joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002440
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10002650
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x1008ccec], 0
jne 0x1000247d
cmp dword [0x1008cce8], 0
je 0x1000247d
mov eax, dword [0x1008cce8]
mov dword [0x1008ccec], eax
cmp dword [0x1008ccec], 0
je 0x100024fa
mov ecx, dword [0x1008ccec]
cmp dword [ecx + 8], 0
je 0x100024fa
mov edx, dword [0x1008ccec]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x100024fa
mov ecx, dword [0x1008ccec]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100024fa
mov eax, dword [0x1008ccec]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x100024c9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x100024d0
xor eax, eax
jmp 0x10002640
mov ecx, dword [0x1008ccec]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10051430
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10002640
mov edx, dword [0x1008cce8]
mov dword [0x1008ccec], edx
jmp 0x10002516
mov eax, dword [0x1008ccec]
mov ecx, dword [eax + 4]
mov dword [0x1008ccec], ecx
cmp dword [0x1008ccec], 0
je 0x10002556
cmp dword [0x1008ccec], 0
je 0x10002554
mov edx, dword [0x1008ccec]
cmp dword [edx + 8], 0
je 0x10002554
mov eax, dword [0x1008ccec]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x10002554
mov edx, dword [0x1008ccec]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10002554
jmp 0x100024ae
jmp 0x10002508
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x10002587
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10002830
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100025a0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10002730
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000263e
mov ecx, dword [ebp - 4]
mov dword [0x1008ccec], ecx
mov edx, dword [0x1008ccec]
mov dword [edx], 0x52727464
mov eax, dword [0x1008ccec]
mov dword [eax + 8], 0
mov ecx, dword [0x1008ccec]
mov edx, dword [0x1008cce8]
mov dword [ecx + 4], edx
mov eax, dword [0x1008ccec]
mov dword [0x1008cce8], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x1008ccec]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x10002609
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x1000262d
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x10002600
mov ecx, dword [0x1008ccec]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x100024ae
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002730
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002800
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100027f5
mov edx, dword [ebp - 4]
cmp edx, dword [0x1008b090]
jb 0x10002775
mov eax, dword [ebp - 4]
cmp eax, dword [0x1008b094]
ja 0x10002775
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10002745
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10051430
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000279b
jmp 0x100027f5
cmp dword [ebp - 0x10], 0x10000
jne 0x100027de
cmp dword [ebp - 0x14], 0x10000
jb 0x100027de
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100027d1
mov eax, dword [ebp - 0x24]
jmp 0x100027f7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100027f0
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002800
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10002745
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10002830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10002910
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100028fd
mov edx, dword [ebp - 4]
cmp edx, dword [0x1008b090]
jb 0x1000287a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1008b094]
ja 0x1000287a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000284a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10051430
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100028a0
jmp 0x100028fd
cmp dword [ebp - 0x10], 0x10000
jne 0x100028e3
cmp dword [ebp - 0x14], 0x10000
jb 0x100028e3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100028d6
mov eax, dword [ebp - 0x24]
jmp 0x100028ff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100028f8
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10002910
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000284a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10004a30
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x10004a88
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004a81
mov ecx, dword [ebp + 8]
push ecx
call fcn.1002f570
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
ja 0x10004a68
cmp dword [ebp - 8], 0xc800000
jbe 0x10004a7f
cmp dword [ebp + 0xc], 0
je 0x10004a78
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp + 8], 0
jmp 0x10004a88
mov dword [ebp + 8], 0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x10011e80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2030
call fcn.1004f4c0
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10012000
movzx eax, al
test eax, eax
je 0x10011fef
mov ecx, 2
imul edx, ecx, 0
mov dword [ebp - 0x2020], edx
cmp dword [ebp - 0x2020], 0x800
jae 0x10011ec3
jmp 0x10011ec8
call fcn.1004e90b
xor eax, eax
mov ecx, dword [ebp - 0x2020]
mov word [ebp + ecx - 0x804], ax
mov edx, 2
imul eax, edx, 0
mov dword [ebp - 0x2024], eax
cmp dword [ebp - 0x2024], 0x800
jae 0x10011ef4
jmp 0x10011ef9
call fcn.1004e90b
xor ecx, ecx
mov edx, dword [ebp - 0x2024]
mov word [ebp + edx - 0x1004], cx
push 0x1007dd74
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1007dd88
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea edx, [ebp - 0x201c]
push edx
call fcn.10011d90
add esp, 4
mov dword [ebp - 0x2030], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2030]
call fcn.10004d30
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0x400
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x201c]
call fcn.10004d70
mov eax, 2
imul ecx, eax, 0
mov dword [ebp - 0x2028], ecx
cmp dword [ebp - 0x2028], 0x1000
jae 0x10011f95
jmp 0x10011f9a
call fcn.1004e90b
xor edx, edx
mov eax, dword [ebp - 0x2028]
mov word [ebp + eax - 0x2004], dx
call fcn.10006600
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x202c], ecx
mov edx, dword [ebp - 0x202c]
push edx
lea eax, [ebp - 0x1004]
push eax
push 0x800
lea ecx, [ebp - 0x2004]
push ecx
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
mov dword [ebp - 0x202c], 0
lea edx, [ebp - 0x2004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret

Function at 0x10012890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100128d3
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.thread__d_created:__s
call fcn.10012530
add esp, 0xc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002f340
Capabilities:
Check if file exists
Clear file content
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d78b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x1002f382
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x1002f389
xor eax, eax
jmp 0x1002f519
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.10051430
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1002fa70
lea edx, [ebp - 0x218]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
je 0x1002f406
mov ecx, dword [ebp - 0x428]
and ecx, 0x10
je 0x1002f3f1
mov dword [ebp - 0x42c], 0
jmp 0x1002f3fb
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x42c]
jmp 0x1002f519
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x420]
push edx
call fcn.1002f540
test eax, eax
je 0x1002f517
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x424]
call fcn.10013ab0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
or ecx, dword [ebp + 0x10]
je 0x1002f4c9
lea ecx, [ebp - 0x424]
call fcn.10013b10
movzx edx, al
test edx, edx
je 0x1002f4c9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x438], ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x424]
call fcn.10007900
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea ecx, [ebp - 0x424]
call fcn.10007900
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea ecx, [ebp - 0x424]
call fcn.10013b10
movzx ecx, al
test ecx, ecx
je 0x1002f4e7
mov dword [ebp - 0x430], 1
jmp 0x1002f4f1
mov dword [ebp - 0x430], 0
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x434], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.10013ad0
mov eax, dword [ebp - 0x434]
jmp 0x1002f519
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002f6d0
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002f720
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.1002f340
test eax, eax
jne 0x1002f720
xor eax, eax
jmp 0x1002f7ff
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x10]
call fcn.10013ab0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.10013b10
movzx eax, al
test eax, eax
jne 0x1002f783
cmp dword [ebp - 0x14], 0
jne 0x1002f768
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013ad0
mov eax, dword [ebp - 0x1c]
jmp 0x1002f7ff
mov dword [ebp - 0x18], 0
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x10]
call fcn.10007900
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002f7ce
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x10]
jne 0x1002f7ce
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013ad0
mov eax, dword [ebp - 0x20]
jmp 0x1002f7ff
cmp dword [ebp - 0x14], 0
jne 0x1002f7e6
lea ecx, [ebp - 0x10]
call fcn.10013b40
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10013ad0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002f810
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x1002f82e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jge 0x1002f85c
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 8]
movzx edx, cl
mov eax, dword [ebp - 8]
shr eax, 8
and eax, 0xffffff
xor eax, dword [edx*4 + 0x1008bac8]
mov dword [ebp - 8], eax
jmp 0x1002f825
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100304e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d88b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x100305df
mov dword [ebp - 0x438], 0
push 0x424
push 0
lea eax, [ebp - 0x434]
push eax
call fcn.10051430
add esp, 0xc
mov dword [ebp - 0x438], 0x428
mov ecx, dword [ebp + 8]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push eax
lea ecx, [ebp - 0x43c]
call fcn.10013ab0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.10013b10
movzx edx, al
test edx, edx
je 0x100305cd
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x43c]
call fcn.10007900
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
je 0x100305cd
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x438]
push edx
call dword [ebp + 0xc]
test eax, eax
jne 0x100305ac
jmp 0x100305cd
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x43c]
call fcn.10007900
push eax
call dword [sym.imp.KERNEL32.dll_Module32NextW]
mov dword [ebp - 0x440], eax
jmp 0x1003058f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.10013ad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10031180
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
je 0x100311d4
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 4
jne 0x100311d4
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jne 0x100311d4
mov eax, 1
jmp 0x10031205
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x100311fb
mov dword [ebp - 0xc], 1
jmp 0x10031202
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10031260
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5014
call fcn.1004f4c0
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
je 0x100312fc
xor eax, eax
mov word [ebp - 0x5004], ax
push 0x4ffe
push 0
lea ecx, [ebp - 0x5002]
push ecx
call fcn.10051430
add esp, 0xc
mov dword [ebp - 0x5008], 0
mov dword [ebp - 0x5014], 0x5000
lea edx, [ebp - 0x5014]
push edx
lea eax, [ebp - 0x5004]
push eax
lea ecx, [ebp - 0x5008]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x5008], 1
jne 0x100312fc
lea edx, [ebp - 0x5004]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x100312fc
mov eax, 1
jmp 0x10031361
cmp dword [ebp + 0x14], 0
je 0x10031314
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x500c], eax
jmp 0x1003131e
mov dword [ebp - 0x500c], 0
mov edx, dword [ebp - 0x500c]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x10031351
mov dword [ebp - 0x5010], 1
jmp 0x1003135b
mov dword [ebp - 0x5010], 0
mov eax, dword [ebp - 0x5010]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10031380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d9cb
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x83c], 0
lea ecx, [ebp - 0x828]
call fcn.10007dd0
mov dword [ebp - 4], 0
mov dword [ebp - 0x830], 0
cmp dword [ebp + 0x10], 0
je 0x1003150d
xor eax, eax
mov word [ebp - 0x810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call fcn.10051430
add esp, 0xc
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x834], 0
lea edx, [ebp - 0x82c]
push edx
push 0
lea eax, [ebp - 0x834]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x834], 1
je 0x10031446
cmp dword [ebp - 0x834], 2
jne 0x1003150d
cmp dword [ebp - 0x82c], 0
je 0x1003150d
cmp dword [ebp - 0x82c], 0x800
jbe 0x100314b6
mov ecx, dword [ebp - 0x82c]
add ecx, 2
push ecx
call fcn.100550bc
add esp, 4
mov dword [ebp - 0x830], eax
mov edx, dword [ebp - 0x82c]
add edx, 2
push edx
push 0
mov eax, dword [ebp - 0x830]
push eax
call fcn.10051430
add esp, 0xc
lea ecx, [ebp - 0x82c]
push ecx
mov edx, dword [ebp - 0x830]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x100314d8
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x830], 0
je 0x100314ef
mov edx, dword [ebp - 0x830]
mov dword [ebp - 0x838], edx
jmp 0x100314fb
lea eax, [ebp - 0x810]
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp - 0x838]
push ecx
lea ecx, [ebp - 0x828]
call fcn.10007cc0
cmp dword [ebp - 0x830], 0
je 0x10031525
mov edx, dword [ebp - 0x830]
push edx
call fcn.100550b7
add esp, 4
lea eax, [ebp - 0x828]
push eax
mov ecx, dword [ebp + 8]
call fcn.10004dc0
mov ecx, dword [ebp - 0x83c]
or ecx, 1
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.10004d70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret
Function at 0x10031580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006da21
mov eax, dword fs:[0]
push eax
mov eax, 0x2044
call fcn.1004f4c0
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2030], 0
lea ecx, [ebp - 0x2050]
call fcn.10007bd0
mov dword [ebp - 4], 0
push 0
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2044]
call fcn.1002efd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2044]
call fcn.1002f090
movzx edx, al
test edx, edx
je 0x100316d3
mov dword [ebp - 0x202c], 0
xor eax, eax
mov word [ebp - 0x2010], ax
push 0x1ffe
push 0
lea ecx, [ebp - 0x200e]
push ecx
call fcn.10051430
add esp, 0xc
mov edx, 1
test edx, edx
je 0x100316d3
mov dword [ebp - 0x2034], 0x1000
mov eax, dword [ebp - 0x202c]
mov dword [ebp - 0x2038], eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2034]
push ecx
lea edx, [ebp - 0x2010]
push edx
mov eax, dword [ebp - 0x2038]
push eax
lea ecx, [ebp - 0x2044]
call fcn.10015980
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x203c], eax
mov ecx, dword [ebp - 0x202c]
add ecx, 1
mov dword [ebp - 0x202c], ecx
cmp dword [ebp - 0x203c], 0
je 0x10031697
jmp 0x100316d3
lea edx, [ebp - 0x2010]
push edx
lea ecx, [ebp - 0x2028]
call fcn.10004e40
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2028]
push eax
lea ecx, [ebp - 0x2050]
call fcn.10014170
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2028]
call fcn.10004d70
jmp 0x10031625
lea ecx, [ebp - 0x2050]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10007b60
mov edx, dword [ebp - 0x2030]
or edx, 1
mov dword [ebp - 0x2030], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2044]
call fcn.1002f060
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2050]
call fcn.10007680
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret