joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b022b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
test eax, eax
je 0x100d4331
xor esi, esi
mov dword [ebp - 8], esi
test edi, edi
jne 0x100d434a
mov dword [ebp - 8], ebx
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test byte [ebp + 8], 1
jne 0x100d43d9
test eax, eax
jne 0x100d43ec
test edi, edi
jne 0x100d4418
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
push 0x1002f91c
mov edx, 0x3e0
mov ecx, 0x10009bfc
call fcn.100e970f
jmp 0x100b0252
test byte [ebp + 8], 2
lea eax, [ebp - 8]
mov edx, edi
je 0x100d4382
push esi
push eax
push ecx
push 2
push esi
push ecx
push ecx
mov ecx, ebx
call fcn.100afc63
test eax, eax
je 0x100d43d1
jg 0x100d436e
mov esi, eax
jmp 0x100d4377
movzx esi, ax
or esi, 0x80070000
push edi
push 0x1002f784
jmp 0x100d4403
push eax
push 2
push esi
mov ecx, ebx
call fcn.100afca4
test byte [ebp + 8], 1
je 0x100d43b6
cmp eax, 2
je 0x100d439d
cmp eax, 3
jne 0x100d43b6
test eax, eax
jg 0x100d43a8
mov esi, eax
jmp 0x100b0287
movzx esi, ax
or esi, 0x80070000
jmp 0x100b0287
test eax, eax
je 0x100d43d1
jg 0x100d43c0
mov esi, eax
jmp 0x100d43c9
movzx esi, ax
or esi, 0x80070000
push edi
push 0x1002f7a0
jmp 0x100d4403
mov ebx, dword [ebp - 8]
jmp 0x100b0262
cmp eax, 2
jne 0x100b027f
mov esi, 0x80070002
jmp 0x100b0287
jg 0x100d43f2
mov esi, eax
jmp 0x100d43fb
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0xc]
push 0x1002f7b8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b0287
cmp dword [ebp - 8], 0
je 0x100b028f
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x100b028f
Function at 0x100b0f6f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x1c], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push edi
mov edi, edx
test eax, eax
je 0x100d4598
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
test edi, edi
jne 0x100b0ff3
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 2
jne 0x100b1024
mov esi, 0x80070002
test edi, edi
jne 0x100b1046
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20019
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
cmp eax, 2
je 0x100d45ee
cmp eax, 3
je 0x100d45ee
test eax, eax
jne 0x100d45b1
mov ebx, dword [ebp - 0x18]
jmp 0x100b0fb4
test eax, eax
jne 0x100d4607
cmp dword [ebp - 0xc], 0xb
jne 0x100d460d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
jmp 0x100b0fdc
cmp dword [ebp - 0x18], 0
je 0x100b0fe0
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x100b0fe0
push 0x1002f70c
mov edx, 0x263
mov ecx, 0x10009bfc
call fcn.100e970f
jmp 0x100b0f9c
jg 0x100d45b7
mov esi, eax
jmp 0x100d45c0
movzx esi, ax
or esi, 0x80070000
push edi
push 0x10009c20
jmp 0x100d45d9
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0x1c]
push 0x10009c5c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b0fdc
test eax, eax
jg 0x100d45f9
mov esi, eax
jmp 0x100b0fdc
movzx esi, ax
or esi, 0x80070000
jmp 0x100b0fdc
jg 0x100d45c8
mov esi, eax
jmp 0x100d45d1
push 0x1002f718
push 1
mov esi, 0x8007000d
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b0fdc
Function at 0x100b1990
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push esi
push 0x208
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100d4eb4
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.100a7590
mov esi, eax
test esi, esi
js 0x100d4eec
lea ecx, [ebp - 0x210]
call fcn.100b15f5
mov esi, eax
test esi, esi
js 0x100d4efa
push 0x10008b24
mov edx, 0x10008b10
lea ecx, [ebp - 0x210]
call fcn.100a9500
mov esi, eax
test esi, esi
js 0x100d4f1b
mov edi, dword [ebp - 0x210]
push ebx
push edi
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100d4f3b
push 0x10008af0
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca7c], eax
test eax, eax
je 0x100d4f75
push 0x10008acc
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca80], eax
test eax, eax
je 0x100d4fbc
mov dword [0x101dc9f8], ebx
xor ebx, ebx
test ebx, ebx
jne 0x100d4fd6
pop ebx
test edi, edi
je 0x100b1a98
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100b88c0
leave
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100d4ecb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100d4ed2
mov esi, 0x80004005
push 0x1004c8f4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b1a99
mov edi, dword [ebp - 0x210]
push edi
push 0x1004c924
jmp 0x100d4f06
mov edi, dword [ebp - 0x210]
push edi
push 0x1004c960
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b1a8a
push 0x100421cc
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 0x210]
add esp, 0x10
jmp 0x100b1a8a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d4f4d
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x100d4f5a
mov esi, 0x80004005
mov eax, esi
push edi
push 0x1004c99c
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b1a89
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d4f87
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x100d4f94
mov esi, 0x80004005
mov eax, esi
push 0x1004c9bc
jmp 0x100d4fa7
mov esi, 0x80004005
mov eax, esi
push 0x1004ca00
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b1a81
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d4fce
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x100d4fa2
jmp 0x100d4f9b
and dword [0x101dca7c], 0
and dword [0x101dca80], 0
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_FreeLibrary]
jmp 0x100b1a89
Function at 0x100b1de4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101dca58], 0
push ebx
mov ebx, dword [0x101dc370]
push esi
push edi
mov dword [ebp - 0x218], ecx
jne 0x100d526c
xor edi, edi
lea eax, [ebp - 0x210]
push 0x208
push edi
push eax
xor esi, esi
mov dword [ebp - 0x214], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x224]
push 1
push 0x101dd038
call fcn.100ad791
cmp dword [0x101dca58], esi
jne 0x100d5283
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100d52ae
test ebx, ebx
jne 0x100d5312
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.100a7590
mov esi, eax
test esi, esi
js 0x100d52c9
lea ecx, [ebp - 0x214]
call fcn.100b15f5
mov esi, eax
test esi, esi
js 0x100d52d7
push 0x10008c0c
mov edx, 0x10008bf4
lea ecx, [ebp - 0x214]
call fcn.100a9500
mov esi, eax
test esi, esi
js 0x100d52eb
mov edi, dword [ebp - 0x214]
push 2
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_LoadLibraryExW]
mov dword [0x101dca58], eax
test eax, eax
je 0x100d531c
test edi, edi
je 0x100b1ef0
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
lea ecx, [ebp - 0x224]
call fcn.100aa570
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
push 0x10042068
push 0x15
pop edx
mov ecx, 0x1004207c
call fcn.100e970f
jmp 0x100b1e15
push 0x100420a4
mov esi, 0x800f0802
jmp 0x100d5299
mov esi, 0x80004005
push 0x100420d8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b1ef0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100d52c5
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100d5294
jmp 0x100d528f
mov edi, dword [ebp - 0x214]
push edi
push 0x10042110
jmp 0x100d52e3
mov edi, dword [ebp - 0x214]
push edi
push 0x10042158
push 1
push esi
jmp 0x100d5388
push 0x10042198
jmp 0x100d52f7
push 0x100421cc
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 0x214]
add esp, 0x10
jmp 0x100b1ee2
mov eax, dword [0x101dca58]
jmp 0x100b1eda
test edi, edi
je 0x100d5331
lea eax, [edi - 4]
push eax
call fcn.100b84f9
and dword [ebp - 0x214], 0
pop ecx
mov edx, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
push 0x10008c0c
call fcn.100a9500
mov esi, eax
test esi, esi
js 0x100d52f2
mov edi, dword [ebp - 0x214]
push 2
push 0
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_LoadLibraryExW]
mov dword [0x101dca58], eax
test eax, eax
jne 0x100b1ee2
xor esi, esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d537f
movzx eax, ax
or eax, 0x80070000
push edi
push 0x100421fc
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b1ee2
Function at 0x100b2838
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
test edi, edi
je 0x100d5986
and dword [edi], 0
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100d599d
lea ecx, [ebp - 0x20c]
call fcn.100b2aac
mov esi, eax
test esi, esi
js 0x100d59c2
push ebx
lea edx, [ebp - 0x20c]
mov ecx, edi
call fcn.100a9500
mov esi, eax
test esi, esi
js 0x100d59c9
mov ecx, edi
call fcn.100b28e1
mov esi, eax
test esi, esi
js 0x100d59d0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 4
push 0x10044068
push 0x2e
pop edx
mov ecx, 0x1004407c
call fcn.100e970f
jmp 0x100b285d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100d59b4
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100d59bb
mov esi, 0x80004005
push 0x100349f4
jmp 0x100d59d5
push 0x100440b0
jmp 0x100d59d5
push 0x100440f4
jmp 0x100d59d5
push 0x1004411c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b28ce
Function at 0x100b6c87
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, edx
mov ebx, ecx
push 3
xor edx, edx
mov dword [ebp - 4], ebx
pop esi
div esi
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov edi, eax
mov dword [ebp - 8], edi
test edx, edx
jne 0x100d8959
inc ecx
lea eax, [ecx + edi*4]
cmp eax, 0x81
ja 0x100b6d54
xor esi, esi
test edi, edi
mov edi, dword [ebp + 8]
je 0x100b6d3e
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov bl, byte [eax + 1]
mov dl, byte [eax + 2]
add eax, 3
mov dword [ebp - 4], eax
movzx eax, cl
and cl, 3
shr eax, 2
shl cl, 4
movzx ecx, cl
movzx edx, dl
mov al, byte [eax + 0x10025ab0]
mov byte [esi + edi], al
movzx eax, bl
and bl, 0xf
shr eax, 4
or ecx, eax
shl bl, 2
mov al, byte [ecx + 0x10025ab0]
mov byte [esi + edi + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
movzx ecx, bl
or ecx, eax
mov al, byte [ecx + 0x10025ab0]
mov byte [esi + edi + 2], al
mov al, byte [edx + 0x10025ab0]
mov byte [esi + edi + 3], al
add esi, 4
sub dword [ebp - 8], 1
jne 0x100b6cca
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
sub edx, 1
je 0x100d89af
sub edx, 1
je 0x100d8966
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
leave
ret 4
cmp edx, 1
setne cl
add ecx, esi
jmp 0x100b6cb3
mov cl, byte [ebx]
mov dl, byte [ebx + 1]
movzx eax, cl
and cl, 3
shr eax, 2
shl cl, 4
movzx ecx, cl
mov al, byte [eax + 0x10025ab0]
mov byte [esi + edi], al
movzx eax, dl
and dl, 0xf
shr eax, 4
or ecx, eax
shl dl, 2
mov al, byte [ecx + 0x10025ab0]
mov byte [esi + edi + 1], al
movzx eax, dl
mov al, byte [eax + 0x10025ab0]
mov byte [esi + edi + 2], al
mov byte [esi + edi + 3], 0x3d
jmp 0x100d89da
mov cl, byte [ebx]
movzx eax, cl
and cl, 3
shr eax, 2
shl cl, 4
mov al, byte [eax + 0x10025ab0]
mov byte [esi + edi], al
movzx eax, cl
mov al, byte [eax + 0x10025ab0]
mov byte [esi + edi + 1], al
mov word [esi + edi + 2], 0x3d3d
add esi, 4
jmp 0x100b6d50

Function at 0x100b707f
Capabilities:
Set thread local storage value

Disassembly:
mov edx, dword [0x101dc37c]
push esi
xor esi, esi
cmp edx, 0xffffffff
je 0x100b70a6
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
push eax
push edx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
test eax, eax
je 0x100d8ae4
mov eax, esi
pop esi
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100d8afb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100d8b02
mov esi, 0x80004005
push 0x10031bb0
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b70a6
Function at 0x100b72d2
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
and dword [ebp - 8], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
push edx
push eax
call fcn.100b7330
mov esi, eax
test esi, esi
js 0x100d8c2d
cmp byte [ebp + 8], 0
jne 0x100d8c58
mov eax, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [edi], eax
lea ecx, [ebp - 8]
call fcn.100b61be
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100b88c0
leave
ret 0xc
push 0x10009e0c
push 1
push esi
jmp 0x100d8c46
mov esi, 0x80004005
mov eax, esi
push 0x10054954
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b7316
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.100eb60e
test al, al
jne 0x100b730d
push 0
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x100b730d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d8c8f
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x100d8c3e
jmp 0x100d8c37

Function at 0x100b7fb2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
xor esi, esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100b7fcc
test al, 0x10
jne 0x100b7fc8
inc esi
mov eax, esi
pop esi
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x100b7fc8

Function at 0x100b8181
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x101dc37c], 0xffffffff
jne 0x100b819e
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x101dc37c], eax
cmp eax, 0xffffffff
je 0x100e0471
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100e0485
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x100b819e
push 0x10031af4
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
ret

Function at 0x100b88d1
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x100b890e
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x100b8907
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x100b8913
add edx, 0x28
cmp edx, esi
jne 0x100b88f8
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100b8910
Function at 0x100e2ead
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x1002d570
lea edi, [ebp - 0x14]
push 0x104
lea eax, [ebp - 0x21c]
xor ebx, ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, ebx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x100e2f24
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x100e2f03
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x100e2f0a
mov ebx, 0x80004005
push 0x1002d580
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100e2fde
mov ax, word [ebp - 0x21c]
test ax, ax
je 0x100e2fc9
cmp word [ebp - 0x21a], 0x3a
jne 0x100e2fc9
push ebx
push 0x2000000
push 3
push ebx
push 7
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push 2
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100e2f89
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x100e2f7b
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x100e2f82
mov ebx, 0x80004005
push 0x1002d5a8
jmp 0x100e2f0f
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
test eax, eax
jne 0x100e2fce
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x100e2fab
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x100e2fb2
mov ebx, 0x80004005
push 0x1002d5cc
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100e2fce
mov ebx, 0x8007000d
test esi, esi
je 0x100e2fde
cmp esi, 0xffffffff
je 0x100e2fde
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
Function at 0x100e70c3
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
test eax, eax
jne 0x100e70fa
push 0x1002f91c
mov edx, 0x57d
mov ecx, 0x10009bfc
call fcn.100e970f
xor esi, esi
mov dword [ebp - 8], esi
test ebx, ebx
je 0x100e715a
lea eax, [ebp - 8]
mov edx, ebx
push eax
push 2
push esi
mov ecx, edi
call fcn.100afca4
cmp eax, 2
je 0x100e714d
cmp eax, 3
je 0x100e714d
test eax, eax
je 0x100e7148
jg 0x100e7127
mov esi, eax
jmp 0x100e7130
movzx esi, ax
or esi, 0x80070000
push ebx
push 0x1002f7a0
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100e71b6
mov edi, dword [ebp - 8]
jmp 0x100e715d
test eax, eax
jg 0x100e7155
mov esi, eax
jmp 0x100e71b6
movzx esi, ax
jmp 0x100e71b0
mov dword [ebp - 8], edi
push dword [ebp - 0xc]
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov edi, eax
cmp edi, 2
je 0x100e71a5
cmp edi, 3
je 0x100e71a5
cmp edi, 5
jne 0x100e7188
mov ecx, dword [ebp - 8]
call fcn.100e7dd6
mov ecx, dword [ebp - 8]
call fcn.100e7ea0
test edi, edi
je 0x100e71b6
jg 0x100e7192
mov esi, edi
jmp 0x100e719b
movzx esi, di
or esi, 0x80070000
push dword [ebp - 0xc]
push 0x1002fb1c
jmp 0x100e7136
test edi, edi
jg 0x100e71ad
mov esi, edi
jmp 0x100e71b6
movzx esi, di
or esi, 0x80070000
test ebx, ebx
je 0x100e71c9
cmp dword [ebp - 8], 0
je 0x100e71c9
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 8
Function at 0x100e73b5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push edi
mov edi, edx
test eax, eax
jne 0x100e73f8
push 0x1002f73c
mov edx, 0x2b3
mov ecx, 0x10009bfc
call fcn.100e970f
test esi, esi
jne 0x100e7410
push 0x1002f744
mov edx, 0x2b4
mov ecx, 0x10009bfc
call fcn.100e970f
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
test edi, edi
je 0x100e747b
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
cmp eax, 2
je 0x100e7468
cmp eax, 3
je 0x100e7468
test eax, eax
je 0x100e7463
jg 0x100e7442
mov esi, eax
jmp 0x100e744b
movzx esi, ax
or esi, 0x80070000
push edi
push 0x10009c20
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100e74dc
mov ebx, dword [ebp - 0xc]
jmp 0x100e747e
test eax, eax
jg 0x100e7470
mov esi, eax
jmp 0x100e74dc
movzx esi, ax
or esi, 0x80070000
jmp 0x100e74dc
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x14]
lea eax, [ebp - 8]
push dword [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 2
jne 0x100e749f
mov esi, 0x80070002
jmp 0x100e74dc
test eax, eax
je 0x100e74bc
jg 0x100e74a9
mov esi, eax
jmp 0x100e74b2
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0x10]
push 0x10009c5c
jmp 0x100e7451
cmp dword [ebp - 8], 3
je 0x100e74dc
push 0x1002f750
push 1
mov esi, 0x8007000d
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
test edi, edi
je 0x100e74ef
cmp dword [ebp - 0xc], 0
je 0x100e74ef
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0x10