joyce8/EMBER2024-capa huggingface dataset:
Function at 0x120083ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 8]
test eax, eax
jne 0x12008405
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
and byte [ebp - 0x114], 0
push ebx
push esi
push edi
push 0x40
mov dword [0x120b7cf4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push esi
push eax
push str.ResDll
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push str.softwareGator.comGatordyn
push edi
call fcn.120085b5
add esp, 0x14
test eax, eax
jne 0x120084bf
lea eax, [ebp - 0x114]
push esi
push eax
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push edi
call fcn.120085b5
add esp, 0x14
test eax, eax
je 0x120084bf
lea eax, [ebp - 0x114]
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x114], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, 0x120a9b58
je 0x12008499
lea eax, [ebp - 0x114]
push edi
push eax
call esi
lea eax, [ebp - 0x114]
push 0x120a9cb4
push eax
call esi
lea eax, [ebp - 0x114]
push edi
push eax
call esi
lea eax, [ebp - 0x114]
push 0x120a9b84
push eax
call esi
cmp byte [ebp - 0x114], 0
mov ebx, 0x120b7e08
mov edi, 0x120b7e04
mov esi, 0x120b7cf0
je 0x120084f0
push ebx
push edi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.12007e3c
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
jne 0x1200850b
push ebx
push edi
push esi
push str.GatorRes.dll
call fcn.12007e3c
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
je 0x120085ad
mov eax, dword [0x120b7cf0]
and dword [ebp - 4], 0
mov dword [0x120b7cf8], eax
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push str.softwareGator.comGatordyn
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, 0x120b7e14
mov edi, 0x120b7e10
mov esi, 0x120b7e0c
jne 0x12008598
and dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.OEMResDll
mov dword [ebp - 0xc], 0x104
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x12008589
push ebx
push edi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.12007e3c
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x120085a8
push ebx
push edi
push esi
push str.GatorOEMRes.dll
call fcn.12007e3c
add esp, 0x10
call fcn.120081fa
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x120085b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x12008634
mov edx, dword [ebp + 0xc]
cmp edx, ebx
je 0x12008634
cmp byte [edx], bl
je 0x12008634
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
je 0x12008634
cmp byte [ecx], bl
je 0x12008634
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x12008634
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x12008634
lea eax, [ebp + 8]
mov byte [esi], bl
push eax
push 0x20019
push ebx
push edx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1200862d
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
mov dword [ebp + 0x14], ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x12008624
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1200d5ee
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x120875c0
call fcn.12055780
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
call fcn.1200d4af
test eax, eax
pop ecx
je 0x1200d812
mov dword [ebp - 0x14], edi
push 0x7d0
push 0x11
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.1200e278
test eax, eax
je 0x1200d7e9
cmp dword [0x120b843c], edi
jne 0x1200d7c1
push dword [0x120b8848]
mov dword [0x120b8840], edi
call fcn.12074064
mov eax, dword [0x120b3180]
mov dword [0x120b8848], edi
mov dword [ebp + 8], eax
push dword [0x120aa92c]
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
call fcn.1200dd9c
add esp, 0xc
cmp eax, edi
je 0x1200d7a9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x120b843c], eax
je 0x1200d787
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CTB_LoadDataFile2
push eax
call esi
cmp eax, edi
mov dword [0x120b885c], eax
je 0x1200d737
push str.CTB_UpdateDataFile
push dword [0x120b843c]
call esi
cmp eax, edi
mov dword [0x120b8860], eax
je 0x1200d737
push str.CTB_GetDataFileVersion
push dword [0x120b843c]
call esi
cmp eax, edi
mov dword [0x120b8858], eax
je 0x1200d737
push str.CTB_DetermineDomainSupport
push dword [0x120b843c]
call esi
cmp eax, edi
mov dword [0x120b8854], eax
je 0x1200d737
push str.CTB_PriceComparison
push dword [0x120b843c]
call esi
cmp eax, edi
mov dword [0x120b8850], eax
je 0x1200d737
push edi
call fcn.1200de97
cmp eax, edi
pop ecx
mov dword [0x120b8840], eax
jne 0x1200d728
push str.Datafile_load_failed
push 0xbd
push str.D:FixTree_253rdPartyCTBPriceComparison.cpp
push edi
call fcn.1200f490
add esp, 0x10
push 1
call fcn.1200de97
pop ecx
mov dword [0x120b8844], eax
jmp 0x1200d7a9
push str.Function_table_wrong
push 0xc4
push str.D:FixTree_253rdPartyCTBPriceComparison.cpp
push edi
call fcn.1200f490
add esp, 0x10
mov dword [0x120b885c], edi
mov dword [0x120b8860], edi
mov dword [0x120b8858], edi
push dword [0x120b843c]
mov dword [0x120b8854], edi
mov dword [0x120b8850], edi
mov dword [0x120b8840], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x120b843c], edi
jmp 0x1200d7a9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DLL_load_failed__d_:__s
push 0xd4
push str.D:FixTree_253rdPartyCTBPriceComparison.cpp
push edi
call fcn.1200f4fa
add esp, 0x18
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.1207396a
jmp 0x1200d801
cmp dword [ebp + 8], edi
jne 0x1200d7d4
push edi
call fcn.1200de97
pop ecx
mov dword [0x120b8840], eax
jmp 0x1200d801
cmp dword [ebp + 8], 1
jne 0x1200d801
push 1
call fcn.1200de97
pop ecx
mov dword [0x120b8844], eax
jmp 0x1200d801
push str.Control.Enter_failed
push 0xed
push str.D:FixTree_253rdPartyCTBPriceComparison.cpp
push edi
call fcn.1200f490
add esp, 0x10
cmp dword [ebp - 0x14], edi
je 0x1200d812
push dword [0x120b884c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [0x120b843c], edi
pop edi
pop esi
mov dword fs:[0], ecx
setne al
pop ebx
leave
ret
Function at 0x1200e278
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x120b884c]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
jne 0x1200e2a4
test byte [esp + 0xc], 0x10
je 0x1200e2fc
push str.GatorPCE
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [0x120b884c], eax
je 0x1200e2fc
push dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1200e2f0
cmp dword [0x120b843c], edi
push 1
pop eax
jne 0x1200e2ea
test byte [esp + 0xc], al
jne 0x1200e2ea
push str.ControlledEntry:_DLL_not_loaded
push 0x443
push str.D:FixTree_253rdPartyCTBPriceComparison.cpp
push edi
call fcn.1200f490
add esp, 0x10
push dword [0x120b884c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1200e314
mov edi, eax
mov dword [esi], eax
jmp 0x1200e314
push str.ControlledEntry:_Timeout_waiting_for_Mutex
push 0x44b
jmp 0x1200e306
push str.ControlledEntry:_Mutex_is_NULL
push 0x450
push str.D:FixTree_253rdPartyCTBPriceComparison.cpp
push edi
call fcn.1200f490
add esp, 0x10
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x1200e5af
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
and byte [ebp - 0xe0], 0
push esi
push edi
mov esi, ecx
push 0x13
xor eax, eax
pop ecx
lea edi, [ebp - 0xdf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xe0]
push 0x50
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x1200e748
and byte [ebp - 0x90], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x8f]
push 0x80
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0xe0]
push str.Static
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
jne 0x1200e748
lea eax, [ebp - 0x90]
push str.Site:
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
jne 0x1200e66a
lea edi, [esi + 0x1d0]
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x1200e748
lea eax, [ebp - 0x90]
push str.Realm
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
je 0x1200e698
lea eax, [ebp - 0x90]
push str.Resource:
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
jne 0x1200e6a0
lea edi, [esi + 0x1e0]
jmp 0x1200e65e
lea eax, [ebp - 0x90]
push str.User_Name
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
je 0x1200e6ce
lea eax, [ebp - 0x90]
push str.User_Name:
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
jne 0x1200e6d6
lea edi, [esi + 0x1f0]
jmp 0x1200e65e
lea eax, [ebp - 0x90]
push str.Password
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
je 0x1200e704
lea eax, [ebp - 0x90]
push str.Password:
push eax
call fcn.12055af0
pop ecx
test eax, eax
pop ecx
jne 0x1200e70f
lea edi, [esi + 0x200]
jmp 0x1200e65e
mov edi, str.Enter_username_for
push edi
call fcn.12055dd0
push eax
lea eax, [ebp - 0x90]
push edi
push eax
call fcn.120561c0
add esp, 0x10
test eax, eax
jne 0x1200e748
lea eax, [ebp - 0x90]
push 0x100
add esi, 0x210
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
pop esi
leave
ret 4
Function at 0x1200e74e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x1200e80a
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0x1d0]
push eax
call fcn.1200e811
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
test al, al
je 0x1200e795
lea eax, [esi + 0x10]
push 0x40
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0x1e0]
push eax
call fcn.1200e811
test al, al
mov ebx, 0x80
je 0x1200e7ba
lea eax, [esi + 0x50]
push ebx
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0x1f0]
push eax
call fcn.1200e811
test al, al
je 0x1200e7e3
lea eax, [esi + 0xd0]
push ebx
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0x200]
push eax
call fcn.1200e811
test al, al
je 0x1200e80a
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esi + 0x150]
push eax
push ebx
call edi
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1200f59a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x1200f5af
mov dword [esi], ebx
cmp dword [ebp + 8], ebx
je 0x1200f689
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200f689
cmp byte [eax], bl
je 0x1200f689
cmp esi, ebx
je 0x1200f689
lea ecx, [ebp + 0xc]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1200f689
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp + 0x14]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], ebx
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1200f67a
push dword [ebp + 8]
call fcn.1207403b
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x1200f67a
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1200f671
push 1
pop edi
cmp dword [ebp + 0x14], edi
jne 0x1200f671
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.1207403b
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x1200f671
mov ecx, dword [ebp + 8]
inc ecx
push ecx
push ebx
push eax
call fcn.12055850
add esp, 0xc
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call fcn.12074064
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
pop edi
jne 0x1200f6b0
cmp dword [ebp + 0x18], ebx
je 0x1200f6b0
push dword [ebp + 0x18]
call fcn.12055dd0
inc eax
push eax
call fcn.1207403b
pop ecx
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x1200f6b0
push dword [ebp + 0x18]
push eax
call fcn.12055e80
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x1200f6b7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [edi], eax
je 0x1200f724
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200f724
cmp byte [eax], bl
je 0x1200f724
lea ecx, [ebp + 0x14]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1200f724
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 4
push eax
lea eax, [ebp + 8]
push edi
push eax
push ebx
mov dword [ebp + 8], ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1200f71b
cmp dword [ebp + 8], 4
jne 0x1200f71b
push 1
pop ebx
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
pop ebp
ret

Function at 0x1200f72a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 8], ebx
je 0x1200f73f
mov dword [esi], ebx
cmp dword [ebp + 8], ebx
je 0x1200f810
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200f810
cmp byte [eax], bl
je 0x1200f810
lea ecx, [ebp + 0xc]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1200f810
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp + 0x14]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], ebx
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1200f806
push dword [ebp + 8]
call fcn.1207403b
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x1200f806
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x1200f7fd
cmp dword [ebp + 0x14], 3
jne 0x1200f7fd
push dword [ebp + 8]
call fcn.1207403b
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x1200f7fd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push eax
push ebx
mov dword [ecx], eax
push dword [esi]
call fcn.12055850
push dword [ebp + 8]
push dword [ebp - 4]
push dword [esi]
call fcn.120562e0
add esp, 0x18
mov dword [ebp - 8], 1
push dword [ebp - 4]
call fcn.12074064
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x1200f817
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x1200f87c
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200f87c
cmp byte [eax], bl
je 0x1200f87c
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1200f87c
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1200f873
push 1
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x1200f882
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x1200f8df
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200f8df
cmp byte [eax], bl
je 0x1200f8df
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1200f8df
lea eax, [ebp + 0x14]
push 4
push eax
push 4
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1200f8d6
push 1
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x1200f8e5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
je 0x1200f94b
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200f94b
cmp byte [eax], bl
je 0x1200f94b
cmp dword [ebp + 0x18], 0x3fac
ja 0x1200f94b
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1200f94b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1200f942
push 1
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x1200f951
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor ecx, ecx
xor esi, esi
cmp dword [ebp + 8], ecx
je 0x1200f99d
mov eax, dword [ebp + 0xc]
cmp eax, ecx
je 0x1200f99d
cmp byte [eax], cl
je 0x1200f99d
lea edx, [ebp + 8]
push edx
push 0x20006
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1200f99d
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 8]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1200f9a2
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x918
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 4], ebx
je 0x1200fb15
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1200fb15
cmp byte [eax], bl
je 0x1200fb15
push eax
lea eax, [ebp - 0x918]
push eax
call fcn.12055e80
lea eax, [ebp - 0x918]
push 0x5c
push eax
call fcn.12055f70
add esp, 0x10
cmp eax, ebx
jne 0x1200f9f8
xor eax, eax
jmp 0x1200fb18
and byte [eax], 0
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 0x2001f
push eax
push edi
lea eax, [ebp - 0x918]
push ebx
push eax
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1200fb15
and dword [ebp - 4], eax
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
lea ecx, [ebp - 0x118]
push 0x105
push ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1200fa64
push dword [ebp - 0x10]
lea eax, [ebp - 0x118]
push eax
call fcn.12055bd0
mov ebx, eax
pop ecx
neg ebx
sbb ebx, ebx
pop ecx
inc ebx
je 0x1200fa2a
test ebx, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 1
je 0x1200fb10
lea eax, [ebp - 0xc]
and dword [ebp - 0xc], 0
push eax
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1200fafc
lea eax, [ebp - 0x118]
push 0x105
push eax
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1200faf7
push dword [ebp + 0xc]
lea eax, [ebp - 0x518]
push eax
call fcn.12055e80
lea eax, [ebp - 0x518]
push 0x120a9b58
push eax
call fcn.12055e90
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x518]
push eax
call fcn.12055e90
lea eax, [ebp - 0x518]
push eax
push dword [ebp + 8]
call fcn.1200f9a2
add esp, 0x20
mov dword [ebp - 4], eax
test eax, eax
jne 0x1200fa90
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x1200fb10
and dword [ebp - 4], 0
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1200ffbf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1200ffd3
and dword [edi], 0
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x12010082
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x12010082
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 8], eax
je 0x12010082
lea ecx, [ebp + 0xc]
push ebx
push ecx
push eax
call fcn.1200fecc
mov ebx, dword [ebp + 0x14]
pop ecx
test ebx, ebx
pop ecx
mov esi, eax
je 0x12010035
cmp dword [ebx], 0
je 0x12010033
test esi, esi
je 0x1201002f
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebx]
jmp 0x12010035
mov dword [ebx], esi
test edi, edi
je 0x1201006b
push 0
call dword [sym.imp.USER32.dll_GetDC]
push esi
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.120100bf
mov ecx, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
mov dword [ecx], eax
je 0x12010060
mov dword [ebp - 4], 1
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x12010072
mov dword [ebp - 4], 1
test ebx, ebx
pop ebx
jne 0x12010082
test esi, esi
je 0x12010082
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x1201089e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 8]
push esi
push str.PALETTE
push eax
xor esi, esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x120108e0
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x120108e0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x120108e0
add eax, 0x14
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
mov esi, eax
mov eax, esi
pop esi
ret