joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f647e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, edx
mov dword [ebp - 0x10], eax
push esi
mov esi, ecx
push edi
test eax, eax
jne 0x100f64a7
push 0x10039908
mov edx, 0x1475
mov ecx, 0x10035994
call fcn.100e970f
xor eax, eax
mov dword [ebp - 4], eax
push ebx
mov ebx, eax
mov dword [ebp - 8], ebx
test esi, esi
je 0x100f6535
mov ecx, esi
call fcn.100b3e5c
test eax, eax
je 0x100f6535
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.101291ff
mov esi, eax
test esi, esi
jns 0x100f64ec
push 0x1003991c
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 4]
add esp, 0x10
jmp 0x100f6520
mov edi, dword [ebp - 4]
test edi, edi
jne 0x100f65c1
push 0x10039948
mov edx, 0x1481
mov ecx, 0x10035994
call fcn.100e970f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
test ebx, ebx
je 0x100f6520
lea eax, [ebx - 4]
push eax
call fcn.100b84f9
pop ecx
pop ebx
test edi, edi
je 0x100f652f
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret
mov edi, 0x104
lea ecx, [ebp - 4]
mov edx, edi
call fcn.100a70d5
mov esi, eax
test esi, esi
jns 0x100f6551
push 0x10039980
jmp 0x100f64d7
push edi
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
mov dword [ebp - 0xc], eax
cmp eax, 0x104
jb 0x100f657d
push 0x100399a8
mov edx, 0x1489
mov ecx, 0x10035994
call fcn.100e970f
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x100f65b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100f6598
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100f659f
mov esi, 0x80004005
push 0x100399e4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100f6520
test edi, edi
je 0x100f650b
lea ecx, [ebp - 4]
call fcn.100b15f5
mov esi, eax
test esi, esi
jns 0x100f65d9
push 0x10039a0c
jmp 0x100f64d7
mov edi, dword [ebp - 4]
lea ecx, [ebp - 8]
push 0x10034714
mov edx, edi
call fcn.100a9500
mov esi, eax
test esi, esi
jns 0x100f660e
push 0x10039a40
push 1
push esi
push 0x4000000
call fcn.100ab973
mov ebx, dword [ebp - 8]
add esp, 0x10
jmp 0x100f6512
mov ebx, dword [ebp - 8]
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100f650b
xor eax, eax
inc eax
jmp 0x100f650d
Function at 0x100f68e1
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x220], edx
push eax
push 0x2001f
mov dword [ebp - 0x21c], ecx
xor ebx, ebx
xor esi, esi
xor edi, edi
and dword [ebp - 0x214], esi
mov edx, 0x10038e88
push ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x218], edi
call fcn.100afca4
cmp eax, 2
jne 0x100f693e
inc ebx
jmp 0x100f6a9a
test eax, eax
je 0x100f696b
jg 0x100f6948
mov esi, eax
jmp 0x100f6951
movzx esi, ax
or esi, 0x80070000
push 0x10038fc0
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100f6a9a
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, dword [ebp - 0x21c]
add esp, 0xc
test eax, eax
je 0x100f699b
mov ecx, eax
call fcn.101410db
cmp eax, 1
je 0x100f6a9a
lea eax, [ebp - 0x218]
xor edx, edx
push eax
push ecx
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call fcn.100afb70
mov esi, eax
cmp esi, 0x80070103
je 0x100f6a65
test esi, esi
js 0x100f6a4e
mov edi, dword [ebp - 0x218]
xor ecx, ecx
push 0
mov edx, edi
call fcn.1011e745
test eax, eax
jns 0x100f69f8
push edi
push 0x10038fe8
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
lea eax, [ebp - 0x210]
xor edx, edx
push eax
push ecx
mov ecx, dword [ebp - 0x214]
call fcn.100e70c3
mov esi, eax
test esi, esi
jns 0x100f6a2f
lea eax, [ebp - 0x210]
push eax
push 0x10039018
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
test edi, edi
je 0x100f696b
lea eax, [edi - 4]
push eax
call fcn.100b84f9
xor edi, edi
pop ecx
mov dword [ebp - 0x218], edi
jmp 0x100f696b
push 0x10038f38
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100f6a94
push 0x10038e88
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
test eax, eax
je 0x100f6a91
jg 0x100f6a81
mov esi, eax
jmp 0x100f6a8a
movzx esi, ax
or esi, 0x80070000
push 0x10039038
jmp 0x100f6a53
xor ebx, ebx
inc ebx
mov edi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x220]
mov dword [eax], ebx
test edi, edi
je 0x100f6ab0
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
cmp dword [ebp - 0x214], 0
je 0x100f6ac5
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
Function at 0x100f76d9
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
mov ebx, edx
mov dword [ebp - 8], ecx
xor esi, esi
mov dword [ebp - 4], ebx
push 0x101dd068
lea ecx, [ebp - 0x14]
mov edi, esi
call fcn.100ad791
mov ecx, ebx
call fcn.100b7fb2
test eax, eax
je 0x100f7775
jmp 0x100f770f
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x100f772d
cmp edi, 3
jae 0x100f773a
push 0x3e8
inc edi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
cmp edi, 3
jae 0x100f7736
test ebx, ebx
je 0x100f770c
test ebx, ebx
jne 0x100f7772
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100f7751
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100f7758
mov esi, 0x80004005
push dword [ebp - 4]
push 0x1003aae0
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100f77b3
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edi, esi
call fcn.100b7fb2
test eax, eax
je 0x100f77b3
mov esi, dword [ebp - 8]
push ebx
push esi
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
mov ebx, eax
test ebx, ebx
jne 0x100f77a5
cmp edi, 3
jae 0x100f77b1
push 0x3e8
inc edi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
cmp edi, 3
jae 0x100f77b1
test ebx, ebx
mov ebx, dword [ebp - 4]
je 0x100f7786
xor esi, esi
lea ecx, [ebp - 0x14]
call fcn.100aa570
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100fba63
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
inc ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0x101dd068
mov edi, edx
call fcn.100ad791
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.10129ce2
mov esi, eax
test esi, esi
jns 0x100fbabf
push 0x1003ab14
push ebx
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100fbb87
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push 0x1003b1a4
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x100fbae0
push 0x1003ab50
jmp 0x100fbaab
mov ecx, dword [ebp - 8]
call fcn.100b7fb2
test eax, eax
jne 0x100fbaf5
push 0x1003b1c4
push eax
push eax
jmp 0x100fbaad
mov ecx, dword [ebp - 8]
xor dl, dl
push edi
push 0
call fcn.10172cfc
mov esi, eax
test esi, esi
jns 0x100fbb87
push dword [ebp - 0x10]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push 0x1003b1e8
push eax
call fcn.100a6b40
add esp, 0xc
test eax, eax
jns 0x100fbb32
push 0x1003ab50
push ebx
push eax
push 0x4000000
jmp 0x100fbb77
push 3
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
mov edi, 0x4000000
test eax, eax
jne 0x100fbb6f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100fbb5d
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x100fbb6f
push 0x1003b218
push ebx
push eax
push edi
call fcn.100ab973
add esp, 0x10
push 0x1003b238
push ebx
push esi
push edi
call fcn.100ab973
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.100b61be
lea ecx, [ebp - 0x1c]
call fcn.100aa570
lea ecx, [ebp - 8]
call fcn.100b61be
lea ecx, [ebp - 0x10]
call fcn.100b61be
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
Function at 0x100fce35
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
test esi, esi
jne 0x100fce72
push 0x10020554
mov edx, 0x1a14
mov ecx, 0x10035994
call fcn.100e970f
test edi, edi
jne 0x100fce8a
push 0x1003ab04
mov edx, 0x1a15
mov ecx, 0x10035994
call fcn.100e970f
cmp dword [ebp + 0xc], 0
jne 0x100fcea4
push 0x1003ab0c
mov edx, 0x1a16
mov ecx, 0x10035994
call fcn.100e970f
test ebx, ebx
jne 0x100fcebc
push 0x1003ac94
mov edx, 0x1a17
mov ecx, 0x10035994
call fcn.100e970f
xor ebx, ebx
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x14], ebx
xor edi, edi
and dword [ebp - 8], ebx
push 1
push 0x101dd068
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
call fcn.100ad791
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.10129ce2
mov esi, eax
test esi, esi
jns 0x100fcf06
push 0x1003ab14
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100fcff1
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x30]
lea eax, [ebp - 0xc]
push dword [ebp - 0x14]
push 0x1003aca0
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x100fcf46
push 0x1003ab50
push 1
push esi
push 0x4000000
call fcn.100ab973
mov ebx, dword [ebp - 0xc]
add esp, 0x10
jmp 0x100fcff1
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
sub esp, 0x14
mov ecx, ebx
call fcn.100eb467
mov esi, eax
test esi, esi
jns 0x100fcf77
push 0x1003abc8
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 0x10]
add esp, 0x10
jmp 0x100fcff1
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 8]
xor esi, esi
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x100fcfba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100fcfa9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100fcfb0
mov esi, 0x80004005
push 0x1003abe8
jmp 0x100fcef1
test edi, edi
je 0x100fcfcc
cmp edi, 0xffffffff
je 0x100fcfcc
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor edi, edi
push 0
xor edx, edx
mov ecx, ebx
call fcn.100ebf39
test eax, eax
jns 0x100fcff1
push ebx
push 0x100384c8
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100fd002
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
test ebx, ebx
je 0x100fd010
lea eax, [ebx - 4]
push eax
call fcn.100b84f9
pop ecx
test edi, edi
je 0x100fd020
cmp edi, 0xffffffff
je 0x100fd020
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.100aa570
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 8
Function at 0x100ff071
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
and dword [ebp - 0x214], 0
mov edx, 0x10038e88
push esi
push eax
push 0x2001f
mov dword [ebp - 0x218], ecx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push 0
call fcn.100afca4
mov esi, eax
test esi, esi
jle 0x100ff0c9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100ff1b7
push ebx
push edi
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
mov edx, ebx
push eax
push ecx
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.100afb70
mov edi, dword [ebp - 0x214]
mov esi, eax
cmp esi, 0x80070103
je 0x100ff1a5
test esi, esi
js 0x100ff18e
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push dword [ebp - 0x218]
push 1
push 0x7f
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
cmp eax, 2
je 0x100ff14f
test edi, edi
je 0x100ff14c
lea eax, [edi - 4]
push eax
call fcn.100b84f9
and dword [ebp - 0x214], 0
pop ecx
inc ebx
jmp 0x100ff0d3
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
je 0x100ff1a7
jle 0x100ff170
movzx eax, ax
or eax, 0x80070000
lea ecx, [ebp - 0x20c]
push ecx
push 0x10038f68
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ff1a7
push 0x10038f38
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100ff1a7
xor esi, esi
test edi, edi
je 0x100ff1b5
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
pop edi
pop ebx
cmp dword [ebp - 0x210], 0
je 0x100ff1cc
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100b88c0
leave
ret
Function at 0x10102162
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov dword [ebp - 0xc], ecx
mov ebx, 0x10035994
test esi, esi
jne 0x1010218b
push 0x100391e0
mov edx, 0x11d0
mov ecx, ebx
call fcn.100e970f
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x101021a4
push 0x10037c7c
mov edx, 0x11d1
mov ecx, ebx
call fcn.100e970f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
and dword [ebp - 8], 0
push edi
push esi
push 0x100391f8
push eax
call fcn.100a6b40
mov ebx, dword [ebp - 4]
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x101021e3
push edi
push 0x1003920c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x10102282
push 0x10039064
mov edx, edi
lea ecx, [ebp - 8]
call fcn.100a9500
mov edi, dword [ebp - 8]
mov esi, eax
test esi, esi
jns 0x10102212
push 0x10039070
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x10102274
mov esi, dword [ebp - 0xc]
test esi, esi
setne cl
call fcn.1011e927
test al, al
je 0x1010224c
push 0
mov edx, edi
mov ecx, esi
call fcn.1011e745
mov esi, eax
test esi, esi
jns 0x10102261
push edi
push 0x10038fe8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x10102274
mov ecx, edi
call fcn.100f5c29
mov esi, eax
test esi, esi
jns 0x10102261
push edi
push 0x10039244
jmp 0x1010223a
push 0x80
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test edi, edi
je 0x10102282
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
pop edi
test ebx, ebx
je 0x10102291
lea eax, [ebx - 4]
push eax
call fcn.100b84f9
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x10102846
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, edx
push ebx
mov dword [ebp - 8], ecx
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0xc], ebx
push esi
mov dword [ebp - 0x18], ecx
xor esi, esi
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
push edi
push ecx
mov dword [ebp - 0x10], eax
call fcn.10102951
mov edi, dword [ebp - 0xc]
test edi, edi
jne 0x1010289d
mov edx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.10102951
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x101028cc
inc ebx
mov eax, dword [ebp - 0x14]
mov dword [eax], edi
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
test edi, edi
je 0x101028b9
cmp edi, 0xffffffff
je 0x101028b9
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
and dword [ebp - 8], ebx
push eax
sub esp, 0x14
call fcn.100eb467
mov esi, eax
test esi, esi
jns 0x101028fe
push 0x1003abc8
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 0xc]
add esp, 0x10
jmp 0x101028a9
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push 0
push eax
push 0x35
push 0x1003acc4
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x1010289d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10102930
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10102937
mov esi, 0x80004005
push 0x1003acfc
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x101028a9
Function at 0x10102951
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x30], eax
lea edi, [ebp - 0x24]
push 8
xor eax, eax
mov dword [ebp - 0x34], edx
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
xor esi, esi
mov ecx, edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov ebx, esi
mov dword [eax], esi
call fcn.100b7fb2
test eax, eax
je 0x10102a8a
push esi
push 0x2000080
push 3
push esi
push esi
push 0xc0000000
push dword [ebp - 0x34]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10102a04
cmp ebx, 3
jae 0x101029cc
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
inc ebx
cmp ebx, 3
jb 0x10102997
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x101029e3
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x101029ea
mov esi, 0x80004005
push 0x1003abc8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x10102a8a
push 2
push esi
push 0xfffffffffffffff5
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
xor ebx, ebx
inc ebx
cmp eax, 0xffffffff
jne 0x10102a1b
mov dword [ebp - 0x2c], ebx
push esi
lea eax, [ebp - 0x28]
push eax
push 0xb
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
mov edx, ebx
test eax, eax
je 0x10102a36
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov ecx, esi
movzx eax, byte [eax + ecx]
mov ebx, 0x1003acb8
push 1
cmp al, byte [ebx + ecx]
pop ebx
jne 0x10102a59
inc ecx
lea eax, [ebp - 0x24]
cmp ecx, 0xc
jne 0x10102a3b
mov eax, esi
jmp 0x10102a5d
sbb eax, eax
or eax, ebx
test eax, eax
je 0x10102a63
mov edx, ebx
test edx, edx
jne 0x10102a7a
push 2
push esi
push 0xfffffffffffffff5
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov eax, dword [ebp - 0x30]
mov dword [eax], edi
mov edi, esi
test edi, edi
je 0x10102a8a
cmp edi, 0xffffffff
je 0x10102a8a
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 4
Function at 0x10104b97
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x24]
push eax
push 0x20019
push esi
xor ebx, ebx
mov dword [ebp - 0x24], esi
push 0x1002c8d4
inc ebx
mov dword [ebp - 8], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10104c33
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 3
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0x10
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x1003da60
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x10104c27
cmp dword [ebp - 8], 3
jne 0x10104c27
cmp dword [ebp - 0xc], 0x10
jne 0x10104c27
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x14]
jne 0x10104c33
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x24], 0
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10104c49
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
Function at 0x10104c58
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], esi
push eax
mov ebx, 0x20019
mov dword [ebp - 0x28], esi
push ebx
push esi
push 0x1003da78
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10104d16
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push 0x1003daf0
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10104d16
push 8
pop ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0xb
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x1003da60
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x10104d06
cmp dword [ebp - 8], 0xb
jne 0x10104d06
cmp dword [ebp - 0xc], ebx
jne 0x10104d06
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
jne 0x10104d0d
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x24], 0
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10104d2c
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x28], 0
je 0x10104d3b
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret