joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b12c
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
inc ebx
xor esi, esi
mov dword [edi], ebx
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push esi
push 0x100af48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.0100b113
cmp eax, esi
mov dword [ebp - 0x14], eax
jl 0x100b1cc
push 4
pop edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100b064
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
call fcn.0100b113
cmp eax, esi
mov dword [ebp - 0x14], eax
jl 0x100b1c2
cmp dword [ebp - 8], ebx
jne 0x10124f7
jmp 0x10124ed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [eax], ebx
jmp 0x100b1af
mov eax, dword [ebp + 0xc]
mov dword [edi], esi
mov dword [eax], ebx
jmp 0x100b1b8
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x100b1af
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov edi, 0x1012644
push edi
push esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100b1af
cmp dword [ebp - 8], ebx
jne 0x100b1af
push edi
push 0x100af48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10188f8
push dword [ebp - 4]
mov dword [ebp + 0xc], esi
call edi
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
jne 0x1012585
push esi
push dword [ebp + 0xc]
push 0x10188d4
push dword [ebp - 4]
call ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], esi
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x101260c
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100b1af
push esi
push dword [ebp + 0xc]
push 0x10125c0
push dword [ebp - 4]
call ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100b1af
Function at 0x100b695
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x100af48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.0100b113
mov esi, eax
test esi, esi
jl 0x100b722
lea eax, [ebp - 8]
push eax
push 0x100b064
push dword [ebp - 4]
call fcn.0100b331
mov esi, eax
test esi, esi
jl 0x100b719
cmp dword [ebp - 8], 1
jne 0x100b719
push 0x100b728
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
call fcn.0100b113
mov esi, eax
test esi, esi
jge 0x100b709
cmp esi, 0x80070002
jne 0x100b705
xor esi, esi
test esi, esi
jl 0x100b719
cmp dword [0x104d00c], 0x7d6
jl 0x1013768
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
call fcn.0102823c
mov esi, eax
jmp 0x100b719

Function at 0x100c67a
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x83c
mov eax, 0x10433c5
call fcn.01001615
mov ebx, dword [ebp + 8]
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x828], ebx
je 0x100c755
cmp word [ebx], ax
je 0x100c755
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
push eax
mov esi, 0x100c764
push esi
call edi
mov ecx, ebx
lea edx, [ecx + 2]
mov bx, word [ecx]
inc ecx
inc ecx
test bx, bx
jne 0x100c6ba
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + eax + 0x104]
lea ecx, [ebp - 0x824]
call fcn.0100b09f
and dword [ebp - 4], 0
push ebx
push ebx
lea ecx, [ebp - 0x824]
call fcn.0100b75c
push eax
push esi
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x824]
call fcn.0100c773
mov eax, dword [ebp - 0x824]
push 0xffffffffffffffff
push dword [ebp - 0x818]
lea ecx, [ebp - 0x824]
push 0x100c760
call dword [eax + 0x10]
mov eax, dword [ebp - 0x824]
push 0xffffffffffffffff
push dword [ebp - 0x818]
lea ecx, [ebp - 0x824]
push dword [ebp - 0x828]
call dword [eax + 0x10]
push dword [ebp - 0x820]
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x1014a23
lea ecx, [ebp - 0x824]
call fcn.0100adde
xor eax, eax
call fcn.01001652
ret 4
push 0x8000ffff
lea ecx, [ebp - 0x848]
call fcn.0101e159
mov esi, eax
lea edi, [ebp - 0x838]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1048284
lea eax, [ebp - 0x838]
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll__CxxThrowException
Function at 0x100d3f8
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x1042c21
call fcn.01001f29
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x1013f00
cmp dword [ebp + 8], esi
je 0x1013f0a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1013f40
mov eax, dword [ebp - 0x18]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or eax, ecx
push eax
call dword [0x1050b64]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x100d4c1
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, esi
pop ecx
mov dword [edi], eax
je 0x100d4ba
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1013f29
xor ebx, ebx
push dword [ebp - 0x14]
call dword [0x1050b60]
mov eax, ebx
call fcn.01001740
ret 8
mov ebx, 0x8007000e
jmp 0x100d4a7
mov ebx, 0x8007000e
jmp 0x100d4b0
mov eax, 0x80004003
jmp 0x100d4b2
mov eax, 0x80070057
jmp 0x100d4b2
call fcn.0100f5ae
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x100d4a7
push eax
call fcn.0100b113
mov ebx, eax
jmp 0x100d4b0

Function at 0x100d580
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x104d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
je 0x1017edf
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x100d61e
dec ecx
jne 0x100d612
cmp edx, 5
je 0x1017ef7
cmp edx, 4
jbe 0x1017f32
cmp edx, 6
jne 0x100d60f
cmp dword [ebp - 0x118], 0
jne 0x100d60f
cmp dword [ebp - 0x114], 0x1554
jb 0x1017f61
push 0x20
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001666
leave
ret
cmp edx, 4
je 0x1017f3a
jmp 0x100d612
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
jmp 0x100d5ca
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x1017f2b
dec ecx
je 0x1017f20
dec ecx
je 0x1017f0e
push 0x14
jmp 0x100d611
cmp word [ebp - 0xc], 1
jb 0x1017f18
push 0x10
pop eax
or eax, 4
jmp 0x100d612
cmp word [ebp - 0xc], 2
jb 0x1017f18
push 8
jmp 0x1017f17
push 4
jmp 0x100d611
push 2
pop eax
jmp 0x100d61e
cmp dword [ebp - 0x118], 0
je 0x1017f59
cmp dword [ebp - 0x118], 0xa
je 0x1017f59
cmp dword [ebp - 0x118], 0x5a
jne 0x100d612
xor eax, eax
inc eax
jmp 0x100d612
push 0x40
jmp 0x100d611
Function at 0x100dde9
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100dddd
push 0
jmp 0x100df03
xor eax, eax
jmp 0x100df0b
push 0x260
mov eax, 0x1043691
call fcn.01002f53
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
push 0
mov edi, ecx
mov dword [ebp - 0x228], eax
call esi
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x100df13
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x220]
push ecx
push 0
lea ecx, [ebp - 0x224]
push ecx
push 0
push ebx
push eax
call esi
test eax, eax
jne 0x100ddcd
cmp dword [ebp - 0x224], 1
je 0x100de5d
cmp dword [ebp - 0x224], 7
je 0x100de5d
cmp dword [ebp - 0x224], 2
jne 0x100ddcd
and dword [ebp - 4], 0
cmp dword [ebp - 0x224], 2
jne 0x1014ca7
cmp dword [ebp - 0x220], 0x208
jae 0x1014c51
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push dword [edi + 0x9c]
call esi
mov ecx, dword [ebp - 0x228]
mov esi, 0x104
push esi
mov edi, eax
call fcn.0100b75c
push esi
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [eax - 1]
cmp ecx, 0x102
mov dword [ebp - 0x220], eax
ja 0x1014c7e
add eax, eax
mov dword [ebp - 0x220], eax
test edi, edi
jne 0x1014cdc
or dword [ebp - 4], 0xffffffff
shr dword [ebp - 0x220], 1
mov ecx, dword [ebp - 0x228]
je 0x100ddd6
mov eax, dword [ebp - 0x220]
dec eax
push eax
call fcn.0100afb0
xor eax, eax
inc eax
call fcn.01002f93
ret 8
push 6
call esi
jmp 0x100dddd
push 0x80010135
lea ecx, [ebp - 0x23c]
call fcn.0101e159
mov esi, eax
lea edi, [ebp - 0x24c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1048284
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll__CxxThrowException
push 0x80010135
lea ecx, [ebp - 0x23c]
call fcn.0101e159
mov esi, eax
lea edi, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1048284
lea eax, [ebp - 0x25c]
jmp 0x1014c78
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x228]
shr eax, 1
push eax
call fcn.0100b75c
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push dword [edi + 0x9c]
call esi
mov edi, eax
jmp 0x100dedd
jle 0x1014cea
and edi, 0xffff
or edi, 0x80070000
push edi
lea ecx, [ebp - 0x23c]
call fcn.0101e159
mov esi, eax
lea edi, [ebp - 0x26c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1048284
lea eax, [ebp - 0x26c]
jmp 0x1014c78
Function at 0x100e504
Capabilities:
Terminate process

Disassembly:
call fcn.0100d1d2
push 0x58
push 0x100e6f0
call fcn.01001674
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x104d168
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x10137e5
xor esi, esi
inc esi
mov eax, dword [0x104d044]
cmp eax, esi
je 0x1013803
mov eax, dword [0x104d044]
test eax, eax
jne 0x100e727
mov dword [0x104d044], esi
push 0x100e6e8
push 0x100e6dc
call fcn.0100e4db
pop ecx
pop ecx
test eax, eax
jne 0x10138d2
mov eax, dword [0x104d044]
cmp eax, esi
jne 0x100e5b5
push 0x100e6d8
push 0x100e600
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x104d044], 2
test ebx, ebx
jne 0x100e5c1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1050be8], 0
jne 0x1013810
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x100e718
cmp al, 0x22
je 0x1013852
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
jne 0x1013862
inc esi
jmp 0x100e5d5
test al, al
je 0x100e732
cmp dword [ebp - 0x1c], 0
je 0x100e732
jmp 0x100e5e2
mov dword [0x1050de4], esi
jmp 0x100e591
mov al, byte [esi]
test al, al
je 0x100e742
cmp al, 0x20
ja 0x100e742
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100e732
test byte [ebp - 0x3c], 1
jne 0x1013834
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call fcn.0100e767
jmp 0x101383d
cmp eax, esi
jne 0x10137f3
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100e558
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100e543
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100e591
push 0x1050be8
call fcn.0102a8ba
pop ecx
test eax, eax
je 0x100e5ce
push 0
push 2
push 0
call dword [0x1050be8]
jmp 0x100e5ce
movzx eax, word [ebp - 0x38]
jmp 0x100e74f
mov dword [0x1050de0], eax
cmp dword [0x104d01c], 0
jne 0x10138a4
push eax
call dword [sym.imp.msvcrt.dll_exit]
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x100e5ea
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100e5fd
cmp dword [0x1050de4], 0
jne 0x10138b3
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1050de0]
jmp 0x10138de
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010016b9
ret
Function at 0x100fabc
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x104d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0100fb8d
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100fb5e
cmp dword [ebp - 0x94], 5
jb 0x100fb31
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100fb78
call fcn.0100b7aa
test eax, eax
jl 0x10137bb
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01001666
leave
ret
cmp dword [ebp - 0x88], 1
je 0x10137a3
jmp 0x100fb31
cmp dword [ebp - 0x90], 0
jbe 0x100fb31
jmp 0x100fb2d
cmp dword [ebp - 0x94], 4
ja 0x100fb2d
je 0x100fb6d
jmp 0x100fb31
mov byte [0x1050d74], 1
jmp 0x100fb4f
Function at 0x1011919
Capabilities:
Get disk information

Disassembly:
push 0x1a8
mov eax, 0x1045f6d
call fcn.01001615
mov ebx, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0x14]
lea ecx, [ebp - 0x178]
call fcn.01003bb9
push dword [esi + 0x10]
xor edi, edi
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], edi
call fcn.01003bb9
push ebx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 1
call fcn.01005423
mov ebx, dword [ebp - 0x16c]
mov eax, dword [ebx - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 2
call fcn.010059ef
movzx eax, ax
cmp ax, 0x2a
je 0x10164a6
cmp ax, 0x5c
je 0x1011995
cmp ax, 0x2f
jne 0x10164ba
lea ecx, [ebp - 0x1b4]
call fcn.01005a7c
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x16c]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.010116cf
xor esi, esi
cmp eax, edi
jne 0x1011a3a
cmp dword [ebp - 0x1a0], edi
je 0x10164d5
push ebx
lea ecx, [ebp - 0x170]
call fcn.01003bb9
push esi
push dword [ebp - 0x170]
mov byte [ebp - 4], 7
push dword [ebp - 0x174]
push dword [ebp - 0x178]
call fcn.0101171f
jmp 0x10165d4
push dword [ebp - 0x170]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
lea ecx, [ebp - 0x1b4]
call fcn.0100253d
lea ecx, [ebx - 0x10]
call fcn.01002480
push dword [ebp - 0x174]
call esi
push dword [ebp - 0x178]
call esi
mov eax, dword [ebp - 0x16c]
call fcn.01001652
ret 4
cmp eax, 1
je 0x10164db
jmp 0x10119ce
mov ebx, dword [ebx - 0xc]
push 1
dec ebx
push ebx
lea ecx, [ebp - 0x16c]
call fcn.010359ae
jmp 0x10164ca
push 0x10032fc
lea ecx, [ebp - 0x16c]
call fcn.0101cbaf
mov ebx, dword [ebp - 0x16c]
jmp 0x1011995
inc esi
jmp 0x10119ce
push edi
lea ecx, [ebp - 0x168]
call fcn.01005318
push ebx
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 4
call fcn.010054ae
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x168]
call fcn.0102cae5
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x188]
lea eax, [eax + ecx*2]
push eax
lea ecx, [ebp - 0x170]
call fcn.01003615
push 3
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 5
call fcn.0100977f
push eax
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 6
call fcn.0100523a
mov ecx, dword [ebp - 0x17c]
add ecx, 0xfffffff0
call fcn.01002480
push 0xa
lea eax, [ebp - 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x170]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, edi
je 0x10165b2
mov ecx, 0x10189e0
lea eax, [ebp - 0x24]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10165a6
cmp dx, di
je 0x10165a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10165a6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x1016580
xor eax, eax
jmp 0x10165ab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x10165b2
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x170]
add ecx, 0xfffffff0
call fcn.01002480
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 3
call fcn.0100450f
jmp 0x10119ce
cmp eax, 0x80070005
mov dword [ebp - 0x16c], eax
jne 0x10119fb
mov dword [ebp - 0x16c], edi
jmp 0x10119fb
Function at 0x101c6b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x101c70d
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x101c6fe
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x101c6fa
cmp esi, eax
jae 0x101c6fe
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x101c6ec
cmp esi, eax
jb 0x101c702
xor eax, eax
jmp 0x101c70c
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x101cca4
Capabilities:
Get disk information

Disassembly:
push 0x21c
mov eax, 0x1040111
call fcn.01001615
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x220]
call fcn.01003615
xor ebx, ebx
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], ebx
call fcn.01003b90
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.0101c9ff
push 0x105
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x101cd2f
lea eax, [ebp - 0x21c]
push 0x101cd48
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov ebx, eax
neg ebx
pop ecx
sbb bl, bl
pop ecx
inc bl
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.01002480
mov al, bl
call fcn.01001652
ret 4
Function at 0x101d7b2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebx, ebx
push 0x101d900
push ebx
push ebx
mov esi, ecx
push ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], eax
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x101d7f0
push 0x101d8cc
push ebx
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x101d7f9
mov dword [ebp - 4], 0x80004005
jmp 0x101d853
push 0x20019
push 0x101d860
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.01003af9
test eax, eax
mov edi, 0x80004005
jne 0x101d82e
mov eax, dword [esi + 0x14]
push 1
push eax
push 5
push 1
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x101d831
mov dword [ebp - 4], edi
cmp dword [ebp - 4], ebx
jl 0x101d853
lea eax, [esi + 8]
push eax
push ebx
push esi
push 0x101d79a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x101d853
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x101e039
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 0x101e0e0
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call dword [0x1050b68]
test al, al
je 0x101e076
push dword [ebp + 8]
push 0x101e0d0
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call fcn.010337bb
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x100af48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.0100b113
mov esi, eax
test esi, esi
jl 0x101e0c6
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x100b064
push 0
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
call fcn.0100b113
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4
Function at 0x101f509
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x104099d
call fcn.01001615
mov edi, dword [ebp + 0x24]
lea eax, [ebp - 0x218]
push eax
xor ebx, ebx
inc ebx
push ebx
push 0
push dword [ebp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jl 0x101f5de
push 0x1011ab4
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0100e0f4
mov esi, eax
test esi, esi
jl 0x101f63c
push 0x100fe9c
lea ecx, [ebp - 0x21c]
call fcn.01003bb9
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x21c]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
mov ebx, 0x8007000e
add esi, ebx
js 0x101f5d0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0101e1ae
mov esi, dword [ebp - 0x21c]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, ebx
js 0x101f5d0
push edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0x21c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0101f34d
mov esi, eax
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x101f63c
push 0
lea ecx, [ebp - 0x220]
call fcn.0101e28a
push 0x7df
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0100f6ba
push dword [edi + 8]
mov ecx, edi
call fcn.0100b75c
push dword [ebp + 0x14]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push 0x1007550
sub edx, ecx
push edx
lea eax, [eax + ecx*2]
push eax
call fcn.0101056d
add esp, 0x10
push 0xffffffffffffffff
mov ecx, edi
call fcn.0100c773
lea ecx, [ebp - 0x220]
call fcn.0100e0c2
mov eax, esi
call fcn.01001652
ret 0x20