joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10169f2
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x102c22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov eax, esi
push edi
mov dword [ebp - 0x114], esi
mov edi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1016a20
sub eax, ecx
cmp eax, 0x103
jbe 0x1016a34
xor eax, eax
jmp 0x1016aa5
test esi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x1016a9b
push 0x100514c
push edi
call sub.ntdll.dll_strstr
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x10c], eax
je 0x1016a91
push dword [ebp - 0x110]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x108]
push eax
call ebx
inc dword [ebp - 0x10c]
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x10c]
test edi, edi
jne 0x1016a3f
push dword [ebp - 0x110]
push esi
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101439a
leave
ret 8

Function at 0x1016ab8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x102c22c]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push ecx
push 0x100516c
mov esi, 0x107f8a0
xor edi, edi
push esi
mov dword [ebp - 0x210], edi
call sub.ntdll.dll_sprintf
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1016b01
xor eax, eax
inc eax
jmp 0x1016b72
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x20c]
push 0x1005150
mov esi, 0x106f8a0
push esi
mov dword [ebp - 0x224], 0x14
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x214], eax
call sub.ntdll.dll_sprintf
add esp, 0xc
push esi
call fcn.01015c42
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.01016879
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101439a
leave
ret 8
Function at 0x1016d74
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
push 0x10051c8
call fcn.010145b0
xor esi, esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x1016d8e
mov dword [eax], esi
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1016d97
mov dword [eax], esi
lea eax, [ebp - 0x24]
push eax
push 1
push esi
push 0x1004c14
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x1016e4e
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
mov ebx, 0x10051ac
push ebx
push dword [ebp - 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x1016e23
push dword [ebp - 0x20]
call sub.msvcrt.dll_malloc
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, esi
jne 0x1016df6
mov dword [ebp - 0x1c], 8
jmp 0x1016e45
lea ecx, [ebp - 0x20]
push ecx
push eax
push esi
push esi
push ebx
push dword [ebp - 0x24]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x1016e19
mov edi, dword [ebp + 8]
push dword [edi]
call sub.msvcrt.dll_free
pop ecx
mov dword [edi], esi
jmp 0x1016e45
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x1016e45
cmp eax, 2
je 0x1016e2d
cmp eax, 3
jne 0x1016e45
push 1
push 2
call sub.msvcrt.dll_calloc
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [ebp - 0x1c], esi
or dword [ebp - 4], 0xffffffff
call fcn.01016e68
push dword [ebp - 0x1c]
call fcn.0100d556
xor eax, eax
cmp dword [ebp - 0x1c], esi
sete al
call fcn.010145eb
ret 8
Function at 0x1017426
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x102c22c]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edx, [ebp - 0x160]
push edx
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x148], 1
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
mov esi, 0x107f8a0
mov ebx, 0x106e760
test eax, eax
je 0x1017647
mov edi, dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
push 0
push 0x104
push 0x106f8a0
push 1
lea eax, [ebp - 0x160]
push eax
call edi
test eax, eax
je 0x1017605
push 0
push 0x104
push esi
push 2
lea eax, [ebp - 0x160]
push eax
call edi
test eax, eax
je 0x1017605
push 0x1005444
mov edi, 0x106f8a0
push edi
call sub.ntdll.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x10174da
push 0x1000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x1017524
push 0x1005430
push edi
call sub.ntdll.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x1017502
push eax
push 0x1000
push ebx
push esi
push eax
push dword [ebp - 0x150]
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetTargetPathA]
jmp 0x1017524
and dword [ebp - 0x148], 0
push 0x1005414
mov byte [0x106e760], 0
call fcn.01015c42
push 0x4c7
call fcn.0100d556
cmp dword [ebp - 0x148], 1
jne 0x1017605
xor eax, eax
mov ecx, 0x3ffe
mov edi, esi
push ebx
rep stosd dword es:[edi], eax
push 0x100540c
push 0xfff9
push esi
stosw word es:[edi], ax
call sub.ntdll.dll__snprintf
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14c], eax
je 0x10175c6
test byte [ebp - 0x144], 0x10
jne 0x10175a3
xor eax, eax
mov ecx, 0x3ffe
mov edi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x118]
push eax
push ebx
push 0x1005404
push 0xfffa
push esi
call sub.ntdll.dll__snprintf
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x101756b
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1017605
mov ecx, 0x3ffe
mov edi, 0x106f8a0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x10053ec
push 0xfff9
mov edi, 0x106f8a0
push edi
call sub.ntdll.dll__snprintf
add esp, 0x14
push edi
call fcn.01015c42
lea eax, [ebp - 0x160]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
xor edi, edi
test eax, eax
je 0x1017639
push edi
push 0x104
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextA]
test eax, eax
je 0x1017639
xor eax, eax
inc eax
jmp 0x101763b
xor eax, eax
cmp dword [ebp - 0x148], edi
jne 0x101746d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x148]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 8
Function at 0x1017661
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x102c22c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x1005450
xor esi, esi
push ebx
inc esi
call fcn.01015121
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x354], eax
je 0x10177c5
and dword [ebp - 0x350], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x1004c4c
lea eax, [ebp - 0x320]
push eax
call esi
test eax, eax
je 0x1017798
push 0x1004c48
lea eax, [ebp - 0x320]
push eax
call esi
test eax, eax
je 0x1017798
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x320]
push eax
push ebx
call fcn.01015121
test byte [ebp - 0x34c], 0x10
lea eax, [ebp - 0x108]
je 0x1017733
push dword [ebp + 0xc]
push eax
call fcn.01017661
cmp dword [ebp - 0x350], 0
jl 0x1017798
test eax, eax
jge 0x1017798
mov dword [ebp - 0x350], eax
jmp 0x1017798
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1017798
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x1017779
cmp esi, 3
je 0x1017779
cmp dword [ebp + 0xc], 1
jne 0x1017779
push 4
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp dword [ebp - 0x350], 0
jl 0x1017798
test esi, esi
jle 0x1017792
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0x350], esi
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10176bf
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x350]
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1017800
test esi, esi
jl 0x1017800
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1017821
cmp eax, 2
je 0x1017821
test eax, eax
jle 0x1017823
and eax, 0xffff
or eax, 0x80070000
jmp 0x1017823
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1017821
cmp eax, 2
je 0x1017821
cmp dword [ebp + 0xc], 0
je 0x1017821
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 8
Function at 0x1017837
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x102c22c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
push 0x1005450
xor ebx, ebx
push edi
inc ebx
call fcn.01015121
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x350], eax
je 0x1017916
xor ebx, ebx
push 0x1004c4c
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10178f3
push 0x1004c48
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10178f3
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x320]
push eax
push edi
call fcn.01015121
test byte [ebp - 0x34c], 0x10
je 0x10178f3
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.01017837
test ebx, ebx
jl 0x10178f3
test eax, eax
jge 0x10178f3
mov ebx, eax
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1017890
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1017951
test ebx, ebx
jl 0x1017951
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1017972
cmp eax, 2
je 0x1017972
test eax, eax
jle 0x1017974
and eax, 0xffff
or eax, 0x80070000
jmp 0x1017974
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1017972
cmp eax, 2
je 0x1017972
cmp dword [ebp + 0xc], 0
je 0x1017972
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 8

Function at 0x1017988
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102c22c]
push ebx
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x1005488
xor ebx, ebx
push 0x80000002
inc ebx
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10179c4
xor eax, eax
jmp 0x1017a26
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1005480
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1017a06
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push 4
push edi
push 0x1005470
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1017a08
xor ebx, ebx
cmp dword [ebp - 8], edi
je 0x1017a16
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x1017a24
push 0x1005458
call fcn.01015c42
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0101439a
leave
ret
Function at 0x1017c5a
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
imul eax, eax, 0xea60
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
call ebx
test eax, eax
jne 0x1017cad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100556c
mov dword [ebp - 4], eax
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1017d4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0x14], eax
mov eax, dword [esi + 0x14]
mov dword [ebp + 0xc], eax
jmp 0x1017d22
cmp dword [ebp - 8], 0
jne 0x1017cd5
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
ja 0x1017d4b
mov eax, dword [esi + 0x18]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x1017cf1
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1017cf3
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push dword [ebp + 8]
call ebx
test eax, eax
je 0x1017d2c
mov eax, dword [ebp + 0xc]
cmp dword [esi + 0x14], eax
jbe 0x1017d10
call edi
jmp 0x1017cb9
call edi
mov ecx, dword [esi + 0x18]
sub eax, dword [ebp + 0x14]
add ecx, 0xea60
cmp eax, ecx
ja 0x1017d44
mov eax, dword [ebp + 0x10]
cmp dword [esi + 4], eax
jne 0x1017cc4
jmp 0x1017d4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100556c
mov dword [ebp - 4], eax
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1017d4b
mov dword [ebp - 4], 0x41d
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x10
Function at 0x101805c
Capabilities:
Query environment variable
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
xor edi, edi
push 0x2000
mov dword [ebp - 4], edi
call sub.msvcrt.dll_malloc
mov ebx, eax
cmp ebx, edi
pop ecx
jne 0x1018085
push 8
call fcn.0100d556
jmp 0x10180aa
push esi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
test eax, eax
jne 0x10180b5
mov dword [ebp - 4], 1
push ebx
call sub.msvcrt.dll_free
pop ecx
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
xor edi, edi
push edi
mov esi, 0x1000
push esi
push ebx
push edi
push edi
push edi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextA]
test eax, eax
je 0x10180a2
lea eax, [ebp + 0xc]
push eax
push ebx
lea edi, [ebx + 0x1000]
push edi
mov dword [ebp + 0xc], esi
call fcn.01017fdc
test eax, eax
je 0x1018144
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1018144
cmp eax, esi
ja 0x1018144
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10180fc
sub eax, esi
push 0
lea edi, [eax + ebx]
lea ecx, [ebp - 8]
push ecx
add eax, 2
push eax
mov esi, 0x10020d8
movsw word es:[edi], word [esi]
push ebx
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10180a2
lea eax, [ebp - 0x18]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
test eax, eax
jne 0x10180b3
jmp 0x101809b
push 0x7a
call fcn.0100d556
jmp 0x10180a2
Function at 0x101869f
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102c22c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1001a40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10186e9
push eax
push 0x100582c
call fcn.01015c5a
pop ecx
pop ecx
xor eax, eax
jmp 0x10187ed
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x100581c
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x214]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1018739
push ebx
push 0x10057d8
jmp 0x10187d0
mov byte [ebp - 0x20d], 0
mov byte [esi + 1], 0x3a
mov byte [esi + 2], 0
mov bl, 0x43
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x101876b
mov byte [ebp - 0x20d], bl
jmp 0x1018784
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.ntdll.dll__strcmpi
test eax, eax
pop ecx
pop ecx
je 0x10187a3
inc bl
cmp bl, 0x5a
jle 0x101874a
mov al, byte [ebp - 0x20d]
test al, al
jne 0x10187ae
push 0x10057a0
call fcn.01015c5a
xor eax, eax
jmp 0x10187eb
movsx eax, byte [esi]
push eax
push 0x1005758
jmp 0x10187e2
mov byte [esi], al
lea eax, [ebp - 0x108]
push eax
push esi
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x10187d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005710
call fcn.01015c5a
xor eax, eax
jmp 0x10187ea
movsx eax, byte [esi]
push eax
push 0x10056c8
call fcn.01015c5a
xor eax, eax
inc eax
pop ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101439a
leave
ret 4
Function at 0x10187ff
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x102c22c]
push ebx
xor ebx, ebx
cmp dword [0x106e3d8], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
je 0x1018825
xor eax, eax
inc eax
jmp 0x101888c
push esi
lea ecx, [ebp - 0x230]
push ecx
push ebx
push 0x1005970
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
cmp eax, ebx
mov esi, 0x100a5
je 0x101887b
lea eax, [ebp - 0x21c]
push eax
push 1
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetIntField]
cmp eax, ebx
je 0x1018865
cmp dword [ebp - 0x21c], esi
je 0x1018877
lea eax, [ebp - 0x230]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
cmp eax, ebx
jne 0x1018843
cmp eax, ebx
jne 0x1018899
push esi
push 0x1005938
call fcn.01015c5a
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0101439a
leave
ret 4
lea eax, [ebp - 0x214]
push eax
push 1
push ebx
push 0x1001a40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x10188c8
push eax
push 0x1005900
call fcn.01015c5a
pop ecx
pop ecx
xor eax, eax
jmp 0x101888b
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x10058f0
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x214]
mov esi, eax
mov eax, dword [ebp - 0x218]
mov byte [ebp + eax - 0x210], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x1018920
push esi
push 0x10058b4
jmp 0x10188bd
lea eax, [ebp - 0x10c]
push eax
call fcn.0101869f
test eax, eax
jne 0x1018941
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005870
jmp 0x10188bd
push 0x107
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.01015121
lea eax, [ebp - 0x10c]
push eax
call sub.msvcrt.dll__strdup
cmp eax, ebx
pop ecx
mov dword [0x106e3d8], eax
jne 0x1018888
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10188c4
Function at 0x101898c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x102c22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [0x106d39c], 0xffffffff
push esi
push edi
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x614], ebx
je 0x1018a98
mov dword [ebp - 0x610], ebx
push ebx
push 0x400
lea eax, [ebp - 0x60c]
push eax
xor eax, eax
cmp dword [ebp - 0x610], ebx
push ebx
setne al
inc eax
push eax
push dword [ebp - 0x61c]
push dword [ebp - 0x618]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x1018a85
cmp byte [ebp - 0x60c], bl
lea esi, [ebp - 0x60c]
je 0x1018a85
push dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push esi
push 0x10059a4
push 0x103
push eax
call sub.ntdll.dll__snprintf
mov ecx, dword [0x106d39c]
add esp, 0x14
cmp ecx, 0xffffffff
je 0x1018aa2
lea eax, [ebp - 0x20c]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1018a4b
push ebx
lea edx, [ebp - 0x624]
push edx
sub eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1018ab7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1018a74
sub eax, edx
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x1018a17
inc dword [ebp - 0x610]
cmp dword [ebp - 0x610], 2
jl 0x10189d8
mov dword [ebp - 0x614], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x614]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1005980
call fcn.01015c5a
add esp, 0xc
jmp 0x1018aa2