joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f4ed
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x200
lea eax, [ebp - 0x20c]
mov dword [ebp - 8], eax
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6e20
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e2c
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e34
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
call fcn.10005ffa
add esp, 4
test eax, eax
je 0x1000f56b
xor eax, eax
jmp 0x1000f60c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x1000f5a9
cmp dword [ebp - 0xc], 3
je 0x1000f5a9
cmp dword [ebp - 0xc], 5
jne 0x1000f59f
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f60c
mov eax, dword [ebp + 8]
push eax
call fcn.1001bd20
add esp, 4
test eax, eax
je 0x1000f605
mov eax, dword [ebp + 8]
push eax
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x1000f605
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x1000f605
cmp dword [ebp - 0xc], 5
jne 0x1000f5fb
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f60c
xor eax, eax
jmp 0x1000f60c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000f611
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6e3c
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e40
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e48
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x1000f6a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x1000f6a9
cmp dword [ebp - 4], 5
jne 0x1000f69f
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f6b0
xor eax, eax
jmp 0x1000f6b0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000f6b5
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6e50
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e54
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x1000f73b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x1000f73b
cmp dword [ebp - 4], 5
jne 0x1000f731
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f742
xor eax, eax
jmp 0x1000f742
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f747
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x200
lea eax, [ebp - 0x20c]
mov dword [ebp - 8], eax
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Drivers_
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e6c
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
call fcn.10005ffa
add esp, 4
test eax, eax
je 0x1000f7b3
xor eax, eax
jmp 0x1000f854
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x1000f7f1
cmp dword [ebp - 0xc], 3
je 0x1000f7f1
cmp dword [ebp - 0xc], 5
jne 0x1000f7e7
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f854
mov eax, dword [ebp + 8]
push eax
call fcn.1001bd20
add esp, 4
test eax, eax
je 0x1000f84d
mov eax, dword [ebp + 8]
push eax
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x1000f84d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x1000f84d
cmp dword [ebp - 0xc], 5
jne 0x1000f843
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f854
xor eax, eax
jmp 0x1000f854
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000f859
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6e7c
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6e80
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x1000f8df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x1000f8df
cmp dword [ebp - 4], 5
jne 0x1000f8d5
push 0x4000b
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f8e6
xor eax, eax
jmp 0x1000f8e6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100107e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d7024
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d7028
push 0x101434e0
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x100108e2
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d7034
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc40
add esp, 8
push str.haspdos.sys
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x100108e2
push 0
push 0x101434e0
lea eax, [ebp - 0x34c]
push eax
call fcn.10006020
add esp, 0xc
test eax, eax
jne 0x100108ce
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100109b7
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100109b7
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10142a58], eax
cmp dword [0x10142a58], 0xffffffff
jne 0x10010928
push 0x40003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100109b7
push 0
lea eax, [ebp - 4]
push eax
push 0x17f
push 0x100d6038
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010974
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100109b7
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100109b0
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100109b7
xor eax, eax
jmp 0x100109b7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010c03
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d7064
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d7070
push 0x101434e0
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x10010cf1
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d707c
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x10010cf1
push 0
push 0x101434e0
lea eax, [ebp - 0x34c]
push eax
call fcn.10006020
add esp, 0xc
test eax, eax
jne 0x10010cdd
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10010dc7
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x10010dc7
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10142a58], eax
cmp dword [0x10142a58], 0xffffffff
jne 0x10010d37
push 0x40003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10010dc7
push 0
lea eax, [ebp - 4]
push eax
call fcn.10005f91
push eax
push 0x10034f68
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010d84
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10010dc7
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010dc0
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10010dc7
xor eax, eax
jmp 0x10010dc7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010dcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
test byte [ebp + 0xc], 1
je 0x10010f45
push 0x200
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d7088
lea eax, [ebp - 0x21c]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d708c
lea eax, [ebp - 0x21c]
push eax
call fcn.1001bc40
add esp, 8
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x10010eca
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100d7098
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10010eca
push str.GetVDDVersion
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10010ec0
call dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 8], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0xc0000000
push str..hasp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x10010f3c
push 0
lea eax, [ebp - 0x10]
push eax
push 8
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 8]
push eax
push 0x9c402800
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10010f2d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10010f45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
test byte [ebp + 0xc], 2
je 0x10010f7d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10019572
mov eax, dword [ebp - 0x220]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
push 0x200
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers
lea eax, [ebp - 0x21c]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d70cc
lea eax, [ebp - 0x21c]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x21c]
push eax
call fcn.1001739e
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0xffffffff
jne 0x10010fe3
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
xor eax, eax
jmp 0x10010fea
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010fef
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov dword [ebp - 4], 0x200
add byte [eax], al
push 0x100d70d8
mov eax, dword [ebp + 8]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d70dc
push 0x101436f0
call fcn.1001bc30
add esp, 8
cmp dword [ebp + 0xc], 2
jne 0x10011046
push 0x100d7100
push 0x101436f0
call fcn.1001bc40
add esp, 8
jmp 0x10011058
push 0x100d7108
push 0x101436f0
call fcn.1001bc40
add esp, 8
push 0x101436e8
push 0xf003f
push 0
push 0x101436f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x100110aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x100110a3
mov eax, 0xffffffff
jmp 0x10011250
xor eax, eax
jmp 0x10011250
push 0x100d7114
push 0x10143080
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x10011104
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x10011250
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1001112c
mov eax, 0xffffffff
jmp 0x10011250
push 0x100d7120
lea eax, [ebp - 0x208]
push eax
call fcn.1001bee0
add esp, 8
test eax, eax
je 0x100111b6
push str.SystemRoot_
call fcn.1001bd20
add esp, 4
lea eax, [ebp + eax - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc30
add esp, 8
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d7140
push 0x101434e0
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x208]
push eax
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d7144
lea eax, [ebp - 0x208]
push eax
call fcn.1001bee0
add esp, 8
test eax, eax
je 0x100111f6
push 0x100d714c
call fcn.1001bd20
add esp, 4
lea eax, [ebp + eax - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d7154
lea eax, [ebp - 0x208]
push eax
call fcn.1001bee0
add esp, 8
test eax, eax
je 0x10011236
push 0x100d7164
call fcn.1001bd20
add esp, 4
lea eax, [ebp + eax - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.1001bc30
add esp, 8
xor eax, eax
jmp 0x10011250
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011255
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push 0x101436f0
call fcn.1001bc30
add esp, 8
cmp dword [ebp + 8], 2
jne 0x10011291
push 0x100d7198
push 0x101436f0
call fcn.1001bc40
add esp, 8
jmp 0x100112a3
push 0x100d71a0
push 0x101436f0
call fcn.1001bc40
add esp, 8
push 0x101436e8
push 0x101436f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100112dc
push 0x10007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10011382
push 0x100d71ac
push 0x101436f0
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.1001bd20
add esp, 4
inc eax
push eax
mov eax, dword [ebp + 0xc]
push eax
push 2
push 0
push 0x101436f0
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001134b
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10011382
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001137b
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10011382
xor eax, eax
jmp 0x10011382
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100115fe
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d721c
lea eax, [ebp - 0x204]
push eax
call fcn.1001bc40
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x100116f2
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xffffffff
je 0x100116f2
push 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.10006020
add esp, 0xc
test eax, eax
jne 0x100116de
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, dword [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 0xffffffff
jmp 0x100117b2
mov eax, dword [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100117b2
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10142a58], eax
cmp dword [0x10142a58], 0xffffffff
jne 0x1001173a
push 0x40003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100117b2
push 0
lea eax, [ebp - 0x54c]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001177b
push 0x40004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100117b2
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100117ab
push 0x40005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100117b2
xor eax, eax
jmp 0x100117b2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100117b7
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [0x10034ed4], 0
je 0x10011856
push 0x200
push 0x101432e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str...inf
push 0x101432e0
call fcn.1001bc40
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x101432e0
call fcn.1001bc40
add esp, 8
push 0x101432e0
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x10011856
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x10011856
cmp dword [ebp - 4], 5
jne 0x1001183f
push 0x4000b
call fcn.100042e2
add esp, 4
push 0x200401d
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x1001185d
xor eax, eax
jmp 0x1001185d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011d08
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x2ac], 0
test byte [ebp + 8], 2
je 0x10011dc6
push 0x200
push 0x10142500
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10142500
lea eax, [ebp - 0x2a8]
push eax
call fcn.1001bc30
add esp, 8
push 0x100ff550
lea eax, [ebp - 0x2a8]
push eax
call fcn.1001bc40
add esp, 8
push 0x4000
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x10011d96
mov dword [ebp - 0x2ac], 1
test byte [ebp + 8], 1
jne 0x10011dc6
cmp dword [ebp - 0x2ac], 1
jne 0x10011dbc
mov dword [ebp - 0x98], 2
jmp 0x10011dc6
mov dword [ebp - 0x98], 0
test byte [ebp + 8], 1
je 0x10012007
push 0x10142704
push 0xf003f
push 0
push 0x100ff560
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10011e4d
cmp dword [0x101422e0], 2
je 0x10011e34
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012012
cmp dword [ebp - 0x2ac], 1
jne 0x10011e48
or dword [ebp - 0x98], 2
jmp 0x10012007
or dword [ebp - 0x98], 1
test byte [ebp + 8], 2
je 0x10011fc5
mov dword [ebp - 0xa8], 0xc
push str.version
push 0x101422a0
call fcn.1001bc30
add esp, 8
mov dword [ebp - 0x94], 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x101422a0
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10011ed2
push 0x100ff598
lea eax, [ebp - 0xa4]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0xa4]
push eax
push 0x1014b7c0
call fcn.1001bc30
add esp, 8
push 0x100ff5a0
lea eax, [ebp - 0xa4]
push eax
call fcn.1001bf60
add esp, 8
test eax, eax
jge 0x10011f1b
cmp dword [ebp - 0x2ac], 1
jne 0x10011f16
or dword [ebp - 0x98], 2
jmp 0x10011fc5
push 0x100ff5a8
lea eax, [ebp - 0xa4]
push eax
call fcn.1001bf60
add esp, 8
test eax, eax
jg 0x10011f43
or dword [ebp - 0x98], 2
jmp 0x10011fc5
or dword [ebp - 0x98], 1
push 0x100ff5b0
push 0x101422a0
call fcn.1001bc30
add esp, 8
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x90], 4
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x101422a0
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10011fb1
or dword [ebp - 0x98], 2
test byte [ebp - 0x8c], 2
je 0x10011fc5
or dword [ebp - 0x98], 2
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012007
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012012
mov eax, dword [ebp - 0x98]
jmp 0x10012012
pop edi
pop esi
pop ebx
leave
ret