joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107de96
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0x10bcba8
cmp eax, esi
push edi
je 0x107deba
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x107deb0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x107debf
sub eax, edx
lea edi, [eax + 0x10bcba8]
mov byte [edi], 0x5c
inc edi
and dword [ebp + 8], 0
mov ebx, 0x10bc130
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 8], eax
mov word [edi], 0x2a
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x107df6b
test byte [0x10bc130], 0x10
jne 0x107df48
mov eax, 0x10bc15c
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x107df08
push 0x10282fc
push edi
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x107df38
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x107df48
push dword [ebp + 0xc]
push esi
call fcn.0107c243
test eax, eax
je 0x107df48
inc dword [ebp + 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x107def6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 8]
cmp dword [ebp + 8], eax
jne 0x107dedb
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x107e0ba
Capabilities:
Delete directory
Get common file path
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x1099a38]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x104
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x100da14
push eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x318], esi
call fcn.01070fc9
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0107de96
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x108]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x108]
push eax
call edi
test eax, eax
jne 0x107e13e
push 4
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push dword [ebp - 0x318]
push dword [ebp - 0x314]
call fcn.0107de96
push ebx
push dword [ebp - 0x314]
call esi
push dword [ebp - 0x314]
call edi
test eax, eax
jne 0x107e173
push 4
push eax
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp dword [ebp + 0x10], 0
jne 0x107e1b7
mov esi, 0x104
push esi
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x107e1b7
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1026d48
lea eax, [ebp - 0x310]
push eax
call fcn.01070fc9
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.01074549
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0xc
Function at 0x107e1c6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1099a38]
and dword [ebp - 0x218], 0
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov esi, 0x209
je 0x107e262
cmp byte [edi], 0
je 0x107e262
push edi
mov dword [ebp - 0x218], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x107e23b
test al, 0x10
je 0x107e23b
push esi
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
mov byte [ebp - 0x210], 0
call fcn.01070fc9
jmp 0x107e249
push edi
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0108c975
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0107dc27
test eax, eax
mov dword [ebp - 0x214], eax
jne 0x107e2ac
push esi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x21c]
mov byte [ebp - 0x210], 0
call fcn.01070fc9
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0107dc27
test eax, eax
mov dword [ebp - 0x214], eax
je 0x107e2c1
cmp dword [ebp - 0x218], 0
je 0x107e2ac
push edi
push 0x1028328
call fcn.01071ac0
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x1c]
push dword [ebp - 0x220]
call fcn.01037469
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0x18

Function at 0x107e2d6
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, edx
not eax
je 0x107e2ec
push esi
movsx esi, byte [ecx]
rol eax, 3
xor eax, esi
inc ecx
dec edx
jne 0x107e2df
pop esi
ret
Function at 0x107ff71
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x1099a38]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, 0x80000000
push esi
push 0
push 0
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [ebp - 0x420], eax
jne 0x107ffc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1028eb8
call fcn.01071ac0
pop ecx
pop ecx
or edi, 0xffffffff
jmp 0x108017e
push ebx
lea eax, [ebp - 0x42c]
push eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 2
push edi
mov edi, dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldW]
call edi
test eax, eax
jne 0x1080003
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1028e90
call fcn.01071ac0
pop ecx
pop ecx
or edi, 0xffffffff
jmp 0x1080171
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [ebp + 0x14]
cmp esi, 1
mov dword [ebp - 0x424], eax
jne 0x108005a
xor edi, edi
inc edi
test eax, eax
jne 0x108004e
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1028e68
call fcn.01071ac0
add esp, 0xc
jmp 0x108015c
push 0x1028e44
call fcn.01071ac0
jmp 0x108009c
test eax, eax
jne 0x1080075
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1028e18
jmp 0x1080041
lea ecx, [ebp - 0x448]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10800a2
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1028dec
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x108015c
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x42c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 3
push dword [ebp - 0x428]
call edi
test eax, eax
je 0x1080103
lea esi, [esi + esi*2]
shl esi, 5
lea eax, [esi + 0x1099a54]
push eax
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
jne 0x1080103
lea eax, [ebp - 0x41c]
push eax
push 4
push dword [ebp - 0x428]
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetIntField]
test eax, eax
jne 0x1080108
or edi, 0xffffffff
jmp 0x108015c
push 1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 1
push dword [ebp + 0x14]
call fcn.0107f6d6
mov edi, eax
cmp edi, 1
jne 0x1080131
lea eax, [esi + 0x1099a5e]
jmp 0x108013b
test edi, edi
jne 0x108015c
lea eax, [esi + 0x1099a86]
push dword [ebp - 0x41c]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
push 0x1028da8
call fcn.01071ac0
add esp, 0x14
cmp dword [ebp - 0x424], 0
je 0x1080171
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0106bc50
leave
ret 0x10
Function at 0x10819a4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
push 0x10299b8
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x1029948
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1081ab3
push 4
pop edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1029928
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1081ab3
cmp dword [ebp - 0x24], edi
jne 0x1081ab3
cmp dword [ebp - 0x28], 1
jne 0x1081ab3
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1029910
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1081a49
cmp dword [ebp - 0x24], edi
jne 0x1081a49
mov eax, dword [ebp - 0x28]
mov dword [0x1099e74], eax
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x10298f8
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x1081a7b
cmp dword [ebp - 0x24], edi
jne 0x1081a7b
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x1081a7b
mov dword [0x1099e78], eax
or dword [ebp - 4], 0xffffffff
call fcn.01081ac6
push ebx
push 0x40000080
push 3
push ebx
push ebx
push 0xc0000000
push 0x10298e4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x1099e70], eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
call fcn.0106bf9e
ret
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll__local_unwind2
pop ecx
pop ecx
xor eax, eax
jmp 0x1081aad

Function at 0x1081f6a
Capabilities:
Enumerate services

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push 5
push esi
push esi
mov dword [ebp - 4], esi
mov dword [eax], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x1082003
push ebx
push edi
xor ebx, ebx
mov edi, 0x1000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push ebx
call fcn.0106bf39
add edi, dword [ebp - 0xc]
push edi
call sub.msvcrt.dll_malloc
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x1081fee
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push 1
push 0x30
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
test eax, eax
jne 0x108200f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x108200b
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jb 0x1081f9d
push ebx
call fcn.0106bf39
pop ecx
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
cmp eax, esi
jne 0x1081fee
cmp dword [ebp - 4], esi
je 0x1081fee
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1081ff8
Function at 0x10821e5
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0xd
pop ecx
xor ebx, ebx
push ebx
push ebx
push 0x1004
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x3c]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
call esi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x1007
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x1082232
or eax, eax
jmp 0x10822d5
mov edi, dword [ebp + 0xc]
push dword [edi + 4]
push dword [edi]
push dword [edi + 8]
push 0x1029b50
call fcn.01071ac0
add esp, 0x10
test byte [0x10bd0f0], 4
mov ebx, 0x102e
je 0x108228c
push dword [edi + 8]
push 0x1029b48
push 0x1106960
call fcn.0106bf51
and dword [ebp - 0x68], 0
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x5c], 0x1106960
call esi
test byte [0x10bd0f0], 1
je 0x10822b0
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov eax, dword [edi]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call esi
test byte [0x10bd0f0], 2
je 0x10822d2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1083240
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1099a38]
push ebx
push esi
push 2
xor esi, esi
pop ebx
cmp dword [0x10bd1f0], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], esi
jne 0x108337f
push edi
lea eax, [ebp - 0x40c]
push eax
xor edi, edi
inc edi
push edi
push esi
push 0x102a240
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x108337e
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push 0x102a224
push dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1083372
cmp dword [ebp - 0x418], edi
jne 0x1083372
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x102a210
lea eax, [ebp - 0x404]
push eax
call esi
test eax, eax
jne 0x10832f6
mov dword [ebp - 0x408], ebx
jmp 0x1083372
push 0x102a1fc
lea eax, [ebp - 0x404]
push eax
call esi
test eax, eax
jne 0x1083372
push 0x102a1e8
mov dword [ebp - 0x408], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1083372
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x102a1d4
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x108336b
push 0x102a1c0
push edi
call esi
mov esi, eax
test esi, esi
je 0x108336b
lea eax, [ebp - 0x414]
push eax
push 0x65
push 0
call ebx
test eax, eax
jne 0x108336b
mov eax, dword [ebp - 0x414]
test byte [eax + 0x10], 0x10
je 0x1083368
mov dword [ebp - 0x408], 3
push eax
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x408]
pop esi
pop ebx
call fcn.0106bc50
leave
ret

Function at 0x108347a
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1099a38]
push esi
mov esi, dword [ebp + 8]
or dword [esi], 0xffffffff
push edi
mov dword [ebp - 4], eax
call fcn.01083240
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [esi + 4], eax
push 0x10c6a40
lea eax, [ebp - 0x214]
push eax
call edi
lea eax, [ebp - 0x214]
push eax
lea eax, [esi + 0x10]
push eax
call edi
push 0x1014d0c
lea eax, [esi + 0x218]
push eax
call edi
cmp word [ebp - 0x214], 0
mov dword [esi + 8], 0x10
mov dword [esi + 0xc], 8
je 0x1083524
cmp word [ebp - 0x212], 0x3a
jne 0x1083524
cmp word [ebp - 0x210], 0x5c
jne 0x1083524
push 4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x1083524
mov eax, dword [esi + 8]
or dword [esi + 0xc], 0x19
mov dword [esi + 8], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0106bc50
leave
ret 4
Function at 0x1083532
Capabilities:
Check os version
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac0
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [0x10c6c58], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x10bd1e0
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xabc], 1
mov dword [0x10c6c54], eax
mov dword [0x10bd1e0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x102a2f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [0x10bd0f8], eax
je 0x10835bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x102a2e4
push eax
call esi
push 0x102a2d8
push dword [0x10bd0f8]
mov dword [0x10c6c50], eax
call esi
mov dword [0x10c6c4c], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x102a2bc
mov dword [0x10c6c48], 0x102a2a8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1083693
push edi
lea eax, [ebp - 0xac0]
push eax
mov edi, 0x10c6a40
push edi
push esi
push ebx
push dword [0x10c6c48]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp eax, esi
ja 0x1083692
cmp eax, ebx
je 0x1083692
mov eax, dword [0x10c6c50]
cmp eax, ebx
je 0x1083633
push ebx
lea ecx, [ebp - 0xabc]
push ecx
push 4
push edi
push 0x1099e80
call eax
jmp 0x1083635
xor eax, eax
cmp eax, ebx
mov dword [ebp - 0xab8], eax
je 0x1083692
mov ecx, dword [0x10bd1e4]
cmp ecx, 5
jb 0x108367e
jne 0x108365c
cmp dword [0x10bd1e8], ebx
jne 0x108365c
mov eax, dword [eax + 0xc4c]
jmp 0x1083662
mov eax, dword [eax + 0xc5c]
cmp eax, ebx
je 0x108367e
push ebx
push 0x10833c8
push 0x8a8
lea ecx, [ebp - 0xab4]
push ecx
push eax
call fcn.01072b42
cmp dword [ebp - 0xab8], ebx
je 0x1083692
lea eax, [ebp - 0xab8]
push eax
call fcn.01083465
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor eax, eax
pop ebx
call fcn.0106bc50
leave
ret 8
Function at 0x1083d88
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1099a38]
and dword [ebp - 0x130], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x134], eax
je 0x1083f2f
push edi
push 0x4a
pop ecx
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
push eax
push ebx
push esi
mov dword [ebp - 0x12c], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
jne 0x1083e06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x134]
push 0x102a4b0
call fcn.01071ac0
add esp, 0xc
jmp 0x1083f2e
cmp dword [0x109abbc], 0
jne 0x1083e16
or byte [ebp - 0x126], 2
lea eax, [ebp - 0x12c]
push eax
push ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
test eax, eax
jne 0x1083e41
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102759c
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1083f2e
xor eax, eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x138], 0
push 0x10
lea eax, [ebp - 0x144]
push eax
xor edi, edi
push ebx
inc edi
push esi
mov dword [ebp - 0x144], 8
mov dword [ebp - 0x140], 5
mov dword [ebp - 0x13c], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsA]
test eax, eax
jne 0x1083e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102a478
call fcn.01071ac0
pop ecx
pop ecx
push 0x20006
push 2
push 0
push edi
push ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
je 0x1083ed1
push 0x1027508
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x10274f8
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push esi
push 5
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
jne 0x1083f0d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x102a444
call fcn.01071ac0
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiRemoveDevice]
test eax, eax
jne 0x1083f0d
call edi
push eax
push 0x102a418
jmp 0x1083e35
mov eax, dword [0x10f55c8]
test eax, eax
je 0x1083f24
push 0
push dword [ebp - 0x134]
push eax
call fcn.01072ba9
mov dword [ebp - 0x130], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x130]
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0xc
Function at 0x1084847
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1099a38]
mov edx, dword [ebp + 8]
push edi
push 0x40
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
xor edi, edi
push edi
push edx
mov dword [ebp - 0x110], edx
call fcn.01083b4f
test eax, eax
je 0x1084922
push esi
push dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push 0x1009b74
push 0x103
push eax
inc edi
call fcn.01037486
mov ecx, dword [0x10f4464]
add esp, 0x10
cmp ecx, 0xffffffff
je 0x1084921
lea eax, [ebp - 0x108]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10848c8
push 0
lea edx, [ebp - 0x114]
push edx
sub eax, esi
push eax
lea eax, [ebp - 0x108]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1084906
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 0x110]
call fcn.01083b4f
test eax, eax
jne 0x1084894
jmp 0x1084921
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x10252e8
call fcn.01071ac0
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
pop edi
call fcn.0106bc50
leave
ret 4

Function at 0x1084932
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1099a38]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
push 0x40
mov byte [ebp - 0x108], 0
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x108421e
stosb byte es:[edi], al
call fcn.01083a1e
and dword [0x10bd0fc], 0
push 0x1009808
push esi
mov dword [0x1099ea4], eax
call fcn.010844ef
test eax, eax
jne 0x1084a2a
call fcn.01084627
mov edi, eax
test edi, edi
jne 0x1084a28
cmp dword [0x10f4464], 0xffffffff
je 0x1084a21
push 0x102a6cc
push 0x102a764
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.01037486
mov ecx, dword [0x10f4464]
add esp, 0x10
cmp ecx, 0xffffffff
je 0x1084a28
lea eax, [ebp - 0x108]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10849d4
push 0
lea edx, [ebp - 0x10c]
push edx
sub eax, esi
push eax
lea eax, [ebp - 0x108]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1084a16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x10252e8
call fcn.01071ac0
add esp, 0xc
jmp 0x1084a28
push dword [0x1099ea8]
call fcn.01084847
call fcn.0108449a
mov edi, eax
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0106bc50
leave
ret 4