joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1058aac
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.010571af
cmp eax, 6
jne 0x1058acf
push 0x10024d0
push 2
call fcn.0105e573
jmp 0x1058bd8
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x1058bd6
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], esi
jle 0x1058b0c
mov eax, dword [edi + esi*4]
test eax, eax
je 0x1058b04
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1058af0
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2 + 2]
jmp 0x1058b06
inc ebx
inc ebx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x1058ae6
inc ebx
inc ebx
push ebx
mov dword [ebp - 0xc], ebx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
xor eax, eax
cmp esi, eax
pop ecx
je 0x1058bd5
cmp dword [ebp + 0xc], eax
mov dword [ebp - 4], eax
jle 0x1058b7a
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [ecx + edx*4]
xor edi, edi
test edx, edx
je 0x1058b65
mov ecx, edx
lea ebx, [ecx + 2]
mov dword [ebp - 8], ebx
mov bx, word [ecx]
inc ecx
inc ecx
test bx, bx
jne 0x1058b43
sub ecx, dword [ebp - 8]
sar ecx, 1
add ecx, ecx
mov bl, byte [edx + edi]
mov byte [eax + esi], bl
inc eax
inc edi
cmp edi, ecx
jbe 0x1058b54
mov ebx, dword [ebp - 0xc]
jmp 0x1058b6a
mov byte [eax + esi], 0
inc eax
mov byte [eax + esi], 0
inc eax
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jl 0x1058b2c
lea ecx, [eax + 1]
cmp ebx, ecx
jbe 0x1058bce
add eax, esi
cmp ebx, 0xffffffff
mov byte [eax], 0
mov byte [eax + 1], 0
ja 0x1058bce
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0x2001f
push 0
push 0x100a1a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1058bce
push ebx
push esi
push 7
push eax
push 0x100a168
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1058d03
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebx
push edi
push 0x144
push 0
push esi
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [esi], 0
add esp, 0xc
push 0x32
lea eax, [esi + 0xe0]
push eax
push 0x1010
mov ebx, 0x400
push ebx
call edi
lea eax, [esi + 0xe0]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0x32
mov dword [esi + 0x14], eax
lea eax, [esi + 0xe0]
and word [eax], 0
push eax
push 0x12
push ebx
call edi
lea eax, [esi + 0xe0]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0x32
mov dword [esi + 4], eax
lea eax, [esi + 0x18]
push eax
push 0xe
push ebx
call edi
lea eax, [esi + 0x18]
push 0x32
mov dword [esi + 0xc], eax
lea eax, [esi + 0x7c]
push eax
push 0xf
push ebx
call edi
lea eax, [esi + 0x7c]
push 0x32
mov dword [esi + 0x10], eax
lea eax, [esi + 0xe0]
and word [eax], 0
push eax
push 0x10
push ebx
call edi
lea edi, [esi + 0xe0]
movzx eax, word [edi]
test ax, ax
je 0x1058ddc
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
cmp ax, 0x30
je 0x1058ddc
mov eax, dword [esi + 8]
imul eax, eax, 0xa
push edi
mov dword [esi + 8], eax
call dword [sym.imp.msvcrt.dll__wtoi]
add dword [esi + 8], eax
pop ecx
push edi
call ebx
push eax
call ebx
mov edi, eax
movzx eax, word [edi]
test ax, ax
jne 0x1058db2
pop edi
pop ebx
ret

Function at 0x1059579
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x105959c
xor edx, edx
jmp 0x105968b
push esi
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x10595cd
xor edx, edx
jmp 0x105968a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
inc esi
lea eax, [ebp - 0x20c]
inc esi
and word [esi], 0
push eax
call edi
test eax, eax
jne 0x105962d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x105960b
push 0x57
pop eax
test eax, eax
jle 0x1059617
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x100a2bc
push 2
call fcn.0105e5ad
add esp, 0xc
xor eax, eax
xor edx, edx
jmp 0x1059689
mov eax, dword [ebp - 0x210]
push ebx
mov ebx, dword [ebp - 0x214]
test ebx, ebx
mov dword [ebp - 0x218], eax
jne 0x1059680
test eax, eax
jne 0x1059680
and word [esi - 2], ax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x1059680
mov eax, dword [ebp - 0x210]
mov ebx, dword [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01047417
leave
ret 4
Function at 0x105970f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
test eax, eax
je 0x105976d
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x105976d
push 0x5c
lea eax, [ebp - 0x20c]
push eax
call fcn.01056c1a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x105976b
test al, 0x10
je 0x105976b
inc esi
jmp 0x105976d
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 4

Function at 0x1059783
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1059791
sub eax, edx
push esi
push edi
sar eax, 1
lea edi, [eax + 0x14]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0xc], edi
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
test esi, esi
pop ecx
je 0x105988b
push ebx
push dword [ebp + 8]
push edi
push esi
call fcn.01034c79
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x1007e44
push esi
call edi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x1059883
add ebx, 4
and dword [ebp - 4], 0
push 0x1005928
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x105987a
and word [eax], 0
push esi
lea ebx, [eax + 2]
call fcn.0105970f
test eax, eax
jne 0x1059850
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x105982a
push 0x57
pop eax
test eax, eax
jle 0x1059836
and eax, 0xffff
or eax, 0x80070000
push esi
mov dword [ebp - 8], eax
call fcn.0105970f
test eax, eax
je 0x1059867
push 0
push esi
push 5
push 8
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp + 8]
push dword [ebp - 0xc]
push esi
call fcn.01034c79
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x10597f4
jmp 0x105987a
push dword [ebp - 8]
push esi
push 0x100a2e8
push 2
call fcn.0105e5ad
add esp, 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop ebx
push dword [ebp + 8]
call fcn.0105970f
pop edi
pop esi
leave
ret 4
Function at 0x105989e
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x320]
push eax
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1059a15
cmp dword [ebp - 0x310], 2
jne 0x1059a13
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp + 8]
je 0x10598fe
jbe 0x1059a13
xor esi, esi
inc esi
jmp 0x1059a13
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp + 0xc]
jne 0x10598f0
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
inc esi
cmp edi, ebx
jbe 0x1059a12
lea eax, [ebp - 0x32c]
push eax
push esi
push ebx
push 0x1009ab8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10599af
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x324]
push eax
push ebx
push 0x1009a8c
push dword [ebp - 0x32c]
mov dword [ebp - 0x324], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1059997
cmp dword [ebp - 0x324], esi
jne 0x1059997
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
cmp eax, edi
sbb esi, esi
pop ecx
mov dword [ebp - 0x328], eax
inc esi
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x328], edi
ja 0x1059a12
cmp esi, ebx
je 0x1059a12
cmp dword [ebp + 0x14], ebx
je 0x1059a12
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1059a12
push 0x100a324
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034cee
test eax, eax
jl 0x1059a12
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x324], ebx
call fcn.010577fc
test eax, eax
jl 0x1059a12
movzx eax, word [ebp - 0x324]
cmp eax, dword [ebp + 0x14]
sbb esi, esi
inc esi
pop edi
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 0x10
Function at 0x105a267
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], ebx
je 0x105a384
lea eax, [ebp - 0x214]
push eax
push 0x20019
push ebx
push 0x1009c40
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105a384
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x1009c28
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
call esi
test eax, eax
jne 0x105a376
cmp dword [ebp - 0x210], edi
jne 0x105a376
xor edi, edi
inc edi
cmp dword [ebp - 0x21c], edi
jne 0x105a376
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x1002378
push dword [ebp - 0x214]
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], 0x104
call esi
test eax, eax
jne 0x105a376
cmp dword [ebp - 0x210], edi
jne 0x105a376
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x224]
call fcn.01034c79
test eax, eax
jl 0x105a376
mov dword [ebp - 0x220], edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 8
Function at 0x105a865
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x105a881
mov eax, 0x80004003
jmp 0x105aa47
push 0x14
pop eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 8], eax
jne 0x105a8aa
mov eax, 0x8007000e
jmp 0x105aa47
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x10026d8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105a92e
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x105a925
mov edi, 0x104
push edi
push ebx
call fcn.010590be
test eax, eax
je 0x105a91e
push 0x100a664
push edi
push ebx
call fcn.01034cee
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105a8f9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x100a644
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 4]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x100a5d0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x105a9eb
push dword [0x10820c0]
mov ebx, 0x1007d40
push ebx
push 0x14
push dword [ebp - 8]
call fcn.01034d76
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x105a994
cmp dword [0x10820c0], 0x3e8
jge 0x105a9a7
inc dword [0x10820c0]
push dword [0x10820c0]
push ebx
push 0x14
push dword [ebp - 8]
call fcn.01034d76
add esp, 0x10
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call edi
test eax, eax
je 0x105a971
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105a9ad
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 2
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
jne 0x105a9de
inc dword [0x10820c0]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x105aa0e
jle 0x105a9f9
and edi, 0xffff
or edi, 0x80070000
push edi
push dword [ebp + 8]
push 0x100a58c
push 2
call fcn.0105e5ad
add esp, 0x10
jmp 0x105aa3a
push dword [ebp + 8]
push 0x100a550
push 4
call fcn.0105e5ad
add esp, 0xc
cmp dword [ebp + 0x10], esi
je 0x105aa35
push esi
push dword [ebp + 8]
mov ecx, 0x10820c8
push 8
call fcn.01059acf
mov edi, 0xd2af9
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x105aa51
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x105ab42
cmp dword [ebp + 0xc], ebx
je 0x105ab42
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov edi, 0x10026d8
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
je 0x105aaa4
lea eax, [ebp - 4]
push eax
push 3
push ebx
push edi
push SysReAllocString
call esi
mov esi, eax
cmp esi, ebx
jne 0x105ab01
push dword [ebp + 0xc]
push 0x100a6e4
push dword [ebp - 4]
call fcn.01058426
mov edi, eax
cmp edi, ebx
je 0x105aaef
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x105aac0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x105aaf4
mov esi, 0x80004005
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x105ab24
jle 0x105ab0f
and esi, 0xffff
or esi, 0x80070000
push esi
push dword [ebp + 8]
push 0x100a6a0
push 2
call fcn.0105e5ad
add esp, 0x10
jmp 0x105ab3c
push 0x100a678
push 4
call fcn.0105e573
or dword [0x10821d0], 1
mov esi, 0xd2af9
pop edi
mov eax, esi
pop esi
jmp 0x105ab47
mov eax, 0x80004003
pop ebx
leave
ret 8
Function at 0x105b2ea
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x105b323
xor eax, eax
jmp 0x105b473
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105b329
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jbe 0x105b345
mov eax, dword [ebp - 8]
inc dword [ebp - 0x14]
add eax, 5
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x18], eax
jne 0x105b374
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x105b31c
push ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov edi, 0x2001f
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x10051ac
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call fcn.01034d76
add esp, 0x14
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105b448
cmp dword [ebp + 0x10], esi
je 0x105b422
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x105b422
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105b41b
cmp dword [ebp - 0x1c], 1
jne 0x105b41b
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105b3fb
sub eax, edx
sar eax, 1
je 0x105b41b
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x105b43f
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
mov dword [ebp - 4], esi
jbe 0x105b381
jmp 0x105b465
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x105b465
push esi
lea eax, [ebp - 4]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x105b465
mov dword [ebp - 4], esi
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x105b47d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x105b4b6
xor eax, eax
jmp 0x105b5cb
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105b4bc
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jbe 0x105b4d8
mov eax, dword [ebp - 4]
push ebx
add eax, 5
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
jne 0x105b501
xor eax, eax
jmp 0x105b5ca
cmp dword [ebp - 0x14], esi
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
jbe 0x105b5be
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push 0x10051ac
push dword [ebp - 8]
push ebx
call fcn.01034d76
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 3
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105b5af
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
cmp edi, esi
pop ecx
je 0x105b5a6
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105b59f
cmp dword [ebp - 0x18], 1
jne 0x105b59f
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105b57f
sub eax, edx
sar eax, 1
je 0x105b59f
push dword [ebp + 0x10]
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x105b5d0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0x105b511
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
xor ebx, ebx
pop ecx
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret 0xc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
jmp 0x105b5c6
Function at 0x105b8c4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x105b973
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x105b972
push 0x1002aec
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034cee
test eax, eax
jl 0x105b972
and dword [ebp - 0x214], ebx
and dword [ebp - 0x210], ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010577fc
test eax, eax
jl 0x105b972
mov eax, dword [ebp - 0x214]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x210]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x1007e14
push dword [ebp + 0xc]
push esi
call fcn.01034d76
add esp, 0x1c
test eax, eax
jl 0x105b972
inc ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 8

Function at 0x105bbd0
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x100ac68
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105bcb4
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0x100ac2c
push dword [ebp - 0x420]
xor esi, esi
inc esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105bca7
cmp dword [ebp - 0x424], esi
jne 0x105bca7
push esi
push 0x100ac1c
lea eax, [ebp - 0x41c]
push eax
push 0x100ac04
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.01034d76
add esp, 0x18
test eax, eax
jl 0x105bca1
lea eax, [ebp - 0x210]
push eax
call fcn.01056f43
test eax, eax
je 0x105bca1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x10
jl 0x105bc5a
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01047417
leave
ret