joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10081ea
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor esi, esi
lea eax, [ebp + 0xc]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100823e
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x10]
push 1
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x1008998
Capabilities:
Copy file
Delete registry value
Get common file path
Persist via app paths registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa54
mov eax, dword [0x100d0ac]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0xa4c], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
push edi
mov dword [ebp - 0xa54], eax
mov dword [ebp - 0xa48], ecx
je 0x1008bb8
cmp byte [eax], 0
je 0x1008bb8
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1008bb8
push 0x1001410
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x10c]
push eax
mov ebx, 0x1001f00
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
lea eax, [ebp - 0x10c]
push eax
mov edi, 0x1001ef0
lea eax, [ebp - 0x52c]
push edi
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x214]
push eax
call fcn.0100a023
test eax, eax
jne 0x1008a75
push dword [ebp - 0xa48]
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x52c]
push edi
push eax
call esi
add esp, 0x18
xor edi, edi
push edi
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1008bb0
push dword [ebp - 0xa54]
lea ecx, [ebp - 0xa40]
call fcn.0100a825
lea eax, [ebp - 0x937]
push eax
lea eax, [ebp - 0x93b]
push eax
lea eax, [ebp - 0x31c]
push 0x1001754
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1008ae2
inc eax
jmp 0x1008bba
lea eax, [ebp - 0x634]
push 0x10012a8
push eax
call esi
pop ecx
pop ecx
lea eax, [ebp - 0xa44]
push eax
push 0xf003f
push edi
lea eax, [ebp - 0x634]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008bb0
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x31c]
push eax
xor ebx, ebx
inc ebx
push ebx
push edi
mov esi, 0x1001ee8
push esi
push dword [ebp - 0xa44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1008ba4
push 0x41
pop ecx
mov byte [ebp - 0x424], al
lea edi, [ebp - 0x423]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x424]
push eax
push 0xd2
push dword [ebp - 0xa50]
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
lea eax, [ebp - 0x424]
push eax
push 0x1001ee0
lea eax, [ebp - 0x52c]
push eax
call fcn.0100ac25
push esi
push dword [ebp - 0xa44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0xa4c], ebx
push dword [ebp - 0xa44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa4c]
jmp 0x1008bba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0xc
Function at 0x1008bce
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7f4
mov eax, dword [0x100d0ac]
and dword [ebp - 0x7e8], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp + 0x10]
push esi
lea ecx, [ebp - 0x3d8]
mov dword [ebp - 0x7ec], eax
call fcn.0100a525
lea ecx, [ebp - 0x3d8]
call fcn.0100a67c
test eax, eax
je 0x1008cac
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1008cac
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
push edi
push 0x1001494
call esi
mov edi, 0x1001d28
push edi
mov ebx, eax
call esi
add ebx, eax
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebx + eax + 1]
push eax
call fcn.0100a087
test eax, eax
mov dword [ebp - 0x7e8], eax
je 0x1008caa
push 0x1001494
push edi
lea ecx, [ebp - 0x10c]
push ecx
push 0x10014bc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 1
push dword [ebp - 0x7e8]
push dword [ebp - 0x7ec]
call fcn.01004482
push dword [ebp - 0x7e8]
call fcn.0100a0a7
pop edi
pop ebx
push dword [ebp - 0x7f0]
lea eax, [ebp - 0x214]
push eax
call fcn.01003879
test eax, eax
je 0x1008d10
push dword [ebp - 0x7f4]
lea ecx, [ebp - 0x7e4]
call fcn.0100a825
lea eax, [ebp - 0x5da]
push eax
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x31c]
push 0x1001f10
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 1
lea eax, [ebp - 0x7e8]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.010036ac
test eax, eax
jne 0x1008d14
xor eax, eax
jmp 0x1008d4e
push 1
push dword [ebp - 0x7e8]
push dword [ebp - 0x7ec]
call fcn.01004482
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x7e8]
push dword [ebp - 0x7ec]
call fcn.01005309
push dword [ebp - 0x7e8]
mov esi, eax
call fcn.0100a0a7
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
call fcn.01009b9d
leave
ret 0xc
Function at 0x1008d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2d4], 1
call fcn.0100a525
lea eax, [ebp - 0x2d8]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x1001278
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008ee1
push esi
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x2e8]
push eax
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x2e4], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, 0x104
jmp 0x1008eb8
cmp dword [ebp - 0x2e8], 1
jne 0x1008e87
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.01008034
test eax, eax
je 0x1008e87
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.01008bce
and dword [ebp - 0x2d4], eax
lea ecx, [ebp - 0x2d0]
call fcn.0100a67c
test eax, eax
je 0x1008e5c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.01008700
jmp 0x1008e68
lea eax, [ebp - 0x10c]
push eax
call fcn.0100829c
push dword [ebp - 0x2ec]
and dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.01008998
and dword [ebp - 0x2d4], eax
inc dword [ebp - 0x2e4]
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x2e4]
push dword [ebp - 0x2d8]
mov dword [ebp - 0x2e0], esi
mov dword [ebp - 0x2dc], esi
call edi
test eax, eax
je 0x1008df9
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
call fcn.01003ebd
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
pop edi
add eax, 0x80004005
pop ebx
call fcn.01009b9d
leave
ret 8
Function at 0x1008f0d
Capabilities:
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x100d0ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x3d8]
mov dword [ebp - 0x3e8], eax
call fcn.0100a525
lea eax, [ebp - 0x31c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1008f6d
push 0x1001410
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x3d8]
call fcn.0100a67c
test eax, eax
jne 0x1008f77
mov eax, 0x80004005
jmp 0x10090d5
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x3dc]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x1001278
push 0x80000002
call ebx
test eax, eax
jne 0x1009087
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x3f0]
push eax
push edi
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x3e0], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x100905d
cmp dword [ebp - 0x3f0], 1
jne 0x100902c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x3e8]
call fcn.01008bce
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x3e8]
call fcn.01008700
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x3e8]
call fcn.01008998
inc dword [ebp - 0x3e0]
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x3f0]
push eax
push 0
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x3e0]
push dword [ebp - 0x3dc]
mov dword [ebp - 0x3ec], esi
mov dword [ebp - 0x3e4], esi
call edi
test eax, eax
je 0x1008fd8
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
call fcn.01003ebd
lea eax, [ebp - 0x3dc]
push eax
push 2
push edi
push 0x1001f40
push 0x80000002
call ebx
cmp eax, edi
jle 0x10090b2
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
pop edi
pop ebx
jl 0x10090d3
push 0x1001f1c
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x3dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.01009b9d
leave
ret 4
Function at 0x10090e7
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
inc edi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi], eax
je 0x1009149
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100914d
cmp dword [ebp + 0xc], ebx
je 0x100913f
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x100914d
cmp eax, 0x80
jne 0x100913f
cmp dword [ebp + 0x14], ebx
je 0x100914d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
xor eax, eax
jmp 0x1009152
mov dword [esi + 4], edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x100918c
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x100d0ac]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x41
pop ecx
mov dword [ebp - 0x42c], eax
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x10c], bl
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x10c]
push eax
push 0xd2
push edx
mov dword [ebp - 0x428], edx
call edi
push dword [ebp - 0x42c]
lea eax, [ebp - 0x214]
push esi
push eax
push 0x10012fc
push 0x10012f0
push 0x10012e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x214], bl
je 0x1009262
push esi
lea eax, [ebp - 0x424]
push eax
push 0xca
push dword [ebp - 0x428]
call edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x31c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
sub ebx, 6
neg ebx
sbb ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.01009b9d
leave
ret 8

Function at 0x1009278
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x100d0ac]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x105
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x518]
call fcn.0100a825
lea eax, [ebp - 0x40f]
push eax
lea eax, [ebp - 0x413]
push eax
push 0x1001754
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
jne 0x10092ed
push esi
call edi
mov byte [eax + esi - 1], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01009b9d
leave
ret 8
Function at 0x1009840
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x434], eax
xor esi, esi
mov dword [ebp - 0x438], edi
call fcn.0100ae19
lea ecx, [ebp - 0x430]
call fcn.0100ab92
test eax, eax
je 0x10098ad
lea ecx, [ebp - 0x430]
call fcn.0100ab9e
cmp eax, 0x70002
ja 0x10098aa
lea ecx, [ebp - 0x430]
call fcn.0100abb6
cmp eax, 0x75e
jbe 0x10098ad
xor esi, esi
inc esi
lea eax, [ebp - 0x43c]
push eax
push 0x20019
push edi
push 0x1001278
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009974
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x440]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1009905
cmp dword [ebp - 0x440], edi
jbe 0x1009905
mov dword [ebp - 0x438], 1
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x438], edi
je 0x1009974
neg esi
push 0x208
lea eax, [ebp - 0x210]
sbb esi, esi
push eax
add esi, 0xe4
push esi
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x134
push dword [ebp - 0x434]
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x1009958
xor edi, edi
inc edi
lea ecx, [ebp - 0x430]
call fcn.0100ae9f
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 8
cmp esi, edi
je 0x1009955
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0xe5
jmp 0x1009930

Function at 0x1009f21
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
cmp dword [0x100d0b4], 0xffffffff
mov eax, dword [0x100d0ac]
mov dword [ebp - 4], eax
jne 0x100a009
push edi
xor eax, eax
lea edi, [ebp - 0xc4]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc8]
push eax
push 0x20019
push 0
push 0x10012a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x1009fff
push 4
pop eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0
push 0x10020c0
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009fe7
lea ecx, [ebp - 0xc0]
call fcn.0100a525
lea ecx, [ebp - 0xc0]
call fcn.0100a60d
test eax, eax
je 0x1009fda
xor eax, eax
cmp dword [ebp - 0xc4], 2
setne al
mov dword [0x100d0b4], eax
jmp 0x1009ff1
xor eax, eax
cmp dword [ebp - 0xc4], eax
sete al
jmp 0x1009fd3
mov dword [0x100d0b4], 1
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a009
mov dword [0x100d0b4], 1
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x100d0b4], eax
sete al
call fcn.01009b9d
leave
ret

Function at 0x100a1e6
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop ebp
ret 4
Function at 0x100a202
Capabilities:
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x100d0ac]
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x80
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x51c], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x100a2da
push edi
lea ecx, [ebp - 0x518]
call fcn.0100a825
cmp byte [ebp - 0x413], bl
jne 0x100a2d0
cmp byte [ebp - 0x40f], bl
jne 0x100a2d0
cmp byte [ebp - 0x30e], bl
je 0x100a2d0
cmp byte [ebp - 0x20d], bl
je 0x100a2d0
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100a2da
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x10c]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x20d]
push eax
call esi
add ebx, eax
lea eax, [ebp - 0x30e]
push eax
call esi
lea eax, [ebx + eax + 2]
cmp dword [ebp + 0xc], eax
pop esi
jbe 0x100a2da
lea eax, [ebp - 0x20d]
push eax
lea eax, [ebp - 0x30e]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x1001d60
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x51c], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x51c]
pop edi
pop ebx
call fcn.01009b9d
leave
ret 8

Function at 0x100a706
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100d0ac]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, esi
push edi
inc eax
xor edi, edi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x100a729
push 2
sub ecx, edx
pop ebx
cmp ecx, ebx
jle 0x100a781
mov dl, byte [esi + 1]
cmp dl, 0x3a
jne 0x100a74f
xor eax, eax
cmp byte [esi + 2], 0x5c
sete al
inc eax
mov edi, eax
jmp 0x100a788
cmp byte [esi], 0x5c
jne 0x100a788
xor edi, edi
cmp dl, 0x5c
jne 0x100a77e
cmp ecx, ebx
mov edx, ebx
jle 0x100a811
cmp byte [edx + esi], 0x5c
jne 0x100a770
inc edi
cmp edi, ebx
je 0x100a77a
inc edx
cmp edx, ecx
jl 0x100a765
jmp 0x100a811
mov edi, edx
jmp 0x100a788
inc edi
jmp 0x100a788
cmp byte [esi], 0x5c
jne 0x100a788
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10c]
sub eax, esi
dec ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ecx
cmp edi, dword [ebp - 0x218]
jge 0x100a7b2
inc edi
cmp byte [edi + esi], 0x5c
jne 0x100a7a3
lea eax, [ebp - 0x214]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, esi
mov cl, byte [eax]
mov edx, dword [ebp - 0x21c]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100a7c6
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp + edi - 0x10b], cl
call ebx
test eax, eax
jne 0x100a7fd
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x100a811
lea eax, [ebp - 0x214]
push eax
call ebx
cmp edi, dword [ebp - 0x218]
jl 0x100a7ab
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 4
Function at 0x100a9da
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x100ab1e
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x100ab1e
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x100ab1e
cmp dword [ebp + 8], esi
je 0x100ab1e
mov dword [edi], esi
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x100aa5a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100aa45
call esi
mov esi, eax
jmp 0x100ab37
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100ab37
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
mov dword [ebp - 8], eax
je 0x100ab1e
push dword [ebp + 0x10]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x100aa88
mov esi, 0x8007000e
jmp 0x100ab23
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100aae2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1001410
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100aae2
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [edi], ecx
mov eax, dword [eax + 0x14]
and dword [ebp + 0xc], 0
and dword [ebp - 0xc], 0
mov dword [ebx], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x100213c
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x100ab06
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100aaf4
call esi
mov esi, eax
jmp 0x100ab23
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100ab23
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffc
cmp eax, 4
jb 0x100ab23
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x100ab23
mov esi, 0x80004003
cmp dword [ebp - 8], 0
je 0x100ab37
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100ad57
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.0100ab45
lea esi, [edi + 0x118]
push 0x105
push esi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push 0x1001300
push edi
call ebx
add esp, 0xc
push edi
call fcn.0100a023
test eax, eax
jne 0x100ae06
mov byte [esi], al
mov byte [edi], al
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10012a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ae0d
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x100216c
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100adfb
push esi
push 0x1001300
push edi
call ebx
add esp, 0xc
mov ecx, edi
call fcn.0100ab5d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100ae0d
mov ecx, edi
call fcn.0100ab5d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100ae19
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
call fcn.0100ab45
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x100217c
lea esi, [edi + 0x118]
push 0x80000002
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ae94
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x100216c
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ae94
push esi
push 0x10021bc
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, edi
call fcn.0100ab5d
mov eax, edi
pop edi
pop esi
leave
ret