joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104f3e6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x10de03c]
push ebx
push edi
lea ecx, [ebp - 0x5a8]
push ecx
xor ebx, ebx
xor edi, edi
inc ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push edi
push eax
push 0x80000002
mov dword [ebp - 0x59c], edi
mov dword [ebp - 0x5a0], edi
mov dword [ebp - 0x5a4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f435
mov eax, ebx
jmp 0x104f5bb
push esi
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
mov dword [ebp - 0x598], edi
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0xcc]
push eax
push edi
push edi
lea eax, [ebp - 0x5b4]
push eax
lea eax, [ebp - 0x194]
push eax
push dword [ebp - 0x598]
mov dword [ebp - 0x5b4], 0x64
push dword [ebp - 0x5a8]
mov dword [ebp - 0x5ac], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x5b0], eax
jne 0x104f56b
lea eax, [ebp - 0x194]
push 0x100a038
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f4d1
lea eax, [ebp - 0xcc]
push 0x100a018
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f4d1
mov word [0x10e2b44], bx
mov dword [ebp - 0x5a0], ebx
lea eax, [ebp - 0x194]
push 0x1009fa4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f516
push 0x1009f98
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp + eax*2 - 0xcc]
push eax
call fcn.01082855
pop ecx
pop ecx
mov dword [ebp - 0x59c], eax
mov word [0x10e2b48], bx
mov dword [ebp - 0x5a4], ebx
lea eax, [ebp - 0x194]
push 0x1009f6c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f56b
cmp word [0x10dd43c], di
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x594]
je 0x104f554
push dword [ebp + 0x10]
push 0x100a004
push eax
call esi
add esp, 0x10
jmp 0x104f56b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1009fc0
push eax
call esi
add esp, 0x1c
inc dword [ebp - 0x598]
cmp dword [ebp - 0x5b0], edi
je 0x104f442
cmp dword [ebp - 0x5a0], edi
pop esi
je 0x104f5ad
cmp dword [ebp - 0x5a4], edi
je 0x104f5ad
lea eax, [ebp - 0x594]
push eax
push edi
push dword [ebp - 0x59c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104ea49
push dword [ebp - 0x5a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01075bbb
leave
ret 0x14
Function at 0x104f685
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push edi
lea ecx, [ebp - 0x4d8]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push eax
push 0x80000002
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4d4], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f6d3
xor eax, eax
inc eax
jmp 0x104f797
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], edi
lea eax, [ebp - 0x4e8]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x104f779
push dword [ebp - 0x4e0]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call esi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call esi
add esp, 0x18
push dword [ebp - 0x4d4]
lea eax, [ebp - 0x4cc]
push eax
mov word [0x10e2b44], 1
mov word [0x10e2b48], 1
call fcn.0104f1e2
inc dword [ebp - 0x4d4]
inc dword [ebp - 0x4d0]
cmp ebx, edi
je 0x104f6e1
push dword [ebp - 0x4d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.01075bbb
leave
ret 4
Function at 0x104f7a9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
push ebx
push eax
push 0x80000002
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f7ed
xor eax, eax
inc eax
jmp 0x104f8e4
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104f8c2
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104f8a5
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104f89e
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104f8a5
inc esi
inc esi
cmp word [esi], bx
jne 0x104f880
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104f3e6
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104f7fb
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 0x10
Function at 0x104fa95
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push eax
push 0x80000002
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104fad9
xor eax, eax
inc eax
jmp 0x104fbcd
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104fbab
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104fb91
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104fb8a
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104fb91
inc esi
inc esi
cmp word [esi], bx
jne 0x104fb6c
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104f7a9
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104fae7
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 0xc
Function at 0x104fbf3
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push eax
push 0x80000002
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104fc37
xor eax, eax
inc eax
jmp 0x104fd24
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104fd02
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104fceb
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104fce4
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104fceb
inc esi
inc esi
cmp word [esi], bx
jne 0x104fcc6
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 8]
call fcn.0104fa95
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104fc45
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 8
Function at 0x104fd36
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push eax
push 0x80000002
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104fd7a
xor eax, eax
inc eax
jmp 0x104fe64
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104fe42
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104fe2e
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104fe27
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104fe2e
inc esi
inc esi
cmp word [esi], bx
jne 0x104fe09
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
call fcn.0104fbf3
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104fd88
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 4

Function at 0x10508f4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, eax
push 0xa
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, dword [sym.imp.msvcrt.dll_fwrite]
jmp 0x105094e
mov eax, dword [ebp - 4]
sub eax, ebx
push esi
sar eax, 1
push eax
push 2
push ebx
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1050978
push esi
push 2
push 2
push 0x100548c
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1050978
mov ebx, dword [ebp - 4]
add ebx, 2
push 0xa
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x105090f
cmp word [ebx], ax
je 0x1050976
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push 2
push ebx
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1050978
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x1050d84
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, eax
call fcn.0102150d
mov esi, edi
shl esi, 3
cmp dword [esi + 0x10dd4ac], 0
mov ebx, eax
mov ax, word [esi + 0x10dd4b0]
mov word [ebp - 0xc], ax
jne 0x1050ead
push edi
mov edi, 0x10e3358
mov ecx, edi
call fcn.010509ee
cmp word [esi + 0x10dd4b0], 1
lea eax, [ebp - 8]
jne 0x1050de4
push 0x100a59c
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebp - 4], 8
jmp 0x1050e06
and dword [ebp - 4], 0
push 0x100a598
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov word [ebx + 0xac2], 1
mov word [esi + 0x10dd4b0], 1
xor ebx, ebx
cmp word [0x10e3358], bx
pop ecx
pop ecx
je 0x1050ead
push dword [ebp - 4]
push edi
call fcn.010829a3
cmp eax, ebx
mov dword [esi + 0x10dd4ac], eax
jne 0x1050e39
push edi
push 0xdbb
call fcn.010816e4
pop ecx
pop ecx
jmp 0x1050ead
push eax
mov byte [ebp - 2], 0xff
mov byte [ebp - 1], 0xfe
call dword [sym.imp.msvcrt.dll_ftell]
test eax, eax
pop ecx
jne 0x1050e64
push dword [esi + 0x10dd4ac]
lea eax, [ebp - 2]
push 2
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
call fcn.0102150d
cmp dword [eax + 0xbec], ebx
je 0x1050ead
cmp word [ebp - 0xc], 1
je 0x1050ead
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
push 1
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], ebx
call fcn.01059f3c
test eax, eax
jl 0x1050ead
lea eax, [ebp - 0x2c]
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
lea eax, [ebp - 0x18]
push eax
call fcn.0105a0c7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105544d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10de03c]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
xor edi, edi
push edi
push 0x2000000
push edi
push 0x100205c
push edi
push 0x100b110
push 0x80000002
mov dword [ebp - 0x20c], 7
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10554a4
xor eax, eax
inc eax
jmp 0x1055532
push esi
call fcn.0102159a
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x204]
push 0x10e3d78
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x14
lea eax, [eax*4 + 4]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push edi
push 0x100b0ec
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x1055520
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push edi
push 0x100b0cc
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x1055523
xor edi, edi
inc edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.01075bbb
leave
ret
Function at 0x1055542
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10de03c]
push ebx
push esi
push edi
push 0x10
pop ecx
mov esi, 0x100b230
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
mov ebx, 0x2000000
push ebx
push eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x100205c
push esi
push eax
push 0x100b198
push 0x80000002
call edi
test eax, eax
jne 0x10555ef
cmp dword [ebp - 0x50], 1
jne 0x10555c7
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax*4 + 4]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10555c7
xor esi, esi
inc esi
jmp 0x10555f6
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
push ebx
push eax
push esi
push eax
push 0x100a0f8
push 0x80000001
call edi
test eax, eax
je 0x10555f4
xor eax, eax
inc eax
jmp 0x1055601
xor esi, esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret
Function at 0x1057d73
Capabilities:
Set current directory

Disassembly:
call fcn.010214f7
test eax, eax
jne 0x1057d81
call fcn.01055542
push ebx
push esi
push edi
call fcn.01021af2
call fcn.0105544d
mov ebx, 0x100
push ebx
push 0x10e4230
mov edi, 0x100205c
push edi
xor eax, eax
push 0x100bc10
mov esi, 0x100b460
push esi
mov word [0x10e4afc], ax
mov word [0x10e4b00], ax
mov word [0x10e4b02], ax
call fcn.01021695
call fcn.01021518
push eax
call fcn.010218b0
push ebx
push 0x10e4430
push edi
push 0x100bbf4
push esi
call fcn.01021695
call fcn.0102156b
push eax
call fcn.010219c6
push 1
push 0x100ba10
push esi
call fcn.010215b6
movzx eax, ax
mov dword [0x10e4b14], eax
call fcn.01092a1e
push 0
call fcn.0108cdc6
test eax, eax
pop edi
pop esi
mov dword [0x10e4b08], eax
mov dword [0x10e3d70], eax
pop ebx
je 0x1057e5e
mov word [eax + 0x66], 1
mov eax, dword [0x10e3d70]
or dword [eax + 0x9c], 2
call fcn.01055613
call fcn.010579d4
call fcn.01055b64
call fcn.01055ca7
and dword [0x10e25c8], 0
call fcn.01055de3
call fcn.01055e25
call fcn.01032f00
jmp fcn.010215a5
ret

Function at 0x1058094
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10de03c]
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
xor esi, esi
push esi
push 0x2000000
push esi
push esi
push esi
push 0x100a0f8
xor edi, edi
push 0x80000001
inc edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1058108
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push 0x100c280
push dword [ebp - 0x30]
mov dword [ebp - 0x38], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10580ff
cmp dword [ebp - 0x34], 4
jne 0x10580ff
mov edi, dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.01075bbb
leave
ret

Function at 0x105811b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10de03c]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push 0x2000000
push esi
push esi
push esi
push 0x100a0f8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1058173
push 4
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x100c280
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01075bbb
leave
ret 4
Function at 0x105866e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10cefaa
call fcn.01077868
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call edi
mov esi, dword [ebp + 0xc]
push eax
mov ecx, esi
mov dword [ebp - 0x14], eax
call sub.MFC42u.DLL_CString::GetBufferSetLength
cmp eax, ebx
je 0x1058752
push dword [ebp - 0x14]
push eax
call edi
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42u.DLL_CString::ReleaseBuffer
push dword [esi]
call fcn.0103386b
mov edi, eax
cmp edi, ebx
je 0x1058752
mov eax, dword [esi]
push edi
push eax
lea ecx, [ebp + 0xc]
call fcn.01076d6c
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [0x10e25b0]
call fcn.010844f3
test ax, ax
jne 0x1058746
push dword [ebp - 0x18]
push dword [0x10e25b4]
call fcn.0108efdc
cmp eax, ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
je 0x1058746
mov eax, dword [esi]
mov ax, word [eax + edi*2]
cmp ax, 0x5c
mov ecx, esi
lea eax, [ebp + 8]
jne 0x1058721
inc edi
push edi
push eax
call sub.MFC42u.DLL_CString::Mid_1
mov byte [ebp - 4], 1
jmp 0x105872c
push edi
push eax
call sub.MFC42u.DLL_CString::Mid_1
mov byte [ebp - 4], 2
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
mov dword [ebp - 0x10], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x105876b
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10cefc4
call fcn.01077868
sub esp, 0x124
mov eax, dword [0x10de03c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.01074987
mov ecx, esi
call sub.MFC42u.DLL_CCmdTarget::BeginWaitCursor
mov ecx, esi
call sub.MFC42u.DLL_CCmdTarget::EndWaitCursor
push 1
call fcn.0102e3b7
mov edi, eax
cmp edi, 1
je 0x1058892
cmp edi, 4
je 0x1058880
lea ecx, [ebp - 0x12c]
call sub.MFC42u.DLL_CString::CString_4
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x128]
xor edi, edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0105866e
test eax, eax
je 0x105885d
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
push edi
push 0x2000000
push edi
push edi
push edi
push 0x100c2c8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105885d
push 0x45
pop ecx
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x124]
mov esi, 0x114
push eax
mov dword [ebp - 0x124], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
lea eax, [ebp - 0x124]
push eax
push 3
push 0
push 0x100c2a8
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov ecx, ebx
call fcn.010745c4
test eax, eax
je 0x105886f
push 7
call fcn.01039b13
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call sub.MFC42u.DLL_CString::CString
jmp 0x1058892
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xd4]
push 1
call sub.MFC42u.DLL_CWnd::EnableWindow
xor edi, edi
mov ecx, dword [ebp - 0xc]
xor eax, eax
test edi, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
sete al
pop ebx
call fcn.01075bbb
leave
ret 4