joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4611f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x461248
test esi, esi
je 0x461248
mov edx, eax
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x54]
jmp 0x461225
test esi, esi
je 0x461240
movzx eax, byte [edi + edx]
add ecx, 1
add edx, 1
xor al, byte [ecx - 1]
add ebp, 1
sub esi, 1
and edx, 0xf
mov byte [ebp - 1], al
jne 0x461221
mov dword [esp + 0x1c], edx
mov dword [esp + 0x40], ecx
mov eax, dword [ebx + 0xc]
cmp esi, 0xf
bswap eax
jbe 0x4612b4
mov edi, esi
shr edi, 4
mov edx, edi
add edx, eax
jae 0x4612d0
neg eax
mov edi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [esp + 0x5c]
mov edx, 1
mov eax, 0xc
mov dword [ebx + 0xc], 0
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x461291
shl edi, 4
sub esi, edi
add ebp, edi
add dword [esp + 0x40], edi
cmp esi, 0xf
ja 0x461252
test esi, esi
jne 0x461316
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov dword [eax], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], edx
mov dword [esp + 8], edi
shl edi, 4
mov dword [esp + 4], ebp
sub esi, edi
add ebp, edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp], eax
call dword [esp + 0x5c]
mov edx, dword [esp + 0x18]
add dword [esp + 0x40], edi
cmp esi, 0xf
mov eax, edx
bswap eax
mov dword [ebx + 0xc], eax
mov eax, edx
ja 0x461252
jmp 0x4612b4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x54]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
add eax, 1
mov edx, eax
test eax, eax
bswap edx
mov dword [ebx + 0xc], edx
jne 0x461388
mov edx, 1
mov al, 0xc
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x461375
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ebx, dword [esp + 0x54]
mov edx, dword [esp + 0x40]
lea ecx, [ebp + edi]
add ebx, edi
add edi, edx
nop
movzx edx, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jne 0x4613a0
add dword [esp + 0x1c], eax
jmp 0x4612b8
Function at 0x49d690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
lea esi, [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x49d6ef
xor eax, eax
lea esi, [esi]
add ebx, 1
movzx ebx, bl
lea edi, [esi + ebx*4]
mov edx, dword [edi]
add ecx, edx
movzx ecx, cl
lea ebp, [esi + ecx*4]
mov dword [esp], ebp
mov ebp, dword [ebp]
mov dword [edi], ebp
mov edi, dword [esp]
mov dword [edi], edx
mov edi, dword [esp + 0x20]
add edx, ebp
movzx edx, dl
mov edx, dword [esi + edx*4]
xor dl, byte [edi + eax]
mov edi, dword [esp + 0x24]
mov byte [edi + eax], dl
add eax, 1
cmp eax, dword [esp + 0x1c]
jne 0x49d6b0
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov dword [eax + 4], ecx
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4abf60
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
lea esi, [edi + 0x7e]
mov dword [esp + 0x18], eax
mov edi, 5
mov dword [esp + 0x10], 3
mov ecx, ebx
mov eax, edx
shr ebx, 0x10
shr edx, 0x10
mov word [esp], ax
movzx eax, word [esp]
rol dx, 0xb
sub esi, 8
rol word [esp], 0xd
mov ebp, eax
not ebp
and ebp, ecx
sub edx, ebp
mov ebp, eax
movzx eax, word [esi + 6]
and ebp, ebx
sub edx, ebp
mov ebp, ebx
sub dx, word [esi + 8]
not ebp
and ebp, edx
sub word [esp], bp
mov ebp, ebx
and ebp, ecx
sub word [esp], bp
mov ebp, ecx
sub word [esp], ax
not ebp
movzx eax, word [esp]
rol bx, 0xe
and ebp, eax
sub ebx, ebp
mov ebp, edx
and ebp, ecx
sub ebx, ebp
mov ebp, edx
sub bx, word [esi + 4]
not ebp
rol cx, 0xf
and ebp, ebx
sub ecx, ebp
mov ebp, eax
and ebp, edx
sub ecx, ebp
sub cx, word [esi + 2]
sub edi, 1
jne 0x4abf94
sub dword [esp + 0x10], 1
je 0x4ac050
xor eax, eax
mov ebp, dword [esp]
cmp dword [esp + 0x10], 2
sete al
and ebp, 0x3f
mov edi, eax
mov eax, dword [esp + 0x14]
add edi, 5
sub dx, word [eax + ebp*2]
mov ebp, ebx
and ebp, 0x3f
movzx ebp, word [eax + ebp*2]
sub word [esp], bp
mov ebp, ecx
and ebp, 0x3f
sub bx, word [eax + ebp*2]
mov ebp, edx
and ebp, 0x3f
sub cx, word [eax + ebp*2]
jmp 0x4abf94
movzx eax, word [esp]
shl ebx, 0x10
movzx ecx, cx
mov edi, dword [esp + 0x18]
shl edx, 0x10
or ebx, ecx
or edx, eax
mov dword [edi], ebx
mov dword [edi + 4], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
or dword [eax - 0x1a], 0x56
mov edx, dword [esi + 0xc]
push esi
lea eax, [ebp - 0x78]
sub edi, dword [eax + 0x50]
push esi
call 0xa186e0
mov ecx, dword [ebp + 8]
mov edx, dword [0x96c05a]
push eax
push ecx
add edx, 0xffffffa4
movsb byte es:[edi], byte [esi]
adc dword [esp + edx*8 - 0xadffc0], ebp
adc eax, 0x400980
mov eax, dword [0x4102ac]
in eax, 0xc4
dec ecx
test eax, eax
je 0x401e8c
push eax
push 0x25d2af
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
adc al, 0x90
nop
nop
mov byte [ebp + 0x5581e590], bl
lodsb al, byte [esi]
sbb al, byte [ebx + 0x565314ec]
movsb byte es:[edi], byte [esi]
jne 0x401e64
push edi
test byte [esi + 0x5a], 0x89
inc ebp
or al, ch
dec ecx
dec ebx
inc edx
add byte [ebx + 0x410b83], ah
mov dword [0x410ba4], edx
insd dword es:[edi], dx
xlatb
mov edi, dword [ecx - 0x743f7aec]
cli
jne 0x401f0d
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
call fcn.00407e70
mov dword [edi + 0x38], esp
or byte [eax], al
add byte [ecx + 0x83c78], cl
add bh, al
inc esi
out dx, eax
add byte [eax], al
add byte [eax], al
mov ecx, dword [esp + ebp*8]
pop ss
inc ecx
add byte [ecx + 0x60a11456], cl
add cl, byte [0x74c01c00]
cmp esp, dword [ecx + 0x70415970]
mov esp, ecx
add ecx, eax
mov dword [esi - 0x6b], ecx
jmp 0x401f3a
mov ecx, dword [esi - 0x45fff7c8]
mov eax, dword [0x40d028]
mov edx, dword [0x40d02c]
add esp, edx
invalid
mov edx, dword [esi + 0x18]
mov ebx, dword [0xd944e7]
mov eax, dword [esi - 0x7d]
lea ecx, [ebp + 0x65]
mov ah, 0xd0
pop eax
push edx
push eax
call 0x4118f5
ret 0x7477
Function at 0x102ae10
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102ae2e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x102ae70
cmp dword [ebp + 8], 0
jne 0x102ae38
xor eax, eax
jmp 0x102ae70
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
neg eax
sbb eax, eax
and eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8

Function at 0x102afa8
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102afc3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x102b000
xor eax, eax
cmp dword [ebp + 8], eax
je 0x102aff9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4

Function at 0x102b341
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102b35c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x102b39d
cmp dword [ebp + 8], 0
jne 0x102b367
or eax, 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]

Function at 0x102b3ab
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102b3ce
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
jmp 0x102b416
cmp dword [ebp + 8], 0
jne 0x102b3d8
xor eax, eax
jmp 0x102b416
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
push dword [ebp + 0x14]
neg eax
push dword [ebp + 0x10]
sbb eax, eax
push dword [ebp + 0xc]
and eax, edi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x102b6e5
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102b715
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x102b89b
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x102b727
and dword [ebp - 8], 0
jmp 0x102b755
push dword [ebp + 8]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 8]
push ebx
call fcn.010292f1
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x102b761
and dword [ebp - 4], 0
jmp 0x102b78f
push dword [ebp + 0xc]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.010292f1
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x102b7c3
push dword [ebp + 0x10]
call esi
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x10]
push edi
call fcn.010292f1
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
cmp dword [ebp + 0x1c], 0
jne 0x102b7cd
xor esi, esi
jmp 0x102b7fa
push dword [ebp + 0x1c]
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x1c]
push edi
call fcn.010292f1
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [ebp + 0x18]
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov eax, esp
push esi
lea esi, [edi + edi]
push esi
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp + 0x10], eax
push dword [ebp - 8]
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0x1c], eax
push dword [ebp + 0x14]
call fcn.01029317
test eax, eax
jne 0x102b898
mov eax, edi
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x10]
push ebx
call fcn.01029317
test eax, eax
je 0x102b898
xor eax, eax
cmp dword [ebp + 8], eax
je 0x102b87e
cmp dword [ebp + 0xc], eax
je 0x102b87e
push edi
push ebx
push dword [ebp + 0x14]
mov word [esi + ebx - 2], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [edi - 1]
jmp 0x102b89b
push edi
push ebx
push dword [ebp + 0x14]
mov word [esi + ebx - 2], ax
mov word [ebx + edi*2 - 4], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [edi - 2]
jmp 0x102b89b
mov eax, dword [ebp + 0x1c]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x102bdb2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102bde8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x102bf03
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
je 0x102befe
mov esi, dword [ebp + 0x14]
cmp esi, ecx
je 0x102befe
mov ebx, dword [ebp + 0x24]
cmp ebx, ecx
jne 0x102be0e
cmp dword [ebp + 0x20], ecx
jne 0x102befe
cmp dword [ebp + 0x1c], ecx
mov dword [ebp - 8], ecx
jne 0x102be1c
lea eax, [ebp - 8]
mov dword [ebp + 0x1c], eax
cmp ebx, ecx
mov eax, dword [esi]
mov dword [ebp - 4], eax
je 0x102be27
mov ecx, dword [ebx]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp + 0x24], ecx
call fcn.0106afe0
mov edi, esp
push ebx
push dword [ebp + 0x20]
lea eax, [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x102bef9
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
inc eax
cmp ecx, eax
jae 0x102be69
mov eax, ecx
push 0xffffffffffffffff
push eax
push edi
push dword [ebp + 0x10]
call fcn.01029317
dec eax
cmp dword [ebp + 0x20], 0
mov dword [esi], eax
je 0x102bee0
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
test eax, eax
jbe 0x102bef9
cmp eax, 2
jbe 0x102be9a
cmp eax, 7
jne 0x102bef9
mov dword [ebp + 0x14], 0x80004005
jmp 0x102bef9
mov esi, dword [ebx]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edx, esp
mov ecx, esi
mov esi, dword [ebp + 0x20]
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx]
shr eax, 1
push eax
push edx
push dword [ebp + 0x20]
call fcn.01029317
shl eax, 1
mov dword [ebx], eax
jne 0x102bef9
mov dword [ebp + 0x14], 0xea
jmp 0x102bef9
test ebx, ebx
je 0x102bef9
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
test eax, eax
jbe 0x102bef9
cmp eax, 2
jbe 0x102bef7
cmp eax, 7
jne 0x102bef9
shl dword [ebx], 1
mov eax, dword [ebp + 0x14]
jmp 0x102bf03
mov eax, 0x80004003
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x102bf90
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.0102ad60
test al, al
je 0x102bfa5
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp + 0xc], 0
je 0x102bfc5
cmp dword [ebp + 0x10], 0
je 0x102bfc0
push 4
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x102bfc5
push 0x57
pop eax
jmp 0x102bff6
push esi
push dword [ebp + 0x34]
mov esi, dword [ebp + 0x2c]
push dword [ebp + 0x30]
push esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test esi, esi
je 0x102bff5
shl dword [esi], 1
pop esi
pop ebp
ret 0x30

Function at 0x102bfff
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102c02d
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x102c121
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x102c067
push dword [ebp + 0xc]
call edi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push ebx
call fcn.010292f1
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x102c0d9
cmp eax, 2
je 0x102c0d9
cmp eax, 7
jne 0x102c0d0
mov ebx, dword [ebp + 0x18]
xor eax, eax
test ebx, ebx
jne 0x102c086
xor ecx, ecx
jmp 0x102c0ca
push ebx
call fcn.01029380
cmp eax, 0xffffffff
push ebx
jne 0x102c097
call edi
inc eax
jmp 0x102c09c
call fcn.01029380
lea edi, [eax + eax]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov dword [ebp + 0x18], esp
push ebx
call fcn.01029380
push eax
push edi
push ebx
push dword [ebp + 0x18]
call fcn.010292f1
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp + 0x18]
push eax
push ecx
push 7
jmp 0x102c114
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
jmp 0x102c114
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 0x18], ecx
je 0x102c10f
push dword [ebp + 0x18]
call edi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x18]
push ebx
call fcn.010292f1
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, ebx
push eax
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x102c130
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102c160
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x102c2ae
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x102c16b
xor esi, esi
jmp 0x102c19c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.010292f1
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x102c2ae
cmp dword [ebp + 0x18], ebx
mov ecx, dword [ebp - 4]
jne 0x102c1fa
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x102c1e8
cmp ecx, ebx
jbe 0x102c1e3
cmp ecx, 2
jbe 0x102c1dc
cmp ecx, 7
jne 0x102c1e3
mov edx, dword [ebp - 8]
add edx, edx
jmp 0x102c1e6
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x102c2ab
mov dword [eax], ecx
jmp 0x102c2ab
cmp ecx, ebx
jbe 0x102c20f
cmp ecx, 2
jbe 0x102c208
cmp ecx, 7
jne 0x102c20f
mov eax, dword [ebp - 8]
add eax, eax
jmp 0x102c212
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x1c]
cmp dword [ebx], eax
jae 0x102c22d
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x102c224
mov dword [eax], ecx
mov dword [ebp + 0xc], 0xea
jmp 0x102c2ab
test ecx, ecx
jbe 0x102c298
cmp ecx, 2
jbe 0x102c23b
cmp ecx, 7
jne 0x102c298
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov dword [ebp + 0x1c], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x102c2ab
cmp dword [ebp - 4], eax
jbe 0x102c2ab
cmp dword [ebp - 4], 2
jbe 0x102c275
cmp dword [ebp - 4], 7
jne 0x102c2ab
push dword [ebp - 8]
push dword [ebx]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.01029317
shl eax, 1
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x102c2ab
mov ecx, dword [ebp - 4]
jmp 0x102c1f3
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x102c2bd
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102c2db
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x102c31e
cmp dword [ebp + 8], 0
jne 0x102c2e5
xor eax, eax
jmp 0x102c31e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
push dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8

Function at 0x102c508
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102c529
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x102c59e
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x102c544
cmp dword [ebp + 0xc], esi
je 0x102c544
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x102c59e
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x102c59b
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov ebx, esp
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x102c59b
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 0xc]
jbe 0x102c583
mov dword [ebp - 4], eax
jmp 0x102c59b
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.01029317
cmp eax, esi
mov dword [ebp - 4], eax
je 0x102c59b
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x102cb4b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102ad60
test al, al
je 0x102cb66
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x102cba3
xor eax, eax
cmp dword [ebp + 8], eax
je 0x102cb9c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0106afe0
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.010292f1
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4