joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1110c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x111173
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
call fcn.00026f34
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x111154
test bl, bl
je 0x11113b
push 4
push 0x111180
push 1
push 0
push 0x111184
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0x111154
push 3
push 0x111198
push 1
push 0
push 0x111184
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11117a
lea eax, [ebp - 0xc]
call fcn.00013d18
ret

Function at 0x1116a8
Capabilities:
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
mov esi, 1
push 0
call sub.kernel32.dll_SetLastError
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x11173a
push 0
call sub.kernel32.dll_SetLastError
push 0xf01ff
mov eax, edi
call fcn.0001416c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x111727
push 0
call sub.kernel32.dll_SetLastError
push esp
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x11170f
push 0
call sub.kernel32.dll_SetLastError
xor esi, esi
jmp 0x111716
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push edi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x111727
push 0
call sub.kernel32.dll_SetLastError
push ebx
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x111741
push 0
call sub.kernel32.dll_SetLastError
jmp 0x111741
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x111804
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, edx
mov esi, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x1c
call fcn.00012c70
xor eax, eax
mov dword [edi], eax
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x111889
push 0x80000000
mov eax, esi
call fcn.0001416c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x111876
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x11186d
mov eax, dword [esp + 4]
mov edx, eax
dec edx
sub edx, 7
jae 0x111869
mov ebp, eax
jmp 0x11187d
xor ebp, ebp
jmp 0x11187d
call sub.kernel32.dll_GetLastError_1
mov dword [edi], eax
jmp 0x11187d
call sub.kernel32.dll_GetLastError_1
mov dword [edi], eax
test esi, esi
je 0x111890
push esi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x111890
call sub.kernel32.dll_GetLastError_1
mov dword [edi], eax
test ebx, ebx
je 0x11189a
push ebx
call sub.advapi32.dll_CloseServiceHandle
push 0
call sub.kernel32.dll_SetLastError
mov eax, ebp
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x11555c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, 0x250d70
xor eax, eax
push ebp
push 0x11572a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x115740
mov eax, dword [ebx]
call fcn.00112388
cdq
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00027444
push dword [ebp - 0xc]
push 0x115768
mov eax, dword [ebx]
call fcn.00112598
test eax, eax
sete al
lea edx, [ebp - 0x110]
call fcn.000294b8
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10]
call fcn.00013f4c
push dword [ebp - 0x10]
push 0x115768
push esi
push 0x115774
push dword [0x250da0]
push 0x115768
mov eax, dword [ebx]
call fcn.001123d0
push eax
call fcn.00029304
pop edx
call fcn.000292ac
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x114]
call fcn.00027444
push dword [ebp - 0x114]
push 0x115780
mov eax, dword [ebx]
call fcn.00112550
push eax
call fcn.00029304
pop edx
call fcn.000292ac
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x118]
call fcn.00027444
push dword [ebp - 0x118]
push 0x11578c
lea eax, [ebp - 8]
mov edx, 0xd
call fcn.00014068
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.001170e8
xor eax, eax
push ebp
push 0x1156b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.001125e8
test eax, eax
je 0x115694
push 0
mov eax, dword [ebx]
call fcn.001125e8
push eax
call sub.kernel32.dll_TerminateThread
xor edx, edx
mov eax, dword [ebx]
call fcn.001125c0
xor edx, edx
mov eax, dword [ebx]
call fcn.0011260c
xor edx, edx
mov eax, dword [ebx]
call fcn.001123ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1156f2
mov edx, 0x1157b0
mov eax, dword [ebp - 4]
call fcn.001170e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x115731
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00013d3c
ret

Function at 0x116f34
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, eax
xor ebx, ebx
cmp byte [0x250d78], 0
jne 0x116fed
mov edx, esp
mov eax, dword [0x250d70]
call fcn.00112488
cmp dword [esp], 0
je 0x116fed
cmp dword [esp + 4], 0
je 0x116fed
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x116ff8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x116fd6
mov esi, 8
mov edi, 3
push esi
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x117024
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x116fd6
mov byte [0x250d78], 1
mov bl, 1
mov eax, dword [esp]
mov dword [ebp], eax
mov eax, dword [esp + 4]
mov dword [ebp + 4], eax
cmp dword [esp + 8], 0
je 0x116fe7
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [esp + 8], eax
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x117030
Capabilities:
Delete registry value

Disassembly:
add esp, 0xfffffff4
xor eax, eax
mov dword [esp], eax
push esp
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x1170a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x11706a
push 0x1170d4
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [0x250d70]
mov edx, dword [esp + 4]
mov dword [eax + 0x78], edx
mov edx, dword [esp + 8]
mov dword [eax + 0x7c], edx
mov byte [0x250d78], 0
cmp dword [esp], 0
je 0x11709f
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [esp], eax
add esp, 0xc
ret

Function at 0x118614
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0001415c
xor eax, eax
push ebp
push 0x118692
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0001416c
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x11865d
mov eax, dword [ebx + 4]
call fcn.0001416c
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x118699
lea eax, [ebp - 4]
call fcn.00013d18
ret
Function at 0x124cc0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x124e76
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00013ee0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x124e90
call fcn.00013ff4
mov eax, dword [ebp - 0x10]
call fcn.00124c9c
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 8]
mov edx, 0x5000
call fcn.000271f0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x124d3b
push 0
call sub.kernel32.dll_SetLastError
call fcn.00124c78
mov ebx, eax
test esi, esi
je 0x124e1c
mov eax, 0x124ebc
call fcn.00124c9c
push 0xf01ff
mov eax, edi
call fcn.0001416c
push eax
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x124d74
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x124d7f
call fcn.00124c78
mov ebx, eax
test edi, edi
je 0x124de0
lea eax, [ebp - 0xc]
push eax
push 0xa
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
jne 0x124dd5
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x124dd5
mov eax, 0x124ed4
call fcn.00124c9c
add dword [ebp - 0xc], 0x64
cmp dword [ebp - 0xc], 0x5000
ja 0x124dd5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x124dd5
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x124de0
call fcn.00124c78
mov ebx, eax
test edi, edi
je 0x124e00
push edi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x124df5
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x124e00
call fcn.00124c78
mov ebx, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x124e11
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x124e1c
call fcn.00124c78
mov ebx, eax
test ebx, ebx
jne 0x124e30
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00027370
jmp 0x124e3d
mov edx, 0x124ee0
mov eax, dword [ebp - 4]
call fcn.00027370
lea eax, [ebp - 8]
mov edx, 0x5000
call fcn.00027218
push 0
call sub.kernel32.dll_SetLastError
mov eax, 0x124eec
call fcn.00124c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x124e7d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00013d3c
ret
Function at 0x1251ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x125266
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, 2
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x12523c
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x125274
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x12523c
cmp dword [ebp - 8], 4
jne 0x12523c
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x12524b
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12526d
lea eax, [ebp - 0x14]
call fcn.00013d18
ret

Function at 0x125290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x12534a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x125320
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x125358
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x125320
cmp dword [ebp - 4], 4
jne 0x125320
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 8], 0
je 0x12532f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x125351
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0x125380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x12543a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x125410
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x125448
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x125410
cmp dword [ebp - 0xc], 4
jne 0x125410
mov ebx, dword [ebp - 4]
cmp dword [ebp - 8], 0
je 0x12541f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x125441
lea eax, [ebp - 0x14]
call fcn.00013d18
ret

Function at 0x125474
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x12552e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x125504
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x12553c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x125504
cmp dword [ebp - 0x10], 4
jne 0x125504
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 8], 0
je 0x125513
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x125535
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0x12c32c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x12c405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x251a1c]
mov byte [eax], 0
or esi, 0xffffffff
lea eax, [ebp - 0x14]
call fcn.0002a83c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00032acc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x12c41c
call fcn.00013ff4
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp - 0xc]
push 0x12c42c
push 0x12c438
push 0x12c450
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00014068
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
test ebx, ebx
je 0x12c3e4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
cmp dword [ebp - 4], 0
je 0x12c3e4
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [0x251288], eax
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12c40c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00013d3c
ret
Function at 0x12edb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x12edb8
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0001415c
xor eax, eax
push ebp
push 0x12efa5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push dword [ebp - 4]
push 0x12efbc
push 0x12efc8
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x12ef02
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x12f004
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
test esi, esi
jne 0x12eece
cmp dword [ebp - 8], 4
jne 0x12eece
cmp dword [ebp - 0xc], 1
jne 0x12ef34
xor eax, eax
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0x12f004
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov esi, eax
mov bl, 1
test esi, esi
je 0x12ef34
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x12f018
call fcn.00013ff4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.000145ac
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x251144]
call fcn.001174d0
jmp 0x12ef34
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x12f02c
call fcn.00013ff4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.000145ac
mov edx, dword [ebp - 0x28]
mov eax, dword [0x251144]
call fcn.001174d0
jmp 0x12ef34
lea edx, [ebp - 0x3c]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov edx, 0x12f040
call fcn.00013ff4
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.000145ac
mov edx, dword [ebp - 0x34]
mov eax, dword [0x251144]
call fcn.001174d0
cmp dword [ebp - 0x10], 0
je 0x12ef43
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12efac
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x34]
call fcn.000143f0
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x28]
call fcn.000143f0
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x1c]
call fcn.000143f0
lea eax, [ebp - 0x18]
call fcn.00013d18
lea eax, [ebp - 4]
call fcn.00013d18
ret
Function at 0x12f04c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x12f054
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0001415c
xor eax, eax
push ebp
push 0x12f23a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push dword [ebp - 4]
push 0x12f254
push 0x12f260
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x12f197
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x12f29c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
test esi, esi
jne 0x12f163
cmp dword [ebp - 8], 4
jne 0x12f163
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0x12f29c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov esi, eax
test esi, esi
jne 0x12f12f
mov bl, 1
jmp 0x12f1c9
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x12f2b0
call fcn.00013ff4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.000145ac
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x251144]
call fcn.001174d0
jmp 0x12f1c9
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x12f2c4
call fcn.00013ff4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.000145ac
mov edx, dword [ebp - 0x28]
mov eax, dword [0x251144]
call fcn.001174d0
jmp 0x12f1c9
lea edx, [ebp - 0x3c]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov edx, 0x12f2d8
call fcn.00013ff4
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.000145ac
mov edx, dword [ebp - 0x34]
mov eax, dword [0x251144]
call fcn.001174d0
cmp dword [ebp - 0x14], 0
je 0x12f1d8
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12f241
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x34]
call fcn.000143f0
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x28]
call fcn.000143f0
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x1c]
call fcn.000143f0
lea eax, [ebp - 0x18]
call fcn.00013d18
lea eax, [ebp - 4]
call fcn.00013d18
ret