joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb020638
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb020751
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0xb0d9c44], 1
mov word [0xb0f590a], 0x21
push 0x4004
push 0x84000000
push 0
call fcn.0b00584c
fmul dword [0xb02075c]
call fcn.0b005888
mov word [0xb0f5908], ax
mov word [0xb0f5906], 0
mov word [0xb0f5904], 0
push 0x105
lea eax, [ebp - 0x21a]
push eax
call fcn.0b0205ec
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0xb020735
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0xb020610]
call fcn.0b00a864
add esp, 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0xb020735
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xb020760
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0xb020735
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0xb0f5908], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [0xb0f5904], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb020758
lea eax, [ebp - 4]
mov edx, dword [0xb020610]
call fcn.0b00a988
ret

Function at 0xb026190
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf4
mov ebx, edx
mov dword [esp], eax
test ebx, ebx
je 0xb026232
mov ebp, ebx
mov esi, ebp
test esi, esi
je 0xb0261b4
sub esi, 4
mov esi, dword [esi]
push 0
push 0
push 0
push 0
push esi
mov eax, ebx
call fcn.0b009150
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov esi, eax
test esi, esi
jle 0xb026232
cmp esi, 0x201
jge 0xb0261e2
lea edi, [esp + 8]
jmp 0xb0261ec
lea eax, [esi + 1]
call fcn.0b0054cc
mov edi, eax
test ebp, ebp
je 0xb0261f6
sub ebp, 4
mov ebp, dword [ebp]
push 0
push 0
push esi
push edi
push ebp
mov eax, ebx
call fcn.0b009150
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
push esi
push edi
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_WriteFile
lea eax, [esp + 8]
cmp edi, eax
je 0xb026232
mov eax, edi
call fcn.0b0054e8
add esp, 0x20c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb026848
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xb0d9c48], 0x8088405
inc edx
mov dword [ebx + 0xb0d9c48], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0xb03894c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0xb038b1e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0xc], 0
jne 0xb03898f
lea eax, [esi + 0xc]
mov edx, 0xc8
call fcn.0b0384a4
mov edx, dword [esi + 8]
lea eax, [ebp - 0x280]
mov ecx, 0xb038b38
call fcn.0b0093a0
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 4]
call fcn.0b00d45c
push dword [esi + 8]
push 0xb038b38
push 0xb038b48
lea eax, [ebp - 8]
mov edx, 3
call fcn.0b009428
mov edx, 1
mov eax, 6
call fcn.0b01be84
test al, al
je 0xb0389fe
push 2
push 0
push 0
lea eax, [ebp - 0x27c]
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.0b009150
push eax
call sub.kernel32.dll_FindFirstFileExW
mov edi, eax
jmp 0xb038a15
lea eax, [ebp - 0x27c]
push eax
mov eax, dword [ebp - 8]
call fcn.0b009150
push eax
call sub.kernel32.dll_FindFirstFileW
mov edi, eax
cmp edi, 0xffffffff
je 0xb038af0
test byte [ebp - 0x27c], 0x50
jne 0xb038ad5
mov dl, 1
mov eax, dword [0xb03716c]
call fcn.0b006680
mov ebx, eax
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x250]
mov ecx, 0x104
call fcn.0b0091f0
mov eax, dword [ebp - 0x284]
lea edx, [ebx + 8]
call fcn.0b00d45c
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xc], 0
jne 0xb038a71
mov eax, dword [ebp - 0x14]
call fcn.0b03894c
mov eax, dword [ebp - 0x14]
add eax, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
push ebx
mov eax, dword [ebp - 0x1c]
call fcn.0b008e44
call fcn.0b026a28
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
call fcn.0b03870c
lea eax, [ebp - 0x268]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 6]
mov dword [ebp - 0x28], eax
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_FileTimeToDosDateTime
lea eax, [ebp - 0x27c]
push eax
push edi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0xb038a1e
push edi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb038b25
lea eax, [ebp - 0x284]
mov edx, 2
call fcn.0b0084d0
lea eax, [ebp - 8]
call fcn.0b008470
lea eax, [ebp - 4]
call fcn.0b008494
ret

Function at 0xb039214
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, eax
push esp
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
mov word [esp + eax*2], 0
mov eax, dword [esi + 4]
call fcn.0b009150
mov edx, esp
call fcn.0b0161ec
test eax, eax
setne bl
test bl, bl
je 0xb03925c
lea eax, [esi + 4]
mov edx, esp
mov ecx, 0x105
call fcn.0b0091f0
mov eax, esi
mov byte [eax + 8], 1
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0xb07babc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0xb07bac4
mov eax, edx
pop esi
pop ebx
ret

Function at 0xb0ab948
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0xb0ab98b
cmp byte [ebx + 0x11], 0
jne 0xb0ab98b
cmp byte [ebx + 0x2c], 0
jne 0xb0ab98b
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0xb0ab9a2
mov ecx, dword [0xb0df490]
mov dl, 1
mov eax, dword [0xb088490]
call fcn.0b01b250
call fcn.0b007ab0
pop ebx
ret
mov ecx, dword [0xb0df490]
mov dl, 1
mov eax, dword [0xb088490]
call fcn.0b01b250
call fcn.0b007ab0
pop ebx
ret

Function at 0xb0abdd0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0xb0abe1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0b0ab894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb0abe37
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0xb0abe40
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0b0ab894
dec esi
jne 0xb0abe62
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0xb0cc96c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
xor ecx, ecx
mov edx, 0xf8
call fcn.0b005d3c
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp edx, dword [ebp + 0xc]
jne 0xb0cc9c2
cmp eax, dword [ebp + 8]
jne 0xb0cc9c2
lea edx, [ebp - 0x48]
mov ecx, 0x40
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
cmp eax, 0x40
je 0xb0cc9c7
call fcn.0b0cc8d8
cmp word [ebp - 0x48], 0x5a4d
jne 0xb0cca2f
cmp dword [ebp - 0xc], 0
je 0xb0cca2f
mov eax, dword [ebp - 0xc]
xor edx, edx
add eax, dword [ebp + 8]
adc edx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push dword [ebp - 4]
push dword [ebp - 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp edx, dword [ebp - 4]
jne 0xb0cca14
cmp eax, dword [ebp - 8]
jne 0xb0cca14
mov edx, esi
mov ecx, 0xf8
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp eax, 0xf8
je 0xb0cca19
call fcn.0b0cc8d8
cmp dword [esi], 0x4550
je 0xb0cca2f
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xb0cca40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
xor ecx, ecx
mov edx, 0x108
call fcn.0b005d3c
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp edx, dword [ebp + 0xc]
jne 0xb0cca96
cmp eax, dword [ebp + 8]
jne 0xb0cca96
lea edx, [ebp - 0x48]
mov ecx, 0x40
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
cmp eax, 0x40
je 0xb0cca9b
call fcn.0b0cc8d8
cmp word [ebp - 0x48], 0x5a4d
jne 0xb0ccb03
cmp dword [ebp - 0xc], 0
je 0xb0ccb03
mov eax, dword [ebp - 0xc]
xor edx, edx
add eax, dword [ebp + 8]
adc edx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push dword [ebp - 4]
push dword [ebp - 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
cmp edx, dword [ebp - 4]
jne 0xb0ccae8
cmp eax, dword [ebp - 8]
jne 0xb0ccae8
mov edx, esi
mov ecx, 0x108
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp eax, 0x108
je 0xb0ccaed
call fcn.0b0cc8d8
cmp dword [esi], 0x4550
je 0xb0ccb03
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1005822
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push ebx
push 0x1002120
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.010073ab
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ebx
push dword [0x100e664]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10059a4
cmp dword [ebp - 8], 2
jne 0x1005888
push ebx
push 0x10020d0
call fcn.010073ab
pop ecx
pop ecx
push 0x57
pop edi
jmp 0x10059a4
call fcn.01007d77
or eax, 0x400
push eax
call fcn.01007db1
test eax, eax
jne 0x10058b6
push ebx
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x10020bc
call fcn.010078cd
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x114]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x228]
mov dword [ebp - 0x2c], eax
lea esi, [ebx + 0x104]
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x218]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 0x2c
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
push eax
push 3
movsd dword es:[edi], dword [esi]
push 0
push 0x10020b4
push dword [ebp - 4]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
mov edi, eax
test edi, edi
jne 0x1005997
lea edi, [ebx + 4]
push edi
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x10020ac
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
jne 0x1005997
add ebx, 0x118
push ebx
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
xor ebx, ebx
push ebx
push 0x10020a4
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
jne 0x1005997
push dword [ebp + 0x10]
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push ebx
push 0x1002094
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
jne 0x1005997
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push ebx
push 0x1002088
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, ebx
je 0x10059a2
push 0x1002010
call fcn.010073ab
pop ecx
xor esi, esi
cmp dword [ebp - 4], esi
je 0x10059b2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
push dword [ebp + 8]
jne 0x10059c0
push 0x1001fc8
jmp 0x10059c5
push 0x1001f80
call fcn.010073ab
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1005fcd
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x100e0dc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
push 0x1002df0
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ecx
call fcn.010073ab
pop ecx
pop ecx
push 0x1002d78
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01004ca5
mov edi, eax
test edi, edi
jne 0x1006179
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.01005f72
mov edi, eax
test edi, edi
jne 0x1006179
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10060cc
mov eax, dword [ebx]
mov dword [ebp - 0x244], eax
mov eax, dword [ebx + 0x114]
mov dword [ebp - 0x240], eax
mov eax, dword [ebx + 0x228]
mov dword [ebp - 0x23c], eax
lea esi, [ebx + 0x104]
lea edi, [ebp - 0x238]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x218]
lea edi, [ebp - 0x228]
movsd dword es:[edi], dword [esi]
push 0x2c
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x244]
push eax
push 3
movsd dword es:[edi], dword [esi]
push 0
push 0x10020b4
push dword [ebp - 0x210]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
mov edi, eax
jmp 0x10060dd
push 0x1002d08
call fcn.010073ab
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
test edi, edi
jne 0x1006179
lea edi, [ebx + 4]
push edi
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x10020ac
push dword [ebp - 0x210]
call esi
mov edi, eax
test edi, edi
jne 0x1006179
add ebx, 0x118
push ebx
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
xor ebx, ebx
push ebx
push 0x10020a4
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jne 0x1006179
cmp dword [ebp - 0x218], ebx
je 0x100616c
push dword [ebp - 0x218]
call fcn.0100826b
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x218]
push 1
push ebx
push 0x1002094
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jne 0x1006179
push dword [ebp - 0x214]
push 0x1002ca0
jmp 0x1006184
push dword [ebp - 0x214]
push 0x1002bf8
call fcn.010073ab
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01007f55
leave
ret 0xc
Function at 0x1006dee
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push esi
push 0x1003af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x1006e1f
push 0x9c40
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1006e1f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, esi
pop esi
ret

Function at 0x1006ee4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100e0d4]
and dword [ebp - 8], 0
cmp eax, 0xffffffff
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], 0xfe
je 0x1006f14
push 0
lea ecx, [ebp - 8]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
leave
ret

Function at 0x1006f1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push str.SystemCurrentControlSetControlTimeZoneInformation
push 0x80000002
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1006f73
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push str.DisableAutoDaylightTimeSet
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006f6a
cmp dword [ebp - 4], esi
je 0x1006f6a
inc esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x10070e5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100e0dc]
push esi
mov dword [ebp - 4], eax
push edi
call fcn.01006e7e
mov edi, eax
push edi
push 0x1003b30
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.01006f7d
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x10
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
lea eax, [ebp - 0x44]
push eax
push dword [0x100e664]
call esi
inc edi
push edi
call fcn.01006ebb
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x1003b20
push dword [0x100e664]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01007f55
leave
ret 4

Function at 0x100715f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100e0dc]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], esi
call fcn.01006e7e
cmp eax, esi
je 0x10071b8
dec eax
push eax
push 0x1003b30
lea eax, [ebp - 0x44]
push 0x20
push eax
mov dword [ebp - 0x4c], 4
call fcn.01006f7d
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
push esi
lea eax, [ebp - 0x44]
push eax
push dword [0x100e664]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10071bb
mov dword [ebp - 0x48], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
pop esi
call fcn.01007f55
leave
ret
Function at 0x10071ce
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100e0dc]
push edi
mov dword [ebp - 4], eax
call fcn.01006e7e
mov edi, eax
test edi, edi
jbe 0x1007261
push ebx
push esi
lea ebx, [edi - 1]
push ebx
push 0x1003b30
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.01006f7d
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esp, 0x10
lea eax, [ebp - 0x44]
push eax
push dword [0x100e664]
call esi
cmp edi, 1
jne 0x1007236
push 0x1003b10
push dword [0x100e664]
call esi
push 0x1003b20
push dword [0x100e664]
call esi
jmp 0x100725f
push ebx
call fcn.01006ebb
call fcn.0100715f
push 4
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 4
push 0
push 0x1003b20
push dword [0x100e664]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.01007f55
leave
ret

Function at 0x1007271
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 8]
mov eax, dword [0x100e0dc]
push 0x1003b68
push 0x1003b5c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01006f7d
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10072f0
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push 0x1003b3c
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.01007f55
leave
ret 8

Function at 0x10073ab
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
cmp dword [0x100e0d4], 0xffffffff
mov eax, dword [0x100e0dc]
mov dword [ebp - 4], eax
je 0x1007411
cmp dword [ebp + 8], 0
je 0x1007411
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010054d3
push 0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0100826b
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [0x100e0d4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
call fcn.01007f55
leave
ret
Function at 0x1007472
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100e0dc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edi, edi
call fcn.01006e7e
push 0x1003cd0
mov esi, eax
call fcn.010073ab
test esi, esi
mov ebx, dword [ebp + 8]
pop ecx
jbe 0x10074fb
dec esi
push esi
push 0x1003b30
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.01006f7d
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push dword [0x100e664]
mov dword [ebp - 0x4c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10074f3
cmp dword [ebp - 0x48], ebx
jne 0x10074f3
push ebx
push 0x1003c30
mov edi, 0x3ec
call fcn.010073ab
pop ecx
pop ecx
test esi, esi
ja 0x10074a0
test edi, edi
jne 0x1007508
push ebx
push 0x1003be8
call fcn.010073ab
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01007f55
leave
ret 4

Function at 0x100751e
Capabilities:
Delete registry value
Get installed programs
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x100e0dc]
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.01006e7e
xor ebx, ebx
push 0x1003d5c
mov esi, eax
mov dword [ebp - 0x250], ebx
call fcn.010073ab
cmp esi, ebx
pop ecx
jbe 0x100764b
push edi
push 4
pop edi
dec esi
push esi
push 0x1003b30
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.01006f7d
add esp, 0x10
cmp dword [ebp - 0x250], ebx
je 0x1007628
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [0x100e664]
mov dword [ebp - 0x254], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007632
push dword [ebp - 0x25c]
lea eax, [ebp - 0x24c]
push 0x1003b68
push 0x1003b5c
push 0x104
push eax
call fcn.01006f7d
add esp, 0x14
lea eax, [ebp - 0x258]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x24c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1007632
push edi
lea eax, [ebp - 0x260]
push eax
push edi
push ebx
push 0x1003b3c
push dword [ebp - 0x258]
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x254], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1007632
mov dword [ebp - 0x250], 1
lea eax, [ebp - 0x44]
push eax
push dword [0x100e664]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, ebx
ja 0x1007559
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1003b10
push dword [0x100e664]
call esi
push 0x1003b20
push dword [0x100e664]
call esi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01007f55
leave
ret