joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007d420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x101599e4
push ebx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
test eax, eax
jne 0x1007d446
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1007d446
xor eax, eax
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov edi, dword [sym.imp.MSVCR80.dll__fsopen]
xor esi, esi
mov ecx, dword [esp + 0x10]
push 0x10
push ebx
push ecx
call edi
add esp, 0xc
test eax, eax
jne 0x1007d479
push 0x64
call ebp
add esi, 1
cmp esi, 0x3e8
jl 0x1007d457
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x1007e3b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
test ebx, ebx
push esi
push edi
jne 0x1007e407
cmp byte [ebp + 0x2c], al
jne 0x1007e3fe
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1007e3e0
sub eax, edx
lea edi, [ebp + 0x34]
mov esi, eax
call fcn.100812d0
or eax, 0xffffffff
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x3c], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
mov edi, ebp
call fcn.1007d730
mov esi, dword [sym.imp.MSVCR80.dll_fseek]
push 2
or eax, 0xffffffff
push 0
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call esi
push ebx
call dword [sym.imp.MSVCR80.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
add esp, 0x1c
test edi, edi
jg 0x1007e462
cmp byte [ebp + 0x2c], 0
jne 0x1007e3fe
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 0xc
mov ebx, dword [str.Error_document_empty.]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1007e457
jmp 0x1007e3e9
lea eax, [edi + 1]
push eax
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x1007e4be
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [ebp + 0x2c], 0
jne 0x1007e3fe
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1007e4b0
jmp 0x1007e3e9
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x1007e4f4
jmp 0x1007e4d0
mov dl, byte [eax]
cmp dl, 0xd
jne 0x1007e4e7
mov byte [ecx], 0xa
add eax, 1
add ecx, 1
cmp byte [eax], 0xa
jne 0x1007e4ef
jmp 0x1007e4ec
mov byte [ecx], dl
add ecx, 1
add eax, 1
cmp byte [eax], 0
jne 0x1007e4d0
push 1
mov byte [ecx], 0
mov edx, dword [ebp]
mov eax, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call eax
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop esi
pop ebp
sete al
pop ebx
ret 4
Function at 0x100821f0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x56]
push ebx
push ecx
mov dword [esp + 0x28], eax
mov word [esp + 0x5c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea edx, [esp + 0x54]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x10082387
lea eax, [esp + 0x18]
push eax
push 0x10159ed4
push 1
push ebx
push 0x10159ef4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100822bb
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x10159ec4
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov edi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp edi, ebx
jge 0x100822dd
mov esi, dword [sym.imp.MSVCR80.dll_wprintf]
push str.Failed_calling_ITaskScheduler::Activate:
call esi
add esp, 4
push edi
push str.error__0x_x_n
call esi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.10130e50
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, esi
call fcn.1008d060
xor edi, edi
cmp word [esp + 0x14], bx
jbe 0x1008235f
push 0x2e
lea ecx, [esp + 0x26]
push ebx
push ecx
mov word [esp + 0x2c], bx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x20]
call fcn.1005bf30
movzx eax, word [esp + 0x14]
add edi, 1
cmp edi, eax
jl 0x10082302
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x8c]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10130e50
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10082be0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.10130e50
add esp, 0x118
ret
Function at 0x1008fdf0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
cmp byte [eax], 2
push esi
jne 0x1008feb0
cmp byte [eax + 1], 2
jne 0x1008feb0
mov eax, ecx
lea esi, [eax + 1]
jmp 0x1008fe20
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x1008fe20
sub eax, esi
cmp byte [eax + ecx - 1], 0xa
jne 0x1008fe46
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x1008fe37
sub eax, esi
mov byte [eax + ecx - 1], dl
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1008feb0
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x10]
push ecx
call sub.MSVCR80.dll_memcpy
mov edx, dword [esp + 0x14]
add esp, 0xc
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x1008feb0
mov ecx, eax
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x1008fe80
sub ecx, esi
push ecx
push eax
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov al, 1
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10130e50
add esp, 0x14
ret 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
xor al, al
call fcn.10130e50
add esp, 0x14
ret 4
Function at 0x10093010
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x10141449
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
add eax, 0x38
push eax
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push str.WindowsAB_Function.dat
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call dword [0x1014c4e8]
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x10093076
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 4]
jne 0x10093097
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x1009309f
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10130e50
add esp, 0x2c
ret 4
Function at 0x100937a0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x10153438
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100937e1
mov ax, word [esp]
cmp ax, 9
je 0x100937d8
cmp ax, 6
jne 0x100937e1
mov eax, 1
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret

Function at 0x100939b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
push esi
push edi
push 0x40
lea eax, [esp + 0x20]
push 0
push eax
mov dword [esp + 0x24], 0
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [esp + 0x44], 0x101
mov word [esp + 0x48], 0
call fcn.10093c00
mov ecx, dword [ebp + 8]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov esi, eax
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10094870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
mov esi, ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x100948ba
test edi, edi
je 0x100948ba
cmp byte [ebp + 0x18], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 4]
jne 0x100948c5
push 0
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100948d6
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 2
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100948ba
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10094900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
mov esi, ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10094944
test edi, edi
je 0x10094944
cmp byte [ebp + 0x10], al
je 0x1009494f
push 2
xor ecx, ecx
push ecx
push ecx
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10094977
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp byte [ebp + 0x1c], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [esi + 4]
jne 0x10094966
push 0
push 0
push ecx
push edx
jmp 0x10094939
push 2
push 0
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10094944
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10096670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10096694
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
test al, 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
je 0x100966d2
lea eax, [esp + 8]
push eax
push str.S_1_1_0
mov dword [esp + 0x10], 0
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push ecx
push 1
push 1
push edi
call esi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push 3
push 1
push 0x10000000
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push str.Everyone
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x1009668a
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
push 0
push 4
push 1
push edi
call esi
test eax, eax
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100967b0
Capabilities:
Acquire debug privileges

Disassembly:
push 0xffffffffffffffff
push 0x1014141f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 0x210]
mov dword [esi], vtable.GA::RegistryControl.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeDebugPrivilege
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeAuditPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeSecurityPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeTakeOwnershipPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeManageVolumePrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeRestorePrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeBackupPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeLoadDriverPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeSystemEnvironmentPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.100986e0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10096bf0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10143930
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
cmp byte [ebp + 0xc], 0
je 0x10096d64
xor edi, edi
mov dword [esp + 0x18], vtable.MemoryControl.0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x40], edi
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x18], edi
call edx
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.100998f0
mov ebx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x10096c78
mov ecx, dword [esp + 0x20]
push ecx
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [esi]
mov edx, dword [edx + 0x20]
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, esi
call edx
test al, al
jne 0x10096cb4
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x10096c9d
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x2c]
call fcn.10099bb0
add esp, 8
xor ebx, ebx
lea esp, [esp]
mov esi, dword [esp + 0x28]
test esi, esi
je 0x10096d2d
mov ecx, dword [esp + 0x2c]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x10096d2d
cmp dword [ebx + esi + 0x18], 8
jb 0x10096d12
mov esi, dword [ebx + esi + 4]
jmp 0x10096d16
lea esi, [ebx + esi + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add edi, 1
add ebx, 0x1c
jmp 0x10096ce0
lea ebx, [esp + 0x24]
mov byte [esp + 0x40], 0
call fcn.100036e0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10096d4d
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10096d4d
cmp eax, 2
je 0x10096d4d
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10097dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10097dfa
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ecx
ret 0xc
cmp dword [esp], 1
sete al
pop ecx
ret 0xc
Function at 0x100991a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x31c
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push esi
xor eax, eax
push edi
xor ebx, ebx
push 0xfe
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x22]
push ebx
push eax
mov dword [esp + 0x18], ebx
mov word [esp + 0x28], bx
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x12e]
push ebx
push ecx
mov word [esp + 0x134], bx
call sub.MSVCR80.dll_memset
add esp, 0x18
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
movzx eax, byte [esp + 0x1b]
movzx ecx, byte [esp + 0x1a]
push eax
mov eax, dword [esp + 0x1c]
push ecx
movzx ecx, byte [esp + 0x1f]
movzx edx, ah
push edx
movzx edx, byte [esp + 0x22]
movzx eax, al
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
movzx ecx, ah
push ecx
movzx ecx, word [esp + 0x2c]
movzx edx, al
movzx eax, word [esp + 0x2e]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
lea eax, [esp + 0x48]
push 0x101527d8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea ecx, [esp + 0x11c]
call fcn.10099520
mov esi, eax
cmp esi, ebx
jne 0x100992bc
push 0xed
call fcn.10098890
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push ebx
push str.GetAppDataPath_tszAomeiBR__MAX_PATH_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x318]
xor ecx, esp
call fcn.10130e50
add esp, 0x31c
ret
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push ebp
push 0x10152b8c
lea eax, [esp + 0x124]
push 0x104
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x10099332
call ebp
cmp eax, 2
jne 0x10099332
push ebx
lea edx, [esp + 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
cmp edi, ebx
jne 0x10099332
push 0xf5
call fcn.10098890
add esp, 4
push eax
push str.CreateDirectory_tszAomeiBR__NULL_
call ebp
mov esi, eax
call fcn.100016d0
add esp, 8
mov eax, edi
jmp 0x1009939d
push str.comn.ini
lea eax, [esp + 0x124]
push 0x104
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x24]
push edx
push str.MARK
push str.COMN
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, eax
cmp esi, ebx
jne 0x1009939b
push 0xfb
call fcn.10098890
add esp, 4
mov edi, eax
call ebp
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push ebx
push str.WritePrivateProfileString_TEXT__COMN____TEXT__MARK____tszMark__tszAomeiBR_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0x328]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10130e50
add esp, 0x31c
ret