joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100099b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1022b160
push fcn.101c8390
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x102519c8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x10009b41
lea eax, [ebp - 0x1c]
push eax
mov edi, dword [ebp + 8]
push edi
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
js 0x10009b2d
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
jmp 0x10009a57
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push dword [ebp - 0x1c]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.10009c50
test eax, eax
je 0x10009b41
cmp edi, 0x26
je 0x10009ac7
cmp edi, 0x2b
je 0x10009ac7
cmp edi, 0x25
jne 0x10009b41
push 0x10202ca4
push esi
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x10009b41
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], 3
push 0x10202cb8
jmp 0x10009aee
push str.__x86_
push esi
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x10009b41
xor ecx, ecx
mov word [eax], cx
add eax, 0xc
cmp word [eax], cx
je 0x10009b41
mov dword [ebp - 4], 2
push eax
push 0x104
push esi
call fcn.101e6de0
add esp, 0xc
test eax, eax
je 0x10009b24
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
jmp 0x10009b41
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10009b41
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009f90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push edi
mov edi, dword [ebp + 8]
push 0x410
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x207
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.10002490
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1000a410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x1000a428
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edi]
push ebx
add eax, eax
push esi
mov dword [ebp + 0x14], eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1000a447
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
mov ebx, dword [ebp + 0x10]
add esp, 4
test eax, eax
je 0x1000a46d
lea ecx, [ebp + 0x14]
push ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x1000a484
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 0x10], eax
test esi, esi
je 0x1000a492
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1000a4a8
pop esi
pop ebx
mov dword [edi], 0
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x1000a4c9
cmp eax, 2
je 0x1000a4c9
mov dword [edi], 0
pop esi
pop ebx
mov eax, 0xd
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
test ebx, ebx
je 0x1000a52d
test eax, eax
je 0x1000a519
test al, 1
je 0x1000a4dc
dec eax
mov dword [ebp + 0x14], eax
test eax, eax
je 0x1000a4bb
mov ecx, eax
shr ecx, 1
cmp word [ebx + ecx*2 - 2], 0
je 0x1000a530
cmp dword [edi], ecx
jbe 0x1000a50b
xor eax, eax
mov word [ebx + ecx*2], ax
mov eax, dword [ebp + 0x14]
add eax, 2
pop esi
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x10
pop esi
pop ebx
mov eax, 0xea
pop edi
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
shr eax, 1
pop esi
mov word [ebx], cx
mov dword [edi], eax
xor eax, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x10
add eax, 4
pop esi
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000aa00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000aa5d
push esi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1000aa23
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x1000aa36
call eax
jmp 0x1000aa3c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x1000aa49
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
cmp ebx, 0xffffffff
je 0x1000aa5d
test bl, 0x10
jne 0x1000aa5d
pop edi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1001ac50
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1804]
push edi
mov edi, dword [ebp + 0xc]
push 0x1000
push 0
push eax
call sub.msvcrt.dll_memset
push 0x800
push 0x10203f28
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.101ef1c0
push 0x800
push edi
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.101ef070
push 0x800
push 0x10203f30
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.101ef070
push 0x800
push edi
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.101ef070
add esp, 0x4c
lea eax, [ebp - 0x1804]
push 0x800
push str.vL
push 0x800
push eax
call fcn.101ef070
push 0x800
push esi
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.101ef070
push 0x800
push 0x10203f80
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.101ef070
add esp, 0x30
lea eax, [ebp - 0x1804]
push 0x14
push edi
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
cmp ebx, 6
jne 0x1001ae5c
push 0xc8
push 0x10203e30
push 0x1023c1a8
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x1001ae44
push 0x800
push eax
lea eax, [ebp - 0x804]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x180c], 1
lea eax, [ebp - 0x1808]
mov dword [ebp - 0x1808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x180c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001ae37
push str.360ver.dll
lea eax, [ebp - 0x804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001ae37
lea eax, [ebp - 0x804]
push eax
call fcn.101b1360
add esp, 4
test eax, eax
je 0x1001ae37
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1001ae37
push str.IsBetaVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x1001ae44
push 5
push 0
push 0
push 0x1023c340
jmp 0x1001ae4f
push 5
push 0
push 0
push 0x1023c1a8
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0x10], 0
jne 0x1001ae75
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push 0
call fcn.101ef5b0
int3
Function at 0x1001b940
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x1001b9e5
mov edx, esi
lea ecx, [edx + 2]
jmp 0x1001b970
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001b970
sub edx, ecx
sar edx, 1
je 0x1001b9e5
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001b9b0
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001b9b0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001b990
jmp 0x1001b9b4
test edx, edx
jne 0x1001b9b7
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
push 2
push 1
push ebx
call fcn.1001cae0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1001b9bc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001ba20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x210], eax
push edi
mov edi, ecx
test esi, esi
jne 0x1001ba80
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1001babc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001bab0
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001bab0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001ba90
jmp 0x1001bab4
test edx, edx
jne 0x1001bab7
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push dword [ebp - 0x210]
lea eax, [ebp - 0x208]
mov ecx, edi
push dword [ebp + 0x10]
push eax
push 1
push ebx
call fcn.1001c8b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001c150
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xa10], ecx
mov ecx, edi
push eax
call fcn.1001c7e0
mov ebx, eax
test ebx, ebx
je 0x1001c287
push 0x202
lea eax, [ebp - 0x208]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x800
lea eax, [ebp - 0xa08]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0x10]
add esp, 0x18
test esi, esi
je 0x1001c216
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x1001c1c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c1c0
sub ecx, edx
sar ecx, 1
je 0x1001c216
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001c208
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001c208
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001c1e0
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001c238
test edx, edx
jne 0x1001c20f
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001c238
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa0c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1001c287
push dword [ebp - 0xa10]
lea eax, [ebp - 0xa08]
push ebx
push 0x102040c0
push 0x400
push eax
call fcn.1000aa70
add esp, 0x14
lea eax, [ebp - 0x208]
mov ecx, edi
push dword [ebp + 0x14]
push eax
push 3
push 4
lea eax, [ebp - 0xa08]
push eax
call fcn.1001cae0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001c5f0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xa10], ecx
mov ecx, edi
push eax
call fcn.1001c7e0
mov ebx, eax
test ebx, ebx
je 0x1001c722
push 0x202
lea eax, [ebp - 0x208]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x800
lea eax, [ebp - 0xa08]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0x10]
add esp, 0x18
test esi, esi
je 0x1001c6b6
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x1001c660
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c660
sub ecx, edx
sar ecx, 1
je 0x1001c6b6
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001c6a8
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001c6a8
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001c680
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001c6d8
test edx, edx
jne 0x1001c6af
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001c6d8
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa0c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1001c722
push dword [ebp - 0xa10]
lea eax, [ebp - 0xa08]
push ebx
push 0x102040c0
push 0x400
push eax
call fcn.1000aa70
add esp, 0x14
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
push 4
lea eax, [ebp - 0xa08]
push eax
call fcn.1001cc50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001cc50
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push 0x208
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea ecx, [ebp - 0x214]
xor ebx, ebx
push esi
call fcn.10002490
mov esi, dword [ebp - 0x214]
push str.TrustedInstaller
push esi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x1001cce1
push str.NT_SERVICETrustedInstaller
lea ecx, [ebp - 0x214]
call fcn.10008170
mov esi, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001cdda
push 1
push str.SeTakeOwnershipPrivilege
push dword [ebp - 0x210]
call fcn.1001c740
add esp, 0xc
test eax, eax
je 0x1001cdda
push 1
push str.SeRestorePrivilege
push dword [ebp - 0x210]
call fcn.1001c740
add esp, 0xc
test eax, eax
je 0x1001cdda
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1001cd6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001cdda
push edi
push dword [ebp - 0x218]
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
je 0x1001cdd9
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1001cdb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001cdd0
push 0
push 0
push 0
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
jne 0x1001cdd0
lea ebx, [eax + 1]
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 4
pop edi
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x1001cdeb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1001ce03
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10023d70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10023d8b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3d
call fcn.10003680
add esp, 4
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x10023db5
call eax
jmp 0x10023dbb
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test esi, esi
je 0x10023dc8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x20

Function at 0x10023dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10023deb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x10023e0f
call eax
jmp 0x10023e15
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x10023e22
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x10026170
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1025a784]
test eax, eax
jne 0x1002630b
lea ecx, [ebp - 0x115]
call fcn.10129b80
cmp dword [0x1025a784], 0
jne 0x100262fb
push esi
push 0x214
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x100261db
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100270a0
mov dword [esi], eax
mov byte [esi + 0x210], 0
jmp 0x100261dd
xor esi, esi
mov dword [0x1025a784], esi
cmp byte [esi + 0x210], 0
jne 0x100262fa
push edi
push 0
push 0x1a
lea edi, [esi + 8]
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100262f9
push 0x10204534
push 0x104
push edi
call fcn.10026a30
push edi
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x1002622d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10026248
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100262f9
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x10e]
push eax
movzx eax, word [ebp - 0x112]
push eax
movzx eax, word [ebp - 0x114]
push eax
push 0x10204558
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.1000aa70
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
push 0x104
push edi
call fcn.10026a30
push edi
call fcn.1000aa00
add esp, 4
test eax, eax
jne 0x100262eb
push eax
push 0x80
push 1
push eax
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100262f2
push eax
mov byte [esi + 0x210], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100262f2
mov byte [esi + 0x210], 1
mov ecx, esi
call fcn.10024000
pop edi
pop esi
lea ecx, [ebp - 0x115]
call fcn.10129ba0
mov eax, dword [0x1025a784]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x100263b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
mov edi, dword [ebp + 0x14]
or ebx, 0xffffffff
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
test edi, edi
je 0x100263d1
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
mov dword [ebp + 0x14], eax
test eax, eax
je 0x1002643b
push esi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100263f2
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
mov ecx, dword [ebp + 0x10]
add esp, 4
push edi
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push 0
push ecx
push dword [ebp + 0x14]
test eax, eax
je 0x10026416
call eax
jmp 0x1002641c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test esi, esi
je 0x10026429
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
test ebx, ebx
jne 0x10026438
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x10026466
test edi, edi
je 0x1002644c
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [ecx]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call fcn.10023dd0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002b7c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1002b93a
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x1002b93a
push edi
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, [ecx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002b939
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esi + 0x28], 8
lea eax, [esi + 0x14]
jb 0x1002b82c
mov eax, dword [eax]
push dword [esi + 0x2c]
push eax
push dword [esi + 0x10]
movzx eax, word [esi + 0xc]
push eax
movzx eax, word [esi + 0xa]
push eax
movzx eax, word [esi + 8]
push eax
movzx eax, word [esi + 6]
push eax
movzx eax, word [esi + 2]
push eax
movzx eax, word [esi]
push eax
push 0x10204674
push 0x10204678
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.1000aa70
lea ecx, [ebp - 0x204]
add esp, 0x34
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b877
sub ecx, edx
sar ecx, 1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x1002b8c3
push 0
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call ebx
push 0
lea eax, [ebp - 0x208]
push eax
push 4
push 0x102046f8
push edi
call ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, eax
je 0x1002b931
mov edi, edi
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
jb 0x1002b8db
mov edx, dword [edx]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x208], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b8e6
sub eax, dword [ebp - 0x208]
sar eax, 1
je 0x1002b928
push 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0
push ecx
add eax, eax
push eax
push edx
push edi
call ebx
push 0
lea eax, [ebp - 0x208]
push eax
push 4
push 0x102046f8
push edi
call ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [esi]
cmp esi, dword [eax]
jne 0x1002b8d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8