joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001fe7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov edi, edx
mov esi, ecx
mov eax, dword [0x101e2e94]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.101598f0
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
sub ecx, edi
push eax
push 0x20219
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x100020e4
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x24]
push edi
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100020e2
cmp dword [esp + 0xc], 3
mov ebx, 0
jb 0x100020e4
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.10002352
mov ecx, esi
call fcn.10002502
push 0x5c
push eax
call fcn.10159841
add esp, 8
test eax, eax
je 0x100020e2
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.10001e94
test al, al
je 0x100020e2
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100020d3
push edi
call fcn.10002352
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.100020fc
mov ebx, eax
jmp 0x100020e4
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.10157841
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100020fc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x1018a468]
cmp dword [ecx + eax], edx
ja 0x1000211a
jb 0x10002125
add eax, 4
cmp eax, 0x10
jne 0x10002105
push esi
call fcn.1000104a
add esp, 4
jmp 0x10002149
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_skipped_an_incompatible_version
call edi
mov ecx, esi
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x1018a0e6
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x10002a46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x101e2e94]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x10002ac1
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10002adb
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.10002b05
add esp, 8
test al, al
je 0x10002aeb
mov eax, dword [esi]
test eax, eax
je 0x10002b01
push 0xa
push 0
push eax
call fcn.1016103d
add esp, 0xc
cmp eax, 1
jmp 0x10002adf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157841
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10002b05
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x10002aed
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157841
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10002ae2

Function at 0x10002b05
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x101e2e94]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.101598f0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x10002b7c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.10002352
mov ecx, edi
call fcn.10002502
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157841
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002c24
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x101e2e94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10002c82
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002cf8
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x10189a44]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x10002d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x20]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.10002264
push edi
push 1
push 4
push ebx
call fcn.10002b98
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.10002502
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x1018a822
call ebx
mov ecx, edi
call fcn.10002278
jmp 0x10002d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x20]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.10002264
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.10002b98
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x1018a822
call eax
mov ecx, ebx
call fcn.10002278
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002d7e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157841
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10005370
Capabilities:
Get graphical window text

Disassembly:
push 0x228
mov eax, 0x10177b4d
call fcn.101584ae
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], esi
push 0x101bf6b6
mov dword [ebx], esi
call fcn.100043dd
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x21c]
push str.Chrome_WidgetWin_1
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x21c], esi
call fcn.100043dd
push esi
mov dword [ebp - 4], 1
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_FindWindowA]
jmp 0x10005506
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x100054fd
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100054fd
push 0x104
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.101598f0
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000542c
sub ecx, edx
je 0x100054fd
push 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.101598f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], esi
push eax
lea ecx, [ebp - 0x220]
call fcn.100043dd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
push dword [eax - 0xc]
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.100044bf
mov byte [ebp - 4], 3
mov ecx, eax
push dword [ebp - 0x21c]
call fcn.10004544
mov byte [ebp - 4], 2
mov esi, eax
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.10003b51
test esi, esi
jne 0x100054e9
push esi
push ecx
mov ecx, esp
mov byte [ebp - 0x221], 0x3b
push ecx
mov edx, edi
call fcn.10007c80
mov dl, byte [ebp - 0x221]
pop ecx
mov ecx, ebx
call fcn.1000785f
pop ecx
pop ecx
jmp 0x100054eb
xor esi, esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.10003b51
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x100053dd
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.10003b51
mov eax, ebx
call fcn.1015845d
ret 4
Function at 0x10006ae3
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
xor esi, esi
mov al, byte [edi]
test al, al
je 0x10006b89
push ebx
movsx eax, al
mov ebx, dword [eax*4 + 0x101bf918]
cmp ebx, 0xffffffff
je 0x10006b7d
mov eax, esi
sub eax, 0
je 0x10006b78
sub eax, 1
je 0x10006b58
sub eax, 1
je 0x10006b39
sub eax, 1
jne 0x10006b7b
cmp ecx, 0xdbba0
jge 0x10006b35
mov eax, dword [ebp + 0xc]
shl dl, 6
or dl, bl
mov byte [ecx + eax], dl
inc ecx
xor esi, esi
jmp 0x10006b7b
cmp ecx, 0xdbba0
jge 0x10006b54
mov eax, ebx
shl dl, 4
sar eax, 2
and al, 0xf
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 3
jmp 0x10006b75
cmp ecx, 0xdbba0
jge 0x10006b73
mov eax, ebx
shl dl, 2
sar eax, 4
and al, 3
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 2
pop esi
jmp 0x10006b7b
xor esi, esi
inc esi
mov edx, ebx
inc edi
mov al, byte [edi]
test al, al
jne 0x10006afc
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x10006fc1
Capabilities:
Get common file path

Disassembly:
push 0x810
mov eax, 0x10178194
call fcn.101584ae
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x81c], edi
push 0x800
xor ebx, ebx
mov dword [ebp - 0x81c], edi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.101598f0
add esp, 0xc
mov dword [ebp - 0x814], ebx
call fcn.100106e3
push eax
lea ecx, [ebp - 0x814]
call fcn.1000469d
mov dword [ebp - 4], ebx
sub esi, 1
je 0x100070ff
sub esi, 1
je 0x100070f7
sub esi, 3
je 0x100070f0
sub esi, 4
je 0x10007064
sub esi, 1
je 0x1000705f
sub esi, 1
je 0x1000705a
sub esi, 1
jne 0x10007131
push ebx
push 0x1c
lea eax, [ebp - 0x810]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10007111
push ebx
push 0x23
jmp 0x10007047
push ebx
push 0x1a
jmp 0x10007047
push 1
push 2
pop edx
lea ecx, [ebp - 0x818]
call fcn.10006fc1
mov byte [ebp - 4], 1
mov dword [esp], str.Links
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.100042bf
add esp, 0xc
push eax
lea ecx, [ebp - 0x814]
mov byte [ebp - 4], 2
call fcn.1000464d
mov ecx, dword [ebp - 0x81c]
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.10003b51
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.100046fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.10006ec0
pop ecx
mov byte [ebp - 4], 3
jmp 0x10007161
push ebx
push ebx
jmp 0x10007047
push ebx
push 6
jmp 0x10007047
lea eax, [ebp - 0x810]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x810]
push eax
call fcn.10004633
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.10004820
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.100046fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.10006ec0
pop ecx
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x814]
call fcn.1000464d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov esi, dword [ebp - 0x814]
add esi, 0xfffffff0
push esi
call fcn.100046fe
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10003b51
mov eax, edi
call fcn.1015845d
ret
Function at 0x100071ce
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x101781cb
call fcn.1015847b
mov dword [ebp - 0x10], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
je 0x1000727c
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x14], esi
push eax
mov dword [ebp - 0x14], eax
call fcn.100046fe
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.100071a2
pop ecx
test eax, eax
je 0x10007279
mov ebx, edi
mov esi, edi
cmp dword [ebp - 0x10], ebx
jle 0x10007274
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10007239
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x10007219
jmp 0x1000723c
xor ebx, ebx
inc ebx
push ecx
mov esi, esp
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
call fcn.100046fe
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.100071a2
pop ecx
test eax, eax
je 0x10007274
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x1000723c
mov eax, dword [ebp + 8]
jmp 0x1000727f
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
lea ecx, [eax - 0x10]
call fcn.10003b51
mov eax, ebx
call fcn.10158449
ret

Function at 0x1000728f
Capabilities:
Download url
Receive data

Disassembly:
push 4
mov eax, 0x101781fd
call fcn.1015847b
mov dword [ebp - 4], 1
mov edi, dword [ebp + 0xc]
push ecx
mov esi, esp
add edi, 0xfffffff0
push edi
mov dword [ebp - 0x10], esi
call fcn.100046fe
pop ecx
add eax, 0x10
push 5
pop ecx
mov dword [esi], eax
call fcn.100071ce
pop ecx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, dword [ebp + 8]
xor ebx, ebx
test eax, eax
setns bl
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov ecx, edi
call fcn.10003b51
mov eax, ebx
call fcn.10158449
ret

Function at 0x1000732c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1017822f
call fcn.101584ae
mov edi, edx
mov ebx, ecx
mov dword [ebp - 4], 1
lea edx, [ebp + 0xc]
or esi, 0xffffffff
mov dword [ebp - 0x14], esi
call fcn.100072fe
test eax, eax
je 0x100073b7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20019
push eax
push eax
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10007381
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100073b7
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
push dword [ebp - 0x20]
cmovne ecx, ebx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003b51
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003b51
mov eax, esi
call fcn.1015845d
ret
Function at 0x100073d5
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x1017826b
call fcn.101584ae
mov edi, edx
mov dword [ebp - 0x14], ecx
xor esi, esi
lea edx, [ebp + 0xc]
inc esi
mov dword [ebp - 4], esi
call fcn.100072fe
xor ebx, ebx
test eax, eax
je 0x10007422
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10007442
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003b51
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003b51
mov eax, esi
call fcn.1015845d
ret
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x1c]
test eax, eax
jne 0x1000741c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10007424
Function at 0x10007466
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101782af
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.10158630
mov eax, dword [0x101e2e94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1020], edx
mov ebx, ecx
mov dword [ebp - 0x1014], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1014], ebx
xor eax, eax
mov dword [ebp - 4], 2
push 0x1000
push eax
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x1010]
push eax
call fcn.101598f0
add esp, 0xc
lea edx, [ebp + 0x10]
add esi, 0xfffffff0
add edi, 0xfffffff0
call fcn.100072fe
test eax, eax
jne 0x10007513
push 0x101bf6b6
mov ecx, ebx
call fcn.100043dd
mov ecx, esi
call fcn.10003b51
mov ecx, edi
call fcn.10003b51
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
jmp 0x100075d7
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x101c]
push eax
xor eax, eax
push eax
push 0x20019
push eax
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x1020]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10007552
push dword [ebp - 0x101c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x101bf6b6
jmp 0x100075bc
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 0x1000
push eax
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x101c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x101c]
test eax, eax
je 0x1000759b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.100046fe
add eax, 0x10
pop ecx
mov dword [ebx], eax
jmp 0x100075c3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100075aa
sub ecx, edx
je 0x1000758d
lea eax, [ebp - 0x1010]
push eax
mov ecx, ebx
call fcn.100043dd
mov ecx, esi
call fcn.10003b51
mov ecx, edi
call fcn.10003b51
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157841
leave
ret
Function at 0x100075f8
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x101782f6
call fcn.101584ae
mov esi, ecx
lea edx, [ebp + 0x10]
mov dword [ebp - 4], 2
call fcn.100072fe
xor edi, edi
test eax, eax
je 0x10007643
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1000766e
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003b51
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.10003b51
mov eax, esi
call fcn.1015845d
ret
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
mov ecx, dword [eax - 0xc]
inc ecx
push ecx
push eax
push esi
push edi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x18]
test eax, eax
jne 0x1000763d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10007645

Function at 0x10007697
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x101e2e94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push eax
mov esi, ecx
call fcn.101598f0
add esp, 0xc
mov dword [ebp - 0x48], edi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test esi, esi
je 0x100076ef
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x54]
call esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10157841
leave
ret
Function at 0x10007ef1
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x120
mov eax, 0x10178573
call fcn.101584ae
mov edi, ecx
mov dword [ebp - 0x120], edi
xor ebx, ebx
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x124], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov dword [edi], ebx
call fcn.100106e3
push eax
mov ecx, edi
call fcn.1000469d
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x124], esi
push ebx
push eax
mov dword [ebp - 0x118], ebx
call fcn.101598f0
pop ecx
pop ecx
mov edx, esi
lea ecx, [ebp - 0x128]
call fcn.10006fc1
pop ecx
lea ecx, [ebp - 0x114]
push ecx
push ebx
push 0x101bf6b6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [ebp - 0x128]
lea ecx, [ecx - 0x10]
call fcn.10003b51
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x118]
call fcn.100043dd
mov dword [ebp - 0x124], 3
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x118]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x120], esp
mov esi, esp
push eax
mov dword [ebp - 0x11c], esi
call fcn.100046fe
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov esi, esp
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
mov dword [ebp - 0x11c], esi
push ebx
call fcn.100046fe
add eax, 0x10
mov dword [esi], eax
pop ecx
mov byte [ebp - 4], 2
call fcn.1000728f
pop ecx
pop ecx
test eax, eax
je 0x10008030
mov eax, dword [ebp - 0x118]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x11c], esi
call fcn.100046fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x120]
mov dword [esi], eax
call fcn.10008059
pop ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.1000464d
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx - 0x10]
call fcn.10003b51
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x118]
lea ecx, [ecx - 0x10]
call fcn.10003b51
mov ecx, ebx
call fcn.10003b51
mov eax, edi
call fcn.1015845d
ret

Function at 0x1000889f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
pop ebp
jmp fcn.10003b51