joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a01b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006a0140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006a0140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006a0140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006a0140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6a0bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6a0c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6b287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6a0c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6a0c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x100570e
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1005721
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100571d
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100573d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100577c
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1005772
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100577e
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1005762
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1006820
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x584
mov eax, dword [0x1039074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x584], eax
xor eax, eax
mov byte [ebp - 0x570], 0
lea edi, [ebp - 0x56f]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x179
xor edi, edi
lea eax, [ebp - 0x56c]
push edi
push eax
mov dword [ebp - 0x574], ebx
call sub.msvcrt.dll_memset
push 0x3e8
lea eax, [ebp - 0x3ee]
push edi
push eax
mov word [ebp - 0x3f0], di
call sub.msvcrt.dll_memset
push 0x1001840
push esi
call dword [sym.imp.msvcrt.dll__wfopen]
add esp, 0x20
cmp eax, edi
mov dword [ebp - 0x578], eax
jne 0x10068c1
cmp ebx, edi
je 0x10069cb
push esi
push 0x1001818
push ebx
call fcn.01028e39
add esp, 0xc
jmp 0x10069cb
mov edi, dword [sym.imp.msvcrt.dll_fread]
push eax
mov esi, 0x17d
push esi
lea eax, [ebp - 0x570]
push 1
push eax
call edi
add esp, 0x10
cmp eax, esi
jne 0x10069be
jmp 0x10068ec
mov ebx, dword [ebp - 0x574]
and dword [ebp - 0x57c], 0
test ebx, ebx
mov dword [ebp - 0x580], 0x1f4
je 0x1006916
lea eax, [ebp - 0x540]
push eax
push 0x10017e8
push ebx
call fcn.01028e39
add esp, 0xc
push 0
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x570]
push 0x175
push eax
call fcn.0101e119
add esp, 0x14
test eax, eax
jl 0x100697e
push dword [ebp - 0x580]
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
mov eax, dword [ebp - 0x584]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x100696e
mov dword [ebp - 0x57c], 1
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x57c], 0
jne 0x10069a1
cmp dword [ebp - 0x574], 0
je 0x10069a1
lea eax, [ebp - 0x540]
push eax
push 0x10017b4
push dword [ebp - 0x574]
call fcn.01028e39
add esp, 0xc
push dword [ebp - 0x578]
lea eax, [ebp - 0x570]
push esi
push 1
push eax
call edi
add esp, 0x10
cmp eax, esi
je 0x10068e6
push dword [ebp - 0x578]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.010052b2
leave
ret 0xc
Function at 0x101e279
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x101e333
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x101e333
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x101e333
cmp ebx, 0x40
jbe 0x101e2aa
push 0x40
pop ebx
push 0xb0
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
test ebx, ebx
jbe 0x101e2d4
mov cl, byte [eax + edi]
xor cl, 0x36
mov byte [esi + eax + 0x70], cl
inc eax
cmp eax, ebx
jb 0x101e2c0
cmp eax, 0x40
jae 0x101e2e9
push 0x40
pop edx
sub edx, eax
push edx
lea ecx, [eax + esi + 0x70]
push 0x36
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call fcn.01023417
push esi
lea edi, [esi + 0x70]
push 0x40
push edi
call fcn.01023476
add esp, 0x10
xor eax, eax
test ebx, ebx
jbe 0x101e31a
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
xor cl, 0x5c
mov byte [edi + eax], cl
inc eax
cmp eax, ebx
jb 0x101e304
cmp eax, 0x40
jae 0x101e32f
push 0x40
pop edx
sub edx, eax
push edx
lea ecx, [eax + esi + 0x70]
push 0x5c
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x101e338
mov eax, 0x80070057
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x102536c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebp
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebp, dword [ebp + 0xc]
movzx ebx, byte [esi + 0x100]
test ebp, ebp
movzx edx, byte [esi + 0x101]
je 0x1025480
test edi, 3
je 0x10253c4
add bl, 1
movzx ecx, byte [esi + ebx]
add dl, cl
movzx eax, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
movzx eax, byte [esi + ecx]
xor byte [edi], al
add edi, 1
sub ebp, 1
jne 0x1025394
jmp 0x1025474
sub ebp, 4
jl 0x1025443
sub edi, 4
add bl, 1
movzx ecx, byte [esi + ebx]
add dl, cl
movzx eax, byte [esi + edx]
add edi, 4
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
movzx eax, byte [esi + ecx]
add bl, 1
movzx ecx, byte [esi + ebx]
ror eax, 8
add dl, cl
mov al, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
mov al, byte [esi + ecx]
add bl, 1
movzx ecx, byte [esi + ebx]
ror eax, 8
add dl, cl
mov al, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
mov al, byte [esi + ecx]
add bl, 1
movzx ecx, byte [esi + ebx]
ror eax, 8
add dl, cl
mov al, byte [esi + edx]
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
mov al, byte [esi + ecx]
ror eax, 8
xor dword [edi], eax
sub ebp, 4
jge 0x10253cc
add edi, 4
test ebp, 3
je 0x1025474
sub edi, 1
add ebp, 4
add bl, 1
movzx ecx, byte [esi + ebx]
add dl, cl
movzx eax, byte [esi + edx]
add edi, 1
mov byte [esi + ebx], al
mov byte [esi + edx], cl
add cl, al
movzx eax, byte [esi + ecx]
xor byte [edi], al
sub ebp, 1
jne 0x1025451
mov byte [esi + 0x100], bl
mov byte [esi + 0x101], dl
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1025dd7
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x103c9bc], 0
push ebx
jne 0x1025e54
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x1025e48
cmp dword [ebp - 8], 0x660
jae 0x1025e48
xor eax, eax
mov eax, dword [eax*4 + 0x1039f34]
mov dword [0x103c9bc], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10288f4
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1039074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x118]
xor edi, edi
push eax
mov dword [esi], edi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1028954
cmp dword [ebp - 0x108], 2
jne 0x1028951
cmp dword [ebp - 0x114], 6
jb 0x1028951
push edi
push esi
push 1
push 0x1002784
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x1028954
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010052b2
leave
ret

Function at 0x1028992
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
or ebx, 0xffffffff
inc eax
cmp esi, 2
je 0x10289c1
cmp esi, eax
je 0x10289c1
cmp esi, 4
je 0x10289c1
xor eax, eax
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x1c]
push eax
call fcn.01028964
add esp, 0xc
test eax, eax
je 0x1028a18
push 0
push dword [ebp + 0x18]
lea eax, [ebp - 0xc]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1028a18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1028a18
mov ecx, 0x2000
test ecx, eax
jne 0x1028a18
or eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 8], 0
je 0x1028a27
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1028c13
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], 1
je 0x1028c3f
mov dword [ebp - 4], 3
mov eax, dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [ebp + 0x10], eax
jmp 0x1028c76
cmp dword [ebp + 0x18], ebx
je 0x1028c8e
call edi
sub eax, dword [ebp + 0x10]
cmp eax, 0x2710
ja 0x1028c8e
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x14]
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1028c5e
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10290da
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002dec
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1029114
xor eax, eax
jmp 0x1029142
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1002dc8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1029136
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x102919f
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
je 0x10291be
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x110
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x10292f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.01006e57
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1029318
test al, 0x10
je 0x1029318
xor eax, eax
inc eax
jmp 0x102931a
xor eax, eax
pop ebp
ret 4
Function at 0x1029691
Capabilities:
Check os version
Get common file path
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1039074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0xffffffef
push edi
lea eax, [ebp - 0x118]
xor edi, edi
push eax
mov dword [esi + 4], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov ebx, 0x80070000
jne 0x10296f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10296eb
and eax, 0xffff
or eax, ebx
mov edi, eax
test edi, edi
jl 0x1029720
mov edi, 0x8000ffff
jmp 0x1029720
cmp dword [ebp - 0x108], 2
jne 0x1029720
cmp dword [ebp - 0x114], 6
jb 0x1029720
cmp dword [ebp - 0x10c], 0x14ca
jb 0x1029720
mov dword [ebp - 0x11c], 1
test edi, edi
mov eax, edi
jl 0x1029864
mov edi, 0x104
push edi
mov ecx, esi
call fcn.01006a8a
test eax, eax
jl 0x1029864
cmp dword [ebp - 0x11c], 0
je 0x10297ae
push edi
push 0
mov ecx, esi
call fcn.01029216
push eax
push 0x1002e74
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1029785
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1029775
and eax, 0xffff
or eax, ebx
test eax, eax
jl 0x1029864
mov eax, 0x8000ffff
jmp 0x1029864
push 0xffffffffffffffff
mov ecx, esi
call fcn.01006a4c
push 0x1002e60
push esi
call fcn.01006e85
test eax, eax
jl 0x1029864
push 0x1002e50
push esi
call fcn.01006e85
jmp 0x102981a
push esi
push 0x19
call fcn.010295e2
test eax, eax
mov ecx, esi
jne 0x1029820
push edi
push edi
call fcn.01029216
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x10297e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1029864
and eax, 0xffff
or eax, ebx
jmp 0x1029864
push 0xffffffffffffffff
mov ecx, esi
call fcn.01006a4c
push 0x1002e3c
push esi
call fcn.01006e85
test eax, eax
jl 0x1029864
push esi
call fcn.010292f6
test eax, eax
jne 0x1029859
test byte [esi], 0x10
jne 0x102980f
mov eax, dword [esi + 4]
add eax, 0xfffffff5
push eax
mov ecx, esi
call fcn.01029241
test eax, eax
jl 0x1029864
jmp 0x1029859
push 0x5c
call fcn.01006e57
push eax
call sub.ntdll.dll_wcsrchr
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1029859
mov ecx, esi
call fcn.01006e57
sub edi, eax
sar edi, 1
mov eax, edi
cmp eax, dword [esi + 4]
jg 0x102984c
mov dword [esi + 4], eax
jmp 0x1029851
cmp eax, dword [esi + 8]
jge 0x1029859
mov ecx, dword [esi + 0xc]
and word [ecx + eax*2], 0
push 0x1002e34
push esi
call fcn.01006e85
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010052b2
leave
ret 4
Function at 0x1029a40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp - 0x1c]
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0xffffffef
push edi
xor edi, edi
and ebx, 0xffffffc1
or ebx, 0x40
push 0x105
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], 1
mov dword [esi + 4], edi
call fcn.01006a8a
cmp eax, edi
mov dword [ebp + 8], eax
jl 0x1029be9
push 0x104
mov ecx, esi
call fcn.01029216
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x1029aab
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x1029be9
cld
mov edi, dword [ebp + 8]
mov eax, 0
mov ecx, 0x20a
or ecx, ecx
je 0x1029abf
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1002d80
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1029afc
jle 0x1029af4
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
jmp 0x1029be9
lea eax, [ebp - 8]
push eax
mov edi, 0x104
push edi
mov ecx, esi
call fcn.01029216
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002eb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1029b2a
jg 0x1029aea
jmp 0x1029af4
push 0xffffffffffffffff
mov ecx, esi
call fcn.01006a4c
and dword [ebp - 0x18], 0
and ebx, 0xffffffef
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0x208
mov dword [ebp - 0x1c], ebx
call fcn.01006a8a
test eax, eax
mov dword [ebp + 8], eax
jl 0x1029be9
lea eax, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.01029216
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov edi, 0x1002e98
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029be9
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.01006a4c
call fcn.010290da
test eax, eax
jne 0x1029be9
push 1
push esi
lea ecx, [ebp - 0x1c]
call fcn.010295b5
test eax, eax
jne 0x1029bb6
lea ebx, [ebp - 0x1c]
call fcn.01029875
test eax, eax
jl 0x1029be9
push esi
call fcn.01029350
mov dword [ebp + 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1002d98
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1029be9
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x1029bfb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x1029c09
lea ecx, [ebp - 0x1c]
call fcn.010069f9
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x1029e72
Capabilities:
Create directory
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01029c10
Function at 0x102a16d
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [ebp - 4], ebx
xor esi, esi
call fcn.01028992
add esp, 0x18
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x102a1a3
mov dword [ebp - 4], 0x80070002
jmp 0x102a20c
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0102a2cd
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x102a1c4
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x102a202
push ebx
push dword [ebp + 0x10]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x102a1fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102a1eb
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x102a202
mov dword [ebp - 4], 0x8000ffff
jmp 0x102a202
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call fcn.01005b67
mov eax, dword [ebp - 4]
pop ecx
pop esi
pop ebx
leave
ret 0xc

Function at 0x102b2bb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [esi + 8], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
jne 0x102b2ea
mov dword [ebp - 4], 0x80070057
jmp 0x102b38a
call fcn.010326e3
test eax, eax
je 0x102b2de
mov eax, dword [esi + 0x54]
cmp eax, 0xffffffff
je 0x102b302
push eax
call edi
or dword [esi + 0x54], 0xffffffff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
call fcn.0102b01e
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x102b37d
mov ecx, esi
call fcn.010326d2
cmp dword [ebp - 0xc], eax
je 0x102b37d
push 0
push 0x4000006
push 3
push 5
lea ebx, [esi + 0x44]
push 0x80010000
mov ecx, ebx
call fcn.01006e57
push eax
call fcn.01028992
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0x54], eax
je 0x102b356
push eax
call edi
or dword [esi + 0x54], 0xffffffff
mov ecx, ebx
call fcn.01006e57
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x102b37b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x102b37b
mov dword [ebp - 8], 1
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x102b38a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x54]
cmp eax, 0xffffffff
je 0x102b399
push eax
call edi
or dword [esi + 0x54], 0xffffffff
cmp dword [ebp - 4], ebx
jge 0x102b3a1
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102bb31
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0102b2bb
test eax, eax
jne 0x102bb43
and dword [esi + 0xc], 0xffffffef
mov eax, dword [esi + 0x54]
cmp eax, 0xffffffff
je 0x102bb56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x54], 0xffffffff
mov ecx, esi
pop esi
jmp fcn.0103278b

Function at 0x102bb33
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0102b2bb
test eax, eax
jne 0x102bb43
and dword [esi + 0xc], 0xffffffef
mov eax, dword [esi + 0x54]
cmp eax, 0xffffffff
je 0x102bb56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x54], 0xffffffff
mov ecx, esi
pop esi
jmp fcn.0103278b