joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10078e7
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor eax, eax
push eax
mov ebx, 0x2000000
push ebx
push 3
push eax
push eax
mov edi, 0xa0000
push edi
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x1007982
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1007951
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1007951
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007946
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
xor ecx, ecx
cmp eax, ecx
je 0x100796e
cmp eax, 0x50
je 0x100796e
cmp eax, 0xb7
jne 0x1007932
push ecx
push ebx
push 3
push ecx
push ecx
push edi
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1007932
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push 0x10079dc
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x10079b8
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.iertutil.dll_Ordinal_39]
cmp dword [ebp + 8], 0
mov esi, eax
je 0x10079ce
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10079ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10079cc
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1007948

Function at 0x1007a1a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1011478]
test eax, eax
jne 0x1007a6f
push 1
push 6
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1007a6a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
neg eax
sbb eax, eax
add eax, 2
mov dword [0x1011478], eax
jmp 0x1007a6f
mov eax, dword [0x1011478]
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100305d
leave
ret
Function at 0x1007c23
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push esi
push 4
push esi
push esi
push esi
push 0x1007d10
push SysReAllocString
call ebx
mov edi, eax
cmp edi, esi
jne 0x1007cc4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1007cf4
push dword [ebp - 0xc]
call ebx
mov edi, eax
cmp edi, esi
jne 0x1007cb9
push 4
pop ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
mov edi, 0x1007cdc
push edi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 4], 0x100000
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jle 0x1007cd2
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008827
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push 0x214
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 0x62c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01008224
test eax, eax
je 0x1008965
lea eax, [ebp - 0x20c]
push eax
push esi
cmp dword [ebp + 0x14], edi
je 0x1008926
lea eax, [ebp - 0x620]
push eax
call fcn.010027f4
push edi
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010025c7
test eax, eax
js 0x1008901
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1008901
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
or eax, 4
mov dword [ebp - 0x418], eax
push edi
lea eax, [ebp - 0x62c]
push eax
push edi
call sub.IEADVPACK.dll_ExecuteCabW
jmp 0x1008965
test byte [ebp + 0x18], 4
jne 0x1008965
lea eax, [ebp - 0x20c]
push eax
push 0x40
push 0xc
push 0xb
push edi
push dword [0x101100c]
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x18
jmp 0x1008965
lea eax, [ebp - 0x414]
push eax
call fcn.010027f4
push edi
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.010025c7
test eax, eax
js 0x1008965
push edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push edi
push edi
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x414]
push eax
push edi
call sub.IEADVPACK.dll_RunSetupCommandW
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret 0x14
Function at 0x100897b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 0x630]
push eax
mov edi, 0x20019
push edi
xor esi, esi
push esi
push 0x1008b70
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x1008b22
lea eax, [ebp - 0x624]
push eax
push edi
push esi
push 0x1008b58
push dword [ebp - 0x630]
call ebx
test eax, eax
jne 0x1008b16
push 0x1008b70
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x628], edi
call fcn.010027f4
push esi
push esi
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01001e2d
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
jmp 0x1008af6
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
call ebx
test eax, eax
jne 0x1008a7a
push 0x1008b54
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 0x1008b54
push 1
push esi
push 0x1008b34
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
lea eax, [ebp - 0x61c]
push eax
call fcn.01002618
test eax, eax
js 0x1008ad2
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x61c]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x1008ad2
push dword [ebp - 0x620]
push esi
push esi
call sub.IEADVPACK.dll_RegRestoreAllW
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x62c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x62c]
mov dword [ebp - 0x628], edi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1008a25
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret
Function at 0x1008bc1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
cmp esi, edi
je 0x1008c30
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x1008d10
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008c30
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x1008cf4
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008c27
test byte [ebp - 4], bl
je 0x1008c27
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0100d5bd
test eax, eax
jne 0x1008c55
mov eax, 0x1008cd0
cmp esi, edi
jne 0x1008c47
mov eax, 0x1008cb4
push dword [ebp + 0x14]
push esi
push esi
push eax
push dword [ebp + 0xc]
call fcn.01008827
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01008827
cmp esi, edi
je 0x1008c7a
push 0xd
push ebx
push esi
push 0x1008c94
push dword [ebp + 0xc]
call fcn.01008827
push dword [ebp - 8]
push esi
call fcn.010082e9
cmp esi, edi
pop edi
pop esi
pop ebx
jne 0x1008c8f
call fcn.0100897b
leave
ret 0x10

Function at 0x1008d59
Capabilities:
Check os version
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
cmp dword [ebp + 8], ebx
je 0x1008d9d
call fcn.01007dd5
call fcn.0100877f
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x1008d97
call fcn.010077f6
call sub.iertutil.dll_Ordinal_33
call dword [sym.imp.SHELL32.dll_SHFlushSFCache]
mov eax, 0x1008f84
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x1008e50
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push 2
push 8
lea eax, [ebp - 0x120]
push eax
push 0xb
push 0x1008f6c
push 0x1008f18
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0x114
lea eax, [ebp - 0x118]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1008e44
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x1008e3f
jne 0x1008e21
cmp dword [ebp - 0x110], 1
jae 0x1008e3f
cmp eax, 6
jb 0x1008e2a
mov edi, 0x1008ee8
jmp 0x1008e44
cmp eax, 5
jne 0x1008e44
cmp dword [ebp - 0x110], 2
jne 0x1008e44
mov edi, 0x1008ec0
jmp 0x1008e44
mov edi, 0x1008e90
push ebx
push edi
push 0x1008e78
push dword [ebp + 8]
jmp 0x1008e58
push ebx
push eax
push 0x1008e78
push ebx
call fcn.01008bc1
cmp dword [ebp + 8], ebx
pop edi
pop ebx
je 0x1008e69
call fcn.01007c23
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100305d
leave
ret 4
Function at 0x1009016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
push 2
push dword [0x1009180]
call fcn.01007222
push 0x17
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x210], eax
cmp eax, esi
je 0x1009173
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x1009173
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x1009172
push edi
lea eax, [ebp - 0x214]
push eax
push dword [0x100918c]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], esi
call fcn.010071fe
lea eax, [ebp - 0x218]
push eax
push dword [0x1009188]
call fcn.010071fe
mov eax, dword [ebp - 0x218]
xor ecx, ecx
xor edi, edi
add ecx, dword [ebp - 0x214]
adc eax, edi
cmp eax, 0x10000000
ja 0x1009171
jb 0x10090d3
cmp ecx, 0x7ef
jae 0x1009171
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x1009184]
call fcn.0100719d
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x1009171
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x5c
pop eax
push esi
push 0x80
push 2
push esi
push esi
mov word [edi], ax
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1009171
push dword [ebp - 0x210]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
lea ecx, [ebp - 0x210]
push ecx
push eax
push ebx
push edi
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret
Function at 0x100937d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
or eax, 3
cmp dword [ebp + 0xc], esi
je 0x10093be
lea ebx, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x210]
push ebx
push esi
push eax
push esi
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x10093cf
lea ebx, [ebp - 0x210]
push ebx
push eax
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100944f
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call fcn.01009204
cmp dword [ebp + 0xc], esi
je 0x1009413
cmp dword [ebp + 0x10], esi
jne 0x1009406
cmp eax, esi
je 0x1009443
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
jmp 0x1009434
cmp dword [ebp + 0x10], esi
jne 0x100942e
cmp eax, esi
jne 0x1009443
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1009443
push esi
push 0x10014cc
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret 0xc

Function at 0x1009464
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x90]
push ecx
push 1
xor esi, esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x88], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1009533
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x90]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x90]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1009533
push esi
lea eax, [ebp - 0x88]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x88]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1009527
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret 8
Function at 0x10095ad
Capabilities:
Delete registry value
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x10095c2
push esi
call fcn.0100b151
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x10095ed
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x10095e0
and eax, 0xfffffff9
jmp 0x10095e3
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1009628
cmp dword [ebp + 0x10], 0
je 0x1009608
push dword [ebp + 8]
push 0x1009630
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1009628
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x1009630
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop ebp
ret 0xc

Function at 0x1009761
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 2
push esi
push esi
push esi
push 0x1009818
push SysReAllocString
mov edi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10097ba
push 0x40
push 0x10097d8
push 1
push esi
push 0x10097c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10097b1
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1009aa9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
push esi
push edi
push eax
push 0x1009b58
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010015e0
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
mov edi, 0x1009be8
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, SysReAllocString
push esi
mov dword [ebp - 0x214], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x210]
and eax, dword [ebp + 0xc]
push 4
or eax, dword [ebp + 0x10]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push 4
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 0xc
Function at 0x1009c03
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1009cac
push 0x1009cbc
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01007383
test eax, eax
js 0x1009cac
push 0x44
pop edi
push edi
lea eax, [ebp - 0x260]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x260], edi
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1009cac
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x218]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret

Function at 0x1009ce3
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push eax
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01002618
lea eax, [ebp - 0x20c]
push eax
call fcn.0100b151
mov edi, eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x29
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x1009d5e
push 0
push esi
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 8
Function at 0x100a314
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
push edi
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call ebx
mov edi, 0x100a4e0
mov esi, 0x104
test eax, eax
je 0x100a399
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100a279
push esi
lea eax, [ebp - 0x414]
push eax
push 0x10
push dword [0x101100c]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100a399
push 0
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010025c7
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100a279
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x100a4a8
push 0x100a430
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x100a3eb
push esi
lea eax, [ebp - 0x414]
push eax
push 0x11
push dword [0x101100c]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100a421
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call ebx
test eax, eax
je 0x100a421
push 0
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010025c7
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100a279
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret

Function at 0x100a537
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x100a58a
push 0
push dword [esi + edi*4]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100a584
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push 0
push dword [ebp + 8]
push eax
call fcn.0100219b
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x100a558
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 0x10