joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e46
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1002820
call fcn.0100a048
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1009e81
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009e81
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1009e99
cmp eax, 0x20b
je 0x1009e86
mov dword [ebp - 0x1c], edi
jmp 0x1009ead
cmp dword [ecx + 0x84], 0xe
jbe 0x1009e81
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1009ea7
cmp dword [ecx + 0x74], 0xe
jbe 0x1009e81
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10373c8], 0xffffffff
or dword [0x10373cc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1012fb0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1012fac]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10373d0], eax
call fcn.0100a040
cmp dword [0x100e660], edi
jne 0x1009f08
push fcn.0100a040
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100a029
push 0x100c010
push 0x100c00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1012fa8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1012fa4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x100c008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100444a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1009f7f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1009fb4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100a083
ret
Function at 0x100a171
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edx, edx
xor edi, edi
test eax, eax
je 0x100a234
mov ecx, dword [ebp + 8]
push 0x3f
pop esi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
push ebx
movzx ebx, byte [ecx]
shl edx, 8
add edx, ebx
inc ecx
inc edi
cmp edi, 3
jne 0x100a1e2
mov edi, edx
shr edi, 0x12
and edi, esi
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
mov edi, edx
shr edi, 0xc
and edi, esi
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, edx
inc eax
mov byte [eax], bl
shr edi, 6
and edi, esi
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
and edx, esi
mov byte [eax], bl
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov byte [eax], dl
inc eax
xor edx, edx
xor edi, edi
dec dword [ebp + 0xc]
jne 0x100a194
test edi, edi
pop ebx
je 0x100a237
push 3
pop ecx
sub ecx, edi
shl ecx, 3
shl edx, cl
mov ecx, edx
shr ecx, 0x12
and ecx, esi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, esi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov byte [eax], cl
inc eax
cmp edi, 2
jne 0x100a22a
shr edx, 6
and edx, esi
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
jmp 0x100a22d
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
jmp 0x100a237
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100a288
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x100a29e
or dword [ebp + 0x18], 0xffffffff
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_sprintf]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x13e]
cmp edi, eax
mov dword [ebp - 0x10], eax
jae 0x100a362
mov cl, byte [esi]
mov al, cl
inc esi
and al, 0xc0
mov byte [ebp + 0xb], cl
jne 0x100a30e
movzx eax, cl
push eax
push 0x1003010
push edi
mov dword [ebp - 0xc], eax
call ebx
add edi, eax
add esp, 0xc
cmp byte [ebp + 0xb], 0
mov dword [ebp - 8], edi
je 0x100a3b5
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + esi]
cmp eax, dword [ebp + 0x18]
jae 0x100a36e
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
add dword [ebp - 8], ecx
mov edi, dword [ebp - 8]
jmp 0x100a357
cmp al, 0xc0
jne 0x100a3a1
cmp esi, dword [ebp + 0x18]
jae 0x100a381
xor eax, eax
mov ah, cl
mov al, byte [esi]
inc esi
movzx eax, ax
push eax
push 0x1003008
push edi
mov dword [ebp + 8], eax
call ebx
add esp, 0xc
add edi, eax
cmp dword [ebp + 0x14], 0
je 0x100a39b
cmp dword [ebp - 4], 0
jne 0x100a345
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
xor eax, 0xc000
add eax, dword [ebp + 0x14]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x100a389
cmp edi, dword [ebp - 0x10]
mov esi, eax
jb 0x100a2be
push 0x1002fd8
push edi
call ebx
pop ecx
pop ecx
jmp 0x100a3b0
movzx eax, byte [ebp + 0xb]
push esi
push eax
push 0x1002f9c
push edi
call ebx
add esp, 0x10
jmp 0x100a3b0
push esi
push 0x1002f68
jmp 0x100a3aa
push eax
lea eax, [esi - 2]
push eax
push 0x1002f34
push edi
call ebx
add esp, 0x10
jmp 0x100a3b3
mov byte [edi], 0
inc edi
jmp 0x100a3b5
movzx eax, cl
push eax
push 0x1002f18
push edi
call ebx
add esp, 0xc
mov esi, dword [ebp + 0x10]
add edi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100a3be
mov dword [eax], edi
cmp dword [ebp - 4], 0
je 0x100a3c7
mov esi, dword [ebp - 4]
pop edi
mov eax, esi
sub eax, dword [ebp + 0x10]
pop esi
pop ebx
leave
ret 0x14
Function at 0x4673d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
or ebp, 0xffffffff
jmp 0x4673f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4673f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4673e8
mov eax, 1
add ebx, ebx
jne 0x46740b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x467400
jne 0x46741c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x467400
xor ecx, ecx
sub eax, 3
jb 0x467430
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4674a2
mov ebp, eax
add ebx, ebx
jne 0x46743b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x467448
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46746c
inc ecx
add ebx, ebx
jne 0x467458
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46744d
jne 0x467469
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46744d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46748c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46747d
jmp 0x4673ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46748c
add edi, ecx
jmp 0x4673ee
pop esi
mov edi, esi
mov ecx, 0x12
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4674aa
cmp byte [edi], 0
jne 0x4674aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4674af
lea edi, [esi + 0x65000]
mov eax, dword [edi]
or eax, eax
je 0x46751e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8ea4c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ea9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4674dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8eaa0]
or eax, eax
je 0x467518
mov dword [ebx], eax
add ebx, 4
jmp 0x4674f9
call dword [esi + 0x8eab0]
mov ebp, dword [esi + 0x8eaa4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467552
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x101f459
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102737c]
test eax, eax
jne 0x101f516
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x101f508
cmp dword [ebp - 0x318], 2
jne 0x101f4fe
cmp dword [ebp - 0x324], 6
jae 0x101f4fe
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x1027380]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x101f508
push 0
push 8
lea eax, [ebp - 0x20c]
push eax
call fcn.01024dc9
cmp eax, dword [0x1027380]
mov dword [0x102737c], eax
jne 0x101f508
push eax
call fcn.010249f7
jmp 0x101f508
mov eax, dword [0x1027380]
mov dword [0x102737c], eax
mov eax, dword [0x102737c]
test eax, eax
jne 0x101f516
mov eax, dword [0x1027380]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010236f9
leave
ret

Function at 0x101f54b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x101f5d7
push 0x10013f4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101f5d7
push 1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01023f99
mov ecx, dword [ebp - 0x210]
cmp ecx, 0x50000
mov eax, 0x60000
jb 0x101f5c7
cmp ecx, 0x50032
jae 0x101f5cf
push 2
jmp 0x101f5d9
cmp ecx, 0x50032
jb 0x101f5d7
cmp ecx, eax
jae 0x101f5d7
push 3
jmp 0x101f5d9
push 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop eax
call fcn.010236f9
leave
ret
Function at 0x101f703
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push 4
pop ebx
push ebx
push esi
push esi
push esi
push 0x1001460
push 0x80000001
call edi
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x101f7a4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001448
push dword [ebp - 0x10]
call edi
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x101f79b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
mov edi, 0x1001430
push edi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 4], 0x100000
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.01024661
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101fc5c
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push 0x214
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 0x62c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101f66d
test eax, eax
je 0x101fd8e
cmp dword [ebp + 0x14], edi
lea eax, [ebp - 0x20c]
push eax
push esi
je 0x101fd50
lea eax, [ebp - 0x620]
push eax
call fcn.0101f9b5
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101fd35
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x101fd35
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
or eax, 4
mov dword [ebp - 0x418], eax
push edi
lea eax, [ebp - 0x62c]
push eax
push edi
call sub.ADVPACK.dll_ExecuteCabW
jmp 0x101fd8e
test byte [ebp + 0x18], 4
jne 0x101fd8e
lea eax, [ebp - 0x20c]
push eax
push 0x40
push 0xc
push 0xb
push edi
call fcn.0101fb78
jmp 0x101fd8e
lea eax, [ebp - 0x414]
push eax
call fcn.0101f9b5
push ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101fd8e
push edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push edi
push edi
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x414]
push eax
push edi
call sub.ADVPACK.dll_RunSetupCommandW
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010236f9
leave
ret 0x14
Function at 0x101fda4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x630]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, 0x1001708
push ebx
push SysStringLen
call edi
test eax, eax
jne 0x101ff58
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
push 0x10016f0
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x101ff4c
mov eax, 0x104
push ebx
push eax
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], esi
call fcn.0101f9b5
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x101ff40
mov ebx, 0x10016ec
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x101fead
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x10016cc
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x101ff04
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x80000001
call edi
test eax, eax
jne 0x101ff04
push dword [ebp - 0x620]
push esi
push esi
call sub.ADVPACK.dll_RegRestoreAllW
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x62c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x62c]
mov dword [ebp - 0x628], 0x104
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x101fe60
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010236f9
leave
ret
Function at 0x10202e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
je 0x1020353
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x1001978
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020353
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x100195c
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102034a
test byte [ebp - 4], bl
je 0x102034a
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.010244e4
test eax, eax
jne 0x1020378
cmp esi, edi
mov eax, 0x1001938
jne 0x102036a
mov eax, 0x100191c
push dword [ebp + 0x14]
push esi
push esi
push eax
push dword [ebp + 0xc]
call fcn.0101fc5c
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0101fc5c
cmp esi, edi
je 0x102039d
push 0xd
push ebx
push esi
push 0x10018fc
push dword [ebp + 0xc]
call fcn.0101fc5c
push dword [ebp - 8]
push esi
call fcn.0101fff6
cmp esi, edi
pop edi
pop esi
pop ebx
jne 0x10203b2
call fcn.0101fda4
leave
ret 0x10

Function at 0x10203bb
Capabilities:
Check os version
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10203ff
call fcn.0101f7b6
call fcn.0101f5eb
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x10203f9
call sub.iertutil.dll_Ordinal_37
call sub.iertutil.dll_Ordinal_33
call dword [sym.imp.SHELL32.dll_SHFlushSFCache]
cmp dword [ebp + 8], edi
mov eax, 0x1001a94
mov ebx, eax
je 0x10204a2
call fcn.0101f54b
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push 2
push 8
lea eax, [ebp - 0x120]
push eax
push 0xb
push 0x1001a7c
push 0x1001a28
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0x114
lea eax, [ebp - 0x118]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1020496
cmp dword [ebp - 0x114], 6
jb 0x102047f
mov ebx, 0x10019fc
jmp 0x1020496
cmp dword [ebp - 0x114], 5
jne 0x1020496
cmp dword [ebp - 0x110], 2
jne 0x1020496
mov ebx, 0x10019d4
push edi
push ebx
push 0x10019bc
push dword [ebp + 8]
jmp 0x10204aa
push edi
push eax
push 0x10019bc
push edi
call fcn.010202e4
cmp dword [ebp + 8], edi
pop edi
pop ebx
je 0x10204bb
call fcn.0101f703
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010236f9
leave
ret 4
Function at 0x10207e9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
or eax, 3
cmp dword [ebp + 0xc], esi
je 0x102082a
lea ebx, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x210]
push ebx
push esi
push eax
push esi
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x102083b
lea ebx, [ebp - 0x210]
push ebx
push eax
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10208bb
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call fcn.010206de
cmp dword [ebp + 0xc], esi
je 0x102087f
cmp dword [ebp + 0x10], esi
jne 0x1020872
cmp eax, esi
je 0x10208af
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
jmp 0x10208a0
cmp dword [ebp + 0x10], esi
jne 0x102089a
cmp eax, esi
jne 0x10208af
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x10208af
push esi
push 0x10013f0
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010236f9
leave
ret 0xc

Function at 0x1020905
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x90]
push ecx
push 1
xor esi, esi
push esi
push eax
push SysStringLen
mov dword [ebp - 0x88], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10209d4
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x90]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x90]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x10209d4
push esi
lea eax, [ebp - 0x88]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x88]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10209c8
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010236f9
leave
ret 8
Function at 0x1020a2a
Capabilities:
Delete registry value
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x1020a3f
push esi
call fcn.0102227b
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x1020a6a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x1020a5d
and eax, 0xfffffff9
jmp 0x1020a60
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1020aa5
cmp dword [ebp + 0x10], 0
je 0x1020a85
push dword [ebp + 8]
push 0x1001f98
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1020aa5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x1001f98
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop ebp
ret 0xc

Function at 0x1020b01
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0102227b
mov esi, eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010236f9
leave
ret 8