joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a6db
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x101bef28
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x1024bd20]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1024bd20]
xor eax, esp
push eax
lea eax, [esp + 0x83c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x84c]
xor eax, eax
mov ebp, dword [esp + 0x850]
mov ebx, dword [esp + 0x854]
mov esi, dword [esp + 0x858]
and dword [esp + 0x1c], 0
push 0x7fe
push eax
mov word [esp + 0x40], ax
lea eax, [esp + 0x42]
push eax
call fcn.10179250
xor ecx, ecx
mov dword [esp + 0x40], 7
xor eax, eax
mov dword [esp + 0x3c], ecx
add esp, 0xc
mov word [esp + 0x20], ax
cmp dword [ebx + 0x14], 8
mov dword [esp + 0x844], ecx
jb 0x1002a775
mov ebx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push 0x20019
push ecx
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002a7e4
cmp dword [esi + 0x14], 8
mov ebx, 0x400
mov dword [esp + 0x14], ebx
jb 0x1002a79d
mov esi, dword [esi]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push esi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002a7e4
cmp dword [esp + 0x14], ebx
ja 0x1002a7e4
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
push eax
call fcn.1000f0b0
pop ecx
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x28]
call fcn.1000efb0
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.1001d360
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000ee50
mov eax, edi
mov ecx, dword [esp + 0x83c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.1017868e
add esp, 0x834
ret

Function at 0x1002a827
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.10179250
mov esi, dword [ebp + 8]
add esp, 0xc
cmp word [esi], bx
je 0x1002a8a7
push edi
lea edi, [ebp - 0x20c]
sub edi, esi
movzx eax, word [esi]
push 0x5c
pop ecx
cmp cx, ax
je 0x1002a880
push 0x2f
pop ecx
cmp cx, ax
jne 0x1002a897
push 0x3a
pop eax
cmp ax, word [esi - 2]
je 0x1002a897
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ax, word [esi]
mov word [edi + esi], ax
add esi, 2
cmp word [esi], bx
jne 0x1002a86d
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1017868e
mov esp, ebp
pop ebp
ret
Function at 0x1002e9ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10255df0], 0
jne 0x1002ea45
push edi
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], ax
stosd dword es:[edi], eax
push 6
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
pop edi
test eax, eax
jle 0x1002ea45
lea eax, [ebp - 0x18]
push eax
call fcn.1002ef60
pop ecx
mov dword [0x10247194], eax
mov byte [0x10255df0], 1
jmp 0x1002ea4a
mov eax, dword [0x10247194]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
Function at 0x100311f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push 1
push dword [ebp + 0xc]
call fcn.10159260
push 0
push dword [ebp + 0xc]
mov bl, al
push dword [ebp + 8]
call fcn.100312b7
add esp, 0x14
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10031229
push 4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov al, bl
pop ebx
pop ebp
ret 8

Function at 0x100312b7
Capabilities:
Get common file path

Disassembly:
push ebx
mov bl, byte [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov eax, esi
push edi
test bl, bl
je 0x100312d1
push 0x22
pop eax
mov word [esi], ax
lea eax, [esi + 2]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x101d4fcc
mov edi, 0x104
push edi
push esi
call fcn.1017c18a
push dword [esp + 0x1c]
push edi
push esi
call fcn.1017c18a
add esp, 0x18
test bl, bl
je 0x1003130f
push 0x101d4fd0
push edi
push esi
call fcn.1017c18a
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x100314e1
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x10255f28], 0
je 0x1003151d
mov eax, dword [0x10255f34]
test eax, eax
je 0x1003151d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1003151d
push dword [0x10255f34]
mov ecx, dword [0x10255f28]
call fcn.1000fa70
push 0
push dword [0x10255f34]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x10031cd1
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0xa
mov dword [0x10255f2c], eax
call fcn.10028633
push eax
call fcn.10037ebd
pop ecx
pop ecx
push 1
push dword [0x10255f2c]
mov dword [0x10255f54], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 3
push dword [0x10255f2c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0xb
call fcn.10028633
pop ecx
cmp word [eax], 0x31
jne 0x10031d42
push ebx
push ebx
push ebx
push 0x10031cbc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push fcn.10031c6c
call fcn.1002f6b8
mov ecx, eax
call fcn.1002f9b4
pop ebx
ret

Function at 0x10031e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [0x10255f4c]
push ebx
push esi
push edi
call fcn.100278ca
mov ecx, dword [0x10255f4c]
mov esi, eax
call fcn.1002786b
mov ecx, dword [0x10255f4c]
test ecx, ecx
je 0x10031e50
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [0x1025bc1c]
xor ebx, ebx
add eax, 0xfffffff0
mov dword [0x10255f4c], ebx
push eax
mov dword [0x10255f54], ebx
call fcn.1000af30
lea ecx, [ebp - 8]
mov dword [esp], 0x1025b410
lea edi, [eax + 0x10]
call fcn.100224c2
push 0x101d52ec
push 0xa
call fcn.10028647
pop ecx
pop ecx
cmp esi, 4
jne 0x10031ecf
call fcn.10010450
push eax
lea ecx, [ebp - 4]
call fcn.1000c200
push edi
lea eax, [ebp - 4]
push 0x101d52f0
push eax
call fcn.10022679
push 0x101d537c
push 0xa
call fcn.10028647
mov esi, dword [ebp - 4]
add esp, 0x14
push 5
push ebx
push ebx
push esi
push 0x101d5380
jmp 0x10031f90
cmp esi, 3
jne 0x10031f06
call fcn.10010450
push eax
lea ecx, [ebp - 4]
call fcn.1000c200
push edi
lea eax, [ebp - 4]
push str.https:__secure.disc_soft.com_account_serials__s_programkeyASUS_dtpro
push eax
call fcn.10022679
mov esi, dword [ebp - 4]
add esp, 0xc
push 5
push ebx
push ebx
push esi
push 0x101d538c
jmp 0x10031f90
cmp esi, 5
jne 0x10031f5e
push str.https:__www.disc_soft.com_order_update_
lea ecx, [ebp - 4]
call fcn.100224c2
push dword [edi - 0xc]
lea ecx, [ebp - 4]
push edi
call fcn.1000d4a0
push 0x101d5424
lea ecx, [ebp - 8]
call fcn.100258ff
test eax, eax
je 0x10031f41
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.1000aba0
push 5
push ebx
push ebx
push dword [ebp - 4]
push 0x101d5478
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
jmp 0x10031f9c
cmp esi, 6
jne 0x10031fa1
call fcn.10010450
push eax
lea ecx, [ebp - 4]
call fcn.1000c200
push edi
lea eax, [ebp - 4]
push str.https:__www.disc_soft.com_order_modify__s_instances
push eax
call fcn.10022679
mov esi, dword [ebp - 4]
add esp, 0xc
push 5
push ebx
push ebx
push esi
push 0x101d5484
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esi - 0x10]
call fcn.1000c230
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1000c230
lea ecx, [edi - 0x10]
call fcn.1000c230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100320e9
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x10255f38]
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push edi
xor edi, edi
mov ebp, 0xf0
inc edi
test eax, eax
je 0x10032128
push ebx
push ebx
push ebp
push eax
call esi
cmp eax, edi
mov edx, 0x101d555c
mov ecx, 0x101d5558
cmovne ecx, edx
push ecx
push 0xa
call fcn.10028647
pop ecx
pop ecx
mov eax, dword [0x10255f54]
test eax, eax
je 0x10032146
push dword [0x10255f14]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x10255f54], ebx
call fcn.1002f6b8
cmp dword [eax + 0x90], edi
jne 0x1003221e
call fcn.1002f6b8
mov ecx, eax
call fcn.1002f8c9
test al, al
jne 0x1003221e
push 0xb
mov byte [esp + 0x18], bl
mov byte [esp + 0x14], bl
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push ebx
push ebp
push eax
call esi
cmp eax, edi
movzx ecx, bl
push 0xc
cmove ecx, edi
mov byte [esp + 0x20], cl
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push ebx
push ebp
push eax
call esi
cmp eax, edi
movzx ecx, bl
push 0xd
cmove ecx, edi
mov byte [esp + 0x24], cl
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push ebx
push ebp
push eax
call esi
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x100321d9
mov byte [esp + 0x14], cl
mov byte [esp + 0x10], cl
push 0xe
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push ebx
push ebp
push eax
call esi
xor edi, edi
movzx ecx, bl
inc edi
cmp eax, edi
push ebx
cmove ecx, edi
mov byte [esp + 0x1c], cl
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x2c]
push dword [esp + 0x34]
call fcn.1002f6b8
mov ecx, eax
call fcn.1002f8cc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x10032266
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xa
call fcn.10028633
push eax
call fcn.1017ce68
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
pop ecx
pop ecx
push ebx
xor edi, edi
mov ebp, 0xf1
inc edi
push edi
push ebp
push eax
call esi
call fcn.1002f6b8
cmp dword [eax + 0x90], edi
jne 0x10032300
call fcn.1002f6b8
mov ecx, eax
call fcn.1002f8c9
test al, al
jne 0x10032300
push 0xb
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push edi
push ebp
push eax
call esi
push 0xc
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push edi
push ebp
push eax
call esi
push 0xd
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push edi
push ebp
push eax
call esi
push 0xe
call fcn.10028633
push eax
call fcn.1017ce68
pop ecx
pop ecx
push ebx
push edi
push ebp
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10032305
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10255f58]
test eax, eax
je 0x1003234e
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10032342
push 0xfffffc18
push dword [0x10255f58]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x10255f58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10255f40]
push ebx
xor ebx, ebx
test eax, eax
je 0x100323e7
cmp dword [ebp + 8], ebx
je 0x100323da
push ebx
push ebx
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push eax
push 0x150
push dword [0x10255f40]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x100323d5
mov eax, dword [eax]
cmp eax, dword [0x10255de4]
je 0x100323d5
push ebx
push eax
push str.View
push str.Language
call fcn.1015a7e0
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push dword [0x10255f2c]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10033e0e
pop ecx
pop ecx
test al, al
je 0x100323d5
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x10255f40]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x10255f40], ebx
mov eax, dword [0x10255f44]
test eax, eax
je 0x100323fd
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x10255f44], ebx
mov eax, dword [0x10255f54]
test eax, eax
je 0x1003241b
push dword [0x10255f14]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x10255f54], ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1017868e
mov esp, ebp
pop ebp
ret

Function at 0x100324d4
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push 0x10032489
push 0xfffffffffffffffc
push eax
mov dword [0x10255f2c], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x10255f18], eax
xor eax, eax
push eax
push eax
push eax
push 0x100324a1
push eax
push eax
call fcn.101797d8
add esp, 0x18
mov dword [0x10255f58], eax
ret
Function at 0x10033bd5
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x120
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x7c]
push 0x101d6f60
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x10033c36
mov eax, dword [section..data]
cmp eax, section..data
je 0x10033c22
push 0x101d6fa8
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1017868e
lea esp, [ebp + 0x74]
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101d6f7c
push esi
call ebx
mov dword [0x1025bc2c], eax
test eax, eax
je 0x10033c22
push str.SetEntriesInAclA
push esi
call ebx
mov dword [0x1025bc30], eax
test eax, eax
je 0x10033c22
call fcn.10158e20
neg eax
sbb eax, eax
neg eax
mov dword [edi], eax
mov eax, dword [section..data]
mov ebx, section..data
mov esi, 0x101d6fa8
cmp eax, ebx
je 0x10033c91
push dword [edi]
push esi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002116b
add esp, 0x14
push 0x118
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.10179250
add esp, 0xc
mov dword [ebp - 0xac], 0x11c
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10033d1e
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x10033cee
movzx eax, word [ebp + 0x68]
push eax
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
push esi
push 0x14
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.10036257
add esp, 0x1c
cmp dword [ebp - 0xa8], 5
jb 0x10033c22
jne 0x10033d1e
cmp dword [ebp - 0xa4], 0
je 0x10033c22
cmp dword [ebp - 0xa4], 1
jne 0x10033d1e
cmp word [ebp + 0x68], 2
jb 0x10033c22
xor eax, eax
inc eax
jmp 0x10033c24
Function at 0x100342b3
Capabilities:
Move file

Disassembly:
push ebp
mov eax, dword [section..data]
mov ebp, 0x101d6fa8
cmp eax, section..data
je 0x100342d6
push ebp
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push ebx
push esi
push edi
push 0xa
call fcn.10028633
push 0xb
mov ebx, eax
call fcn.10028633
push 0xc
mov edi, eax
call fcn.10028633
push 0xd
mov esi, eax
call fcn.10028633
push eax
push esi
push ebx
call fcn.10159030
add esp, 0x1c
push 3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [section..data]
pop edi
pop esi
pop ebx
cmp eax, section..data
je 0x10034330
push ebp
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
pop ebp
ret
Function at 0x10034987
Capabilities:
Get common file path
Get program files directory

Disassembly:
push esi
push edi
mov edi, 0x1025bc50
xor esi, esi
push edi
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Windows_Sidebar_sidebar.exe
push 0x104
push edi
call fcn.1017c18a
push esi
push edi
call fcn.1017d6c5
cmp eax, 0xffffffff
mov edx, 0x101d6d50
mov ecx, str.10101
setne al
test al, al
cmove ecx, edx
push ecx
push 0xb
call fcn.10028647
add esp, 0x1c
pop edi
pop esi
ret
Function at 0x100354eb
Capabilities:
Check mutex on windows

Disassembly:
push 0xa
call fcn.10028633
pop ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x102556d8], eax
test eax, eax
jne 0x1003550e
push 0x101d6754
jmp 0x10035527
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov ecx, 0x101d6758
mov edx, 0x101d675c
cmovne ecx, edx
push ecx
push 0xb
call fcn.10028647
pop ecx
pop ecx
ret
Function at 0x10038ac7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
xor ebx, ebx
push 0x3e
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
call fcn.10179250
push 0x101d72c4
lea eax, [ebp - 0x68]
push 0x20
push eax
call fcn.1017c1f6
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [ebp - 0x74], eax
mov ecx, 0x1025c27c
lea eax, [ebp - 0x74]
push eax
call fcn.1003a183
push dword [eax]
lea eax, [ebp - 0x68]
push 0x20
push eax
call fcn.1017c18a
add esp, 0xc
lea eax, [ebp - 0x6c]
mov esi, connect
push eax
push 0xf013f
push ebx
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x6c]
test edx, edx
jne 0x10038b69
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [ebp - 0x6c]
test edx, edx
jne 0x10038b69
xor al, al
jmp 0x10038bdb
push edi
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0x70], 0x22
lea edi, [ebp - 0x26]
rep stosd dword es:[edi], eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 0x101d72c8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x10038bd0
lea ecx, [ebp - 0x28]
mov eax, 0x101d72cc
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10038bc6
test dx, dx
je 0x10038bcb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10038bc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10038ba2
jmp 0x10038bcb
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1017868e
mov esp, ebp
pop ebp
ret
Function at 0x10038beb
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x1024bd20]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push ebx
push eax
call fcn.10179250
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.
mov ebp, 0x104
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.1017c1f6
mov eax, dword [esp + 0x448]
add esp, 0x18
mov dword [esp + 0x14], eax
mov ecx, 0x1025c27c
lea eax, [esp + 0x14]
push eax
call fcn.1003a183
push dword [eax]
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.1017c18a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
add esp, 0xc
mov ebp, 0xf013f
mov edi, connect
push eax
push ebp
push ebx
lea eax, [esp + 0x24]
push eax
push edi
call esi
cmp dword [esp + 0x10], ebx
jne 0x10038ca4
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ebp
push ebx
push ebx
push ebx
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [esp + 0x10], ebx
je 0x10038d6d
call fcn.10158e10
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10038d4b
push str.UserChoice
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
push 0x206
mov word [esp + 0x224], ax
lea eax, [esp + 0x226]
push ebx
push eax
call fcn.10179250
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x230]
push 0x104
push eax
call fcn.1017c1f6
push str.OpenWithProgids
lea eax, [esp + 0x23c]
push 0x104
push eax
call fcn.1017c18a
add esp, 0x24
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
lea eax, [esp + 0x22c]
push eax
push connect
call esi
cmp dword [esp + 0x14], ebx
je 0x10038d67
push 0x101d74ec
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x14]
call edi
jmp 0x10038d67
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Progid
push dword [esp + 0x14]
call esi
push str.Application
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call edi
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1017868e
add esp, 0x41c
ret
Function at 0x1003901d
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x398
mov eax, dword [0x1024bd20]
xor eax, esp
mov dword [esp + 0x394], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x3e
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push ebx
push eax
call fcn.10179250
push 0x101d7664
lea eax, [esp + 0x2c]
push 0x20
push eax
call fcn.1017c1f6
mov edi, dword [esp + 0x3c4]
lea eax, [esp + 0x2c]
add esp, 0x18
mov dword [esp + 0x14], edi
mov ecx, 0x1025c27c
push eax
call fcn.1003a183
push dword [eax]
lea eax, [esp + 0x20]
push 0x20
push eax
call fcn.1017c18a
add esp, 0xc
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
mov ebp, 0x20019
push eax
push ebp
push ebx
lea eax, [esp + 0x28]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x100390dc
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ebp
push ebx
push ebx
push ebx
lea eax, [esp + 0x38]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x100390dc
xor al, al
jmp 0x100391d1
push 0x206
lea eax, [esp + 0x1a2]
push ebx
push eax
call fcn.10179250
add esp, 0xc
mov dword [esp + 0x18], 0x208
xor eax, eax
mov word [esp + 0x19c], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1a0]
push eax
push ebx
push ebx
push 0x101d7668
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
push 0x3e
mov word [esp + 0x60], ax
lea eax, [esp + 0x62]
push ebx
push eax
call fcn.10179250
push 0x101d766c
lea eax, [esp + 0x6c]
push 0x20
push eax
call fcn.1017c1f6
add esp, 0x18
mov dword [esp + 0x14], edi
lea eax, [esp + 0x14]
mov ecx, 0x1025c27c
push eax
call fcn.1003a183
push dword [eax]
lea eax, [esp + 0x60]
push 0x20
push eax
call fcn.1017c18a
push 0x101d7670
mov esi, 0x80
lea eax, [esp + 0xac]
push esi
push eax
call fcn.1017c1f6
push 0x101d768c
lea eax, [esp + 0xb8]
push esi
push eax
call fcn.1017c18a
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0xc4]
push esi
push eax
call fcn.1017c18a
push 1
lea ecx, [esp + 0x1d0]
push ecx
lea ecx, [esp + 0xd4]
push ecx
push 0x101d7690
call fcn.1015ac10
add esp, 0x40
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1017868e
add esp, 0x398
ret