joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f09b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0100ab2e
xor ebx, ebx
cmp dword [0x1029f1c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x100f172
push 0x1003744
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x100f0dd
xor eax, eax
jmp 0x100f236
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003738
push edi
call esi
cmp eax, ebx
je 0x100f0d6
push eax
call fcn.0100aac3
mov dword [esp], 0x1003728
push edi
mov dword [0x1029f1c], eax
call esi
push eax
call fcn.0100aac3
mov dword [esp], 0x1003714
push edi
mov dword [0x1029f20], eax
call esi
push eax
call fcn.0100aac3
mov dword [0x1029f24], eax
lea eax, [ebp - 8]
push eax
call fcn.01009927
test eax, eax
pop ecx
pop ecx
je 0x100f140
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100c30c
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x100f172
push 0x10036f8
push edi
call esi
push eax
call fcn.0100aac3
cmp eax, ebx
pop ecx
mov dword [0x1029f2c], eax
je 0x100f172
push 0x10036e0
push edi
call esi
push eax
call fcn.0100aac3
pop ecx
mov dword [0x1029f28], eax
mov eax, dword [0x1029f28]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x100f1eb
cmp dword [0x1029f2c], esi
je 0x100f1eb
push eax
call fcn.0100ab3c
pop ecx
call eax
cmp eax, ebx
je 0x100f1b8
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1029f2c]
call fcn.0100ab3c
pop ecx
call eax
test eax, eax
je 0x100f1b8
test byte [ebp - 0x18], 1
jne 0x100f1eb
lea eax, [ebp - 0xc]
push eax
call fcn.01009968
test eax, eax
pop ecx
je 0x100f1d3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100c30c
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x100f1e2
or dword [ebp + 0x10], 0x200000
jmp 0x100f21c
or dword [ebp + 0x10], 0x40000
jmp 0x100f21c
mov eax, dword [0x1029f20]
cmp eax, esi
je 0x100f21c
push eax
call fcn.0100ab3c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100f21c
mov eax, dword [0x1029f24]
cmp eax, esi
je 0x100f21c
push dword [ebp - 4]
push eax
call fcn.0100ab3c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1029f1c]
call fcn.0100ab3c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101481f
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.01009927
test eax, eax
pop ecx
je 0x1014854
push edi
push edi
push edi
push edi
push edi
call fcn.0100c30c
add esp, 0x14
push 4
pop eax
call fcn.01014c90
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1014962
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x10148db
push 0x10036c4
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x10148db
push 0x1004818
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10148db
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x10148db
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x10148db
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.010147f3
add esp, 0xc
test eax, eax
jl 0x1014962
not edi
and dword [ebp - 8], edi
je 0x101490d
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.010147f3
add esp, 0xc
test eax, eax
jl 0x1014962
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x1014918
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x101492c
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x1014962
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1014962
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1014962
xor eax, eax
inc eax
jmp 0x1014964
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01008e04
leave
ret
Function at 0x1015770
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push 0x208
push edi
mov esi, 0x102a058
push esi
mov dword [0x102a260], edi
mov dword [0x102a264], edi
call fcn.01008e20
mov eax, dword [ebp + 8]
add esp, 0xc
cmp eax, edi
je 0x1015816
cmp word [eax], di
je 0x1015816
push eax
push 0x104
push esi
call fcn.010055fd
test eax, eax
jne 0x1015816
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x10048dc
push 0x80000001
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1015816
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x1015816
cmp dword [ebp - 4], edi
je 0x1015816
xor eax, eax
inc eax
mov dword [0x102a260], eax
jmp 0x1015818
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10169da
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ecx
push edi
lea edi, [eax + 8]
mov ecx, edi
call fcn.01015883
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1016a3c
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov ecx, edi
jne 0x1016a30
push 0x1004910
call fcn.01015cf8
jmp 0x1016a3c
lea eax, [ebp - 0x414]
push eax
call fcn.01015dd4
and dword [ebp - 0x418], 0
mov esi, 0x1004918
push esi
push ebx
call fcn.010206b9
test eax, eax
pop ecx
pop ecx
je 0x1016a5f
push eax
call fcn.01014b23
pop ecx
push ebx
jmp 0x1016aa4
push ebx
push dword [edi]
lea eax, [ebp - 0x20c]
push 0x1002520
push 0x104
push eax
call fcn.01005678
add esp, 0x14
test eax, eax
je 0x1016a83
xor eax, eax
jmp 0x1016ab6
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.010206b9
test eax, eax
pop ecx
pop ecx
je 0x1016ab0
push eax
call fcn.01014b23
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret 4
Function at 0x1016e48
Capabilities:
Get common file path

Disassembly:
push 0x63c
mov eax, 0x1025aac
call fcn.0100961d
xor esi, esi
mov edi, 0x208
push edi
lea eax, [ebp - 0x420]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x62c], esi
call fcn.01008e20
push edi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.01008e20
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push 0
mov ecx, ebx
call fcn.0101a1f8
cmp eax, 0xffffffff
je 0x1017056
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
mov ecx, ebx
call fcn.01016acc
lea eax, [ebp - 0x420]
push eax
push 0x10049ec
call fcn.010090ef
test eax, eax
pop ecx
pop ecx
jne 0x1016ef7
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x30]
call fcn.01015cf8
mov dword [ebp - 0x634], 1
inc dword [ebp - 0x62c]
push edi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.01008e20
push edi
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.01008e20
add esp, 0x18
push esi
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x62c]
mov ecx, ebx
call fcn.0101a1f8
cmp eax, 0xffffffff
jne 0x1016eb2
cmp dword [ebp - 0x634], 1
jne 0x1017056
xor edi, edi
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x630], edi
call fcn.010185d9
push edi
lea eax, [ebp - 0x630]
lea ecx, [ebx + 0x30]
push eax
mov dword [ebp - 4], edi
call fcn.01015883
push eax
lea ecx, [ebp - 0x648]
call fcn.010186d5
test eax, eax
jne 0x1017021
lea eax, [ebp - 0x628]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
lea edi, [ebx + 8]
mov ecx, edi
jne 0x1016fa9
push 0x1004910
jmp 0x1016fb0
lea eax, [ebp - 0x628]
push eax
call fcn.01015cf8
lea ecx, [ebx + 0x30]
call fcn.01015883
push eax
mov ecx, edi
call fcn.01015883
push eax
push 0x1002520
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.01005678
add esp, 0x14
test eax, eax
lea ecx, [ebp - 0x648]
je 0x1016ff2
or dword [ebp - 4], 0xffffffff
call fcn.010186be
xor eax, eax
jmp 0x1017067
push 0
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.010186d5
test eax, eax
jne 0x1017021
lea eax, [ebp - 0x628]
push eax
mov ecx, ebx
call fcn.010169da
lea ecx, [ebp - 0x648]
jmp 0x1016fe5
push dword [ebp - 0x630]
lea ecx, [ebx + 4]
call fcn.01015cf8
mov ecx, ebx
call fcn.01016e48
cmp dword [ebx + 0x44], 0
jne 0x1017047
lea ecx, [ebp - 0x648]
call fcn.01018616
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.010186be
mov ecx, ebx
call fcn.01016673
mov ecx, ebx
call fcn.0101676d
xor eax, eax
inc eax
call fcn.010096af
ret
Function at 0x101717a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [0x102a270], edi
je 0x10171a6
xor eax, eax
inc eax
jmp 0x101722b
push esi
mov esi, 0x114
push esi
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.01008e20
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1017228
cmp dword [ebp - 0x108], 2
jne 0x1017228
cmp dword [ebp - 0x114], 5
jb 0x1017228
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
xor eax, eax
cmp esi, edi
jne 0x10171f8
push ebx
call fcn.0101aced
cmp esi, 2
jne 0x1017203
push ebx
call fcn.0101ad30
cmp esi, 3
jne 0x101720e
push ebx
call fcn.0101ad73
cmp esi, 4
jne 0x1017219
push ebx
call fcn.0101adb6
test eax, eax
je 0x1017225
mov dword [0x102a270], edi
jmp 0x1017228
or edi, 0xffffffff
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret

Function at 0x1018374
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x620], esi
call fcn.01008e20
push esi
push edi
push ebx
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0101816d
add esp, 0x20
test eax, eax
je 0x101846d
cmp word [ebp - 0x20c], 0
je 0x101846d
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x10013a4
push 0x1004c40
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x101846d
cmp eax, 0x206
je 0x101846d
push dword [ebp - 0x620]
lea eax, [ebp - 0x414]
push edi
push ebx
push esi
push eax
call fcn.01017f41
add esp, 0x14
test eax, eax
jne 0x1018442
push 0x1004c3c
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.010055fd
test eax, eax
jne 0x101846d
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x1002520
push dword [ebp + 0xc]
push dword [ebp - 0x624]
call fcn.01005678
add esp, 0x14
neg eax
sbb eax, eax
inc eax
jmp 0x101846f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret
Function at 0x10186d5
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x44
mov eax, 0x1025d1e
call fcn.010095e2
mov esi, ecx
mov dword [ebp - 0x28], esi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x10186f4
xor eax, eax
jmp 0x10188af
call fcn.010185f1
mov ecx, esi
call fcn.0101867e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1018719
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
sub eax, ecx
sar eax, 1
lea edi, [eax + eax + 2]
push edi
push 0x40
mov dword [ebp - 0x4c], eax
call ebx
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x1018751
and dword [ebp - 0x30], eax
push 0x1025f40
lea eax, [ebp - 0x30]
push eax
call fcn.010096d7
push dword [ebp + 8]
shr edi, 1
push edi
push eax
call fcn.010055fd
test eax, eax
je 0x101876f
and dword [ebp - 0x34], 0
push 0x1025f40
lea eax, [ebp - 0x34]
jmp 0x101874b
xor edi, edi
push edi
push 0x100
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x101879f
mov dword [ebp - 0x38], edi
push 0x1025f40
lea eax, [ebp - 0x38]
jmp 0x101874b
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x10187bc
mov dword [ebp - 0x3c], edi
push 0x1025f40
lea eax, [ebp - 0x3c]
jmp 0x101874b
lea edi, [eax + 2]
push edi
push 0x40
mov dword [ebp - 0x2c], edi
call ebx
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x18], ebx
jne 0x10187e2
mov dword [ebp - 0x40], eax
push 0x1025f40
lea eax, [ebp - 0x40]
jmp 0x101874b
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101880b
and dword [ebp - 0x44], eax
push 0x1025f40
lea eax, [ebp - 0x44]
jmp 0x101874b
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x24], eax
je 0x1018873
and dword [ebp - 0x48], 0
push 0x1025f40
lea eax, [ebp - 0x48]
jmp 0x101874b
cmp dword [ebp - 0x20], 1
jne 0x10188ac
mov eax, dword [ebp - 0x14]
mov ecx, esi
mov dword [esi], eax
call fcn.010185f1
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], edi
je 0x10188a0
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10188ac
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
call fcn.01009696
ret 0xc
Function at 0x10188bc
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.010185f1
mov ecx, dword [ebp - 8]
call fcn.0101867e
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
test ebx, ebx
je 0x101892e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebx + ebx]
push eax
push 8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x101892e
push eax
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1018935
push dword [ebp - 0xc]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
and dword [ebp - 0x10], 0
lea eax, [ebx + ebx + 0x208]
push eax
push 8
call esi
push eax
call edi
mov edi, dword [ebp - 8]
xor ebx, ebx
cmp eax, ebx
mov dword [edi + 8], eax
je 0x101898b
push eax
push ebx
push 0x1004908
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x101898b
mov eax, dword [edi + 8]
cmp word [eax], bx
je 0x101898b
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1018973
sub eax, edx
sar eax, 1
mov dword [edi + 4], eax
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x10], ebx
jne 0x10189a4
mov ecx, edi
call fcn.0101867e
mov eax, dword [ebp - 0x10]
jmp 0x1018930

Function at 0x10189ae
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
je 0x10189f3
cmp dword [ebp + 0xc], ebx
jbe 0x10189f3
cmp dword [ebp + 0x10], ebx
je 0x10189f3
call fcn.010188bc
test eax, eax
je 0x10189f3
push ebx
push 0x100
push 2
push ebx
push 1
push 0x40000000
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x10189fb
mov dword [esi], ebx
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
jne 0x1018a1a
mov ecx, esi
call fcn.01018616
mov ecx, esi
call fcn.010185f1
mov eax, edi
pop edi
jmp 0x10189f5
Function at 0x1018cc7
Capabilities:
Check os version
Get common file path

Disassembly:
push 0x340
mov eax, 0x1025e30
call fcn.0100961d
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, eax
push eax
push 0
push ebx
mov edi, ecx
call fcn.01008e20
push 0x114
lea eax, [ebp - 0x32c]
push 0
push eax
call fcn.01008e20
add esp, 0x18
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x32c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x31c], 2
jne 0x1018d2e
cmp dword [ebp - 0x328], 5
jb 0x1018d2e
cmp dword [edi + 4], 4
je 0x1018d3d
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1018ebb
push dword [edi + 8]
lea eax, [ebp - 0x218]
push 0x100252c
push 0x1002520
push 0x104
push eax
call fcn.01005678
add esp, 0x14
test eax, eax
jne 0x1018ebb
lea ecx, [ebp - 0x33c]
call fcn.01015b06
and dword [ebp - 4], 0
lea ecx, [ebp - 0x334]
call fcn.01015b06
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.01015b06
add edi, 0xc
push edi
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 2
call fcn.01015c9e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x334]
call fcn.01015cf8
push 0x1004bd0
lea ecx, [ebp - 0x338]
call fcn.01015cf8
lea ecx, [ebp - 0x340]
call fcn.0101d027
push ecx
lea eax, [ebp - 0x338]
mov ecx, esp
mov dword [ebp - 0x344], esp
push eax
mov byte [ebp - 4], 3
call fcn.010162d3
push ecx
lea eax, [ebp - 0x334]
mov ecx, esp
mov dword [ebp - 0x34c], esp
push eax
mov byte [ebp - 4], 4
call fcn.010162d3
push ecx
lea eax, [ebp - 0x33c]
mov ecx, esp
mov dword [ebp - 0x348], esp
push eax
mov byte [ebp - 4], 5
call fcn.010162d3
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 3
call fcn.0101d041
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 6
call fcn.01015883
push eax
push 0x1004d30
call fcn.010155fa
pop ecx
pop ecx
lea ecx, [ebp - 0x330]
call fcn.01015871
test eax, eax
jne 0x1018e70
lea ecx, [ebp - 0x330]
call fcn.01015883
push eax
push dword [ebp + 0xc]
push ebx
call fcn.010055fd
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 3
call fcn.010159a8
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 2
call fcn.0101d035
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.010159a8
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 0
call fcn.010159a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.010159a8
call fcn.010096af
ret 8
Function at 0x1019102
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x438], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x428], 0x1004e98
jne 0x1019145
mov dword [ebp - 0x428], 0x1004e48
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
mov dword [ebp - 0x418], esi
push 0x80000001
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1019187
push 4
pop eax
jmp 0x10192c1
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x440]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x418]
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x41c], 0x104
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x1019297
cmp dword [ebp - 0x424], 0x103
je 0x10192ae
lea eax, [ebp - 0x420]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1019261
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push 0x1004e38
push dword [ebp - 0x420]
mov dword [ebp - 0x430], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x420]
mov dword [ebp - 0x424], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x424], esi
mov dword [ebp - 0x420], esi
jne 0x1019261
push dword [ebp - 0x438]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10192ce
inc dword [ebp - 0x42c]
lea eax, [ebp - 0x440]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x42c]
mov dword [ebp - 0x41c], 0x104
push dword [ebp - 0x418]
call edi
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x10191cb
xor esi, esi
inc esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01008e04
leave
ret
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x428]
push 0x1004be8
push dword [ebp + 0x14]
push dword [ebp - 0x434]
call fcn.01005678
add esp, 0x14
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x10192b1