je 0x100a296
cmp esi, 0x501
jle 0x100a2ac
push esi
push edi
call fcn.01009b4a
jmp 0x100a2ac
push edi
call fcn.0100979a
jmp 0x100a2ac
push edi
call fcn.010082f2
jmp 0x100a2ac
push edi
call fcn.0100d480
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 0x10
Function at 0x100b3db
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0x200
lea eax, [ebp - 0x404]
push eax
xor edi, edi
push 0
inc edi
call fcn.0100b35d
test eax, eax
je 0x100b445
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100b445
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x404]
push eax
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 4

Function at 0x100b4cd
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push 3
push 0x110a
push ebx
mov dword [ebp - 0x210], edi
call dword [fcn.01001388]
test eax, eax
jne 0x100b509
inc eax
jmp 0x100b5df
push esi
xor esi, esi
push esi
push 0x100
lea eax, [ebp - 0x204]
push eax
push edi
push ebx
call fcn.01002c60
lea ecx, [ebp - 0x208]
push ecx
push 8
push esi
lea ecx, [ebp - 0x204]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100b543
xor eax, eax
jmp 0x100b5de
lea eax, [ebp - 0x204]
push eax
call dword [fcn.01001190]
mov edi, 0xff
sub edi, eax
push edi
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x20c], esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x100b5af
inc dword [ebp - 0x20c]
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.0100b1da
push eax
lea eax, [ebp - 0x204]
push eax
push 0xffff0001
push dword [ebp - 0x210]
push ebx
call fcn.0100b182
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x100b56e
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x210]
push 0
push 0x1113
push ebx
call dword [fcn.01001388]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x100bd6d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push eax
push dword [0x101d090]
call fcn.01002c60
lea eax, [ebp - 0x404]
push eax
call dword [fcn.01001190]
push edi
lea esi, [eax + eax + 2]
call dword [fcn.01001350]
test eax, eax
je 0x100be06
push esi
push 0x2002
call dword [fcn.01001198]
mov edi, eax
test edi, edi
je 0x100be00
push edi
call dword [fcn.0100119c]
push esi
lea ecx, [ebp - 0x404]
push ecx
push eax
call fcn.01019f83
add esp, 0xc
push edi
call dword [fcn.010011a0]
call dword [fcn.0100134c]
push edi
push 0xd
call dword [fcn.01001348]
call dword [fcn.01001344]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 8
Function at 0x100cb08
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push 9
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100cb3d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x100cbf8
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100cb8e
cmp eax, 0xea
je 0x100cb8e
cmp eax, 0x7a
je 0x100cb8e
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100cbf7
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [fcn.01001188]
mov esi, eax
test esi, esi
jne 0x100cba9
push 8
pop esi
jmp 0x100cb81
push edi
xor edi, edi
mov eax, dword [ebp - 8]
inc eax
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x100cbcd
push esi
push dword [ebp - 4]
call fcn.0100cb08
test eax, eax
je 0x100cbce
inc edi
cmp eax, 0x103
je 0x100cbda
cmp edi, dword [ebp - 0x10]
jb 0x100cbac
push esi
call dword [fcn.01001184]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
leave
ret 8
Function at 0x100cd3f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
mov esi, 0x105de20
push esi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x100
call edi
test eax, eax
jne 0x100ce1f
inc dword [ebp - 4]
cmp dword [ebp - 8], 1
je 0x100cd9e
cmp dword [ebp - 8], 2
je 0x100cd9e
cmp dword [ebp - 8], 7
je 0x100cd9e
xor eax, eax
jmp 0x100cda1
push 2
pop eax
mov ecx, dword [ebp - 0x10]
add eax, ecx
push eax
push 0x40
call dword [fcn.01001188]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x100cdf1
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.01003313
test eax, eax
jne 0x100cde3
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push dword [ebp - 8]
push ebx
push esi
push dword [ebp + 0xc]
call dword [entry0]
jmp 0x100cde6
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x20]
call dword [fcn.01001184]
jmp 0x100cdf4
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 0x100
push dword [ebp + 8]
call edi
test eax, eax
je 0x100cd85
cmp dword [ebp - 0xc], ebx
je 0x100ce9b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov esi, 0x105dc20
push 0x100
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc dword [ebp - 4]
test eax, eax
jne 0x100ce9b
lea eax, [ebp - 0x1c]
push eax
push 9
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ce96
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100ce91
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0100cc81
push dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0100cd3f
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x1c]
call edi
cmp dword [ebp - 0xc], ebx
jne 0x100ce2d
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100d5c4
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [0x101d090]
mov dword [ebp - 4], ebx
call dword [fcn.01001388]
mov dword [0x101d068], 0x88
cmp dword [ebp + 0xc], ebx
je 0x100d617
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.010086ed
push eax
call fcn.01002732
test eax, eax
je 0x100d617
mov dword [0x101d068], 0x89
jmp 0x100d677
push esi
push edi
push 1
mov edi, 0x100d67c
push edi
call fcn.0100cc01
push dword [ebp + 8]
mov esi, dword [0x1001168]
call esi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
cmp eax, ebx
je 0x100d66e
cmp eax, 6
je 0x100d65f
xor ecx, ecx
cmp eax, 0x522
sete cl
add ecx, 0x8d
mov dword [0x101d068], ecx
jmp 0x100d669
mov dword [0x101d068], 0x8f
push dword [ebp + 8]
call esi
push ebx
push edi
call fcn.0100cc01
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100d6a5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x105d104]
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x100d730
cmp dword [0x101d0ec], 4
jne 0x100d6fd
push esi
push edi
push edi
push 0x20000
mov esi, 0x101d100
push esi
push eax
push 0x103d100
push edi
push 3
call dword [0x1001160]
push edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [0x105d100]
call dword [0x1001164]
pop esi
test eax, eax
je 0x100d726
cmp ebx, dword [ebp - 4]
jmp 0x100d724
push edi
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push 0x103d100
push dword [0x105d100]
call dword [0x1001164]
test eax, eax
je 0x100d726
mov eax, dword [0x105d104]
add eax, eax
cmp eax, dword [ebp - 4]
je 0x100d730
mov dword [0x101d068], 0x8d
mov dword [0x105d104], edi
pop edi
pop ebx
leave
ret