joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021e1d
Capabilities:
Create directory

Disassembly:
mov eax, 0x108c97e
call fcn.01027038
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], esi
je 0x1021e8d
mov ecx, dword [ebp + 8]
push 1
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0x5c
call fcn.0101ec1f
cmp eax, 0xffffffff
je 0x1021f26
mov ecx, dword [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.0101efdb
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0101a55d
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0101937d
jmp 0x1021e9b
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.0101a55d
mov eax, dword [ebp - 0x18]
cmp eax, esi
jne 0x1021ea7
mov eax, 0x1001eb0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push esi
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp esi, 1
je 0x1021f22
cmp eax, 0xb7
je 0x1021f22
cmp eax, 3
je 0x1021ede
test eax, eax
jle 0x1021f0c
and eax, 0xffff
or eax, 0x80070000
jmp 0x1021f0c
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.01021e1d
mov esi, eax
test esi, esi
jl 0x1021f24
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1021efb
mov eax, 0x1001eb0
push 0
push eax
call ebx
test eax, eax
jne 0x1021f22
call edi
test eax, eax
jg 0x1021f10
call edi
mov esi, eax
jmp 0x1021f24
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1021f24
xor esi, esi
pop edi
pop ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.0101937d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1021f46
Capabilities:
Get disk size

Disassembly:
mov eax, 0x108c9a5
call fcn.01027038
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
push esi
push edi
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.0101a55d
push edi
push 0x1002d50
mov ecx, ebx
call fcn.01021265
cmp eax, esi
mov ecx, ebx
je 0x1021fb1
add eax, 2
push eax
push edi
lea eax, [ebp - 0x38]
push eax
call fcn.0101efdb
mov byte [ebp - 4], 1
push esi
push edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0101a55d
push 1
lea ecx, [ebp - 0x38]
call fcn.0101937d
jmp 0x1022012
push edi
push 0x1002d48
call fcn.01021265
cmp eax, esi
je 0x1022012
cmp eax, edi
jne 0x1022012
push 2
mov esi, 0x1002a80
push esi
mov ecx, ebx
call fcn.01021265
cmp eax, 0xffffffff
je 0x1022012
inc eax
push eax
push esi
mov ecx, ebx
call fcn.01021265
cmp eax, 0xffffffff
je 0x1021ffd
inc eax
push eax
push edi
lea eax, [ebp - 0x38]
push eax
mov ecx, ebx
call fcn.0101efdb
mov byte [ebp - 4], 2
push 0xffffffffffffffff
jmp 0x1021f9b
push 0xffffffffffffffff
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0101a55d
push esi
lea ecx, [ebp - 0x28]
call fcn.0101a383
mov eax, dword [ebp - 0x24]
cmp eax, edi
jne 0x102201e
mov eax, 0x1001eb0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x102205d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x102204b
call esi
mov edi, eax
jmp 0x102208a
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x102208a
mov esi, dword [ebp + 8]
imul esi, dword [ebp - 0x10]
push edi
push esi
push edi
push dword [ebp - 0x14]
call fcn.01027180
mov ecx, dword [ebp + 0xc]
push edi
push esi
push edi
push dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], edx
call fcn.01027180
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], edx
push 1
lea ecx, [ebp - 0x28]
call fcn.0101937d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x10221f8
Capabilities:
Get common file path

Disassembly:
mov eax, 0x108c9d6
call fcn.01027038
sub esp, 0x434
mov eax, dword [0x10a1e18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x430], eax
mov eax, dword [ebp + 0xc]
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [ebp + 0x10]
je 0x1022244
push 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov word [ebp - 0x14], bx
jmp 0x102225a
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10222d6
lea eax, [ebp - 0x21c]
push eax
call fcn.0101f805
lea eax, [ebp - 0x429]
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x440]
call fcn.0101a5f5
push ebx
lea eax, [ebp - 0x440]
push eax
mov dword [ebp - 4], ebx
call fcn.01021e1d
mov esi, eax
cmp esi, ebx
setl byte [ebp - 0x429]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x440]
call fcn.0101937d
cmp byte [ebp - 0x429], bl
jne 0x102230e
cmp edi, ebx
jne 0x10222bc
mov edi, 0x1002d58
lea eax, [ebp - 0x428]
push eax
push ebx
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10222fa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10222e8
call esi
mov esi, eax
jmp 0x102230e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x102230e
mov ecx, dword [ebp - 0x430]
lea eax, [ebp - 0x428]
push eax
call fcn.0101a536
xor esi, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101cfd1
leave
ret 0xc

Function at 0x1022c6b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
mov dword [esi], ebx
push edi
mov byte [eax], bl
lea eax, [ebp + 0x17]
push eax
mov edi, ecx
call fcn.01022c09
cmp eax, ebx
jl 0x1022cf9
cmp byte [ebp + 0x17], bl
je 0x1022cf7
push dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push dword [ebp + 8]
push dword [edi + 8]
call esi
cmp eax, ebx
je 0x1022cc5
cmp eax, 2
je 0x1022cf7
cmp eax, ebx
jle 0x1022cf9
and eax, 0xffff
or eax, 0x80070000
jmp 0x1022cf9
mov eax, dword [ebp + 0x10]
push dword [eax]
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.01026cd9
cmp eax, ebx
jl 0x1022cf9
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.01026ca6
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [edi + 8]
call esi
cmp eax, ebx
jne 0x1022cb7
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x1024314
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x1024336
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x10243a5
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, dword [ebp + 0xc]
push eax
push edi
mov dword [ebp - 4], eax
call fcn.010240b5
mov esi, eax
cmp esi, ebx
jl 0x1024446
push dword [ebp - 8]
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x1024444
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1024390
call esi
jmp 0x102442c
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1024446
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
je 0x10243dc
test eax, eax
jle 0x102442c
and eax, 0xffff
or eax, 0x80070000
jmp 0x102442c
push dword [ebp - 4]
push dword [ebp + 0xc]
call fcn.010240b5
mov esi, eax
test esi, esi
jl 0x1024446
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.010240b5
mov esi, eax
test esi, esi
jl 0x1024446
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
push 0
call edi
test eax, eax
jne 0x1024437
call ebx
test eax, eax
jg 0x1024430
call ebx
mov esi, eax
jmp 0x1024446
call ebx
jmp 0x1024392
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1024444
and dword [ebp - 0xc], 0
mov dword [eax], esi
xor esi, esi
cmp dword [ebp - 8], 0
je 0x1024455
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0xc]
push eax
call fcn.01023c1e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1024e44
Capabilities:
Manipulate user privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push 6
pop ecx
push dword [ebp + 0xc]
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.01023c42
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.01024314
mov esi, eax
cmp esi, edi
jl 0x1024eda
lea eax, [ebp - 4]
push eax
push 0x810
lea eax, [ebp - 0x28]
push eax
push edi
call sub.ADVAPI32.dll_LsaOpenPolicy
mov esi, eax
cmp esi, edi
jne 0x1024eaf
push 1
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaAddAccountRights
mov esi, eax
cmp esi, edi
je 0x1024ed8
push esi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
test eax, eax
push esi
jg 0x1024ec3
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov esi, eax
jmp 0x1024eda
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1024eda
xor esi, esi
lea eax, [ebp - 8]
push eax
call fcn.01023c1e
cmp dword [ebp - 4], edi
je 0x1024ef0
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaClose
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x1025453
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x108cb91
call fcn.01027038

Function at 0x1025c81
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
xor esi, esi
xor ebx, ebx
call fcn.0101d5e8
cmp dword [edi + 0x18], 0xffffffff
jne 0x1025ca8
mov esi, 0x80004005
jmp 0x1025d2a
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0x14]
xor edi, edi
cmp eax, esi
je 0x1025cc8
lea ecx, [ebp + 0x14]
cmp ebx, esi
je 0x1025cbe
mov dword [ebx + edi*4], eax
add ecx, 4
mov eax, dword [ecx]
inc edi
cmp eax, esi
jne 0x1025cb7
cmp dword [ebp - 4], esi
jne 0x1025ce3
cmp edi, esi
je 0x1025ce3
mov eax, edi
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.01027060
mov ebx, esp
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1025cab
mov eax, dword [ebp + 8]
push esi
push ebx
push esi
push edi
push esi
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x1025d2a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1025d1a
call esi
mov esi, eax
jmp 0x1025d2a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [ebp + 8]
call fcn.0101d5f7
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1025d41
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x2d], 0
je 0x1025d60
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
jmp 0x1025d9e
cmp dword [ebp + 8], 0
jne 0x1025d6a
xor eax, eax
jmp 0x1025d90
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01027060
mov eax, esp
push esi
push dword [ebp + 8]
push eax
call fcn.01022b75
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1025d95
sub eax, edx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1025dd1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1025dc3
call esi
jmp 0x1025dd3
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1025dd3
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
leave
ret 4

Function at 0x10267d7
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], edi
mov ecx, 0x80070057
jne 0x10267f5
mov esi, ecx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1026801
cmp word [eax], bx
jne 0x1026803
mov esi, ecx
cmp esi, ebx
jl 0x10268df
mov ecx, edi
call fcn.010263c2
push dword [ebp + 8]
lea eax, [edi + 0x20]
push eax
call fcn.01019d18
push 0x40
push 1
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea esi, [edi + 0x24]
push esi
call ebx
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1026862
call edi
cmp eax, 0x80090016
je 0x1026853
test eax, eax
jle 0x10268c0
and eax, 0xffff
or eax, 0x80070000
jmp 0x10268c0
push 0x48
push 1
push 0
push 0
push esi
call ebx
test eax, eax
je 0x10268b8
mov ebx, dword [ebp - 4]
add ebx, 0x2c
push ebx
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10268b8
push 0
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10268b8
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
push 1
push dword [ebx]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10268d6
call edi
test eax, eax
jg 0x10268c4
call edi
mov esi, eax
jmp 0x10268d8
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10268d8
xor esi, esi
test esi, esi
jge 0x10268e6
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.010263c2
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1026d11
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1002f80
call fcn.010271e8
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1026d4c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1026d4c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1026d64
cmp eax, 0x20b
je 0x1026d51
mov dword [ebp - 0x1c], edi
jmp 0x1026d78
cmp dword [ecx + 0x84], 0xe
jbe 0x1026d4c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1026d72
cmp dword [ecx + 0x74], 0xe
jbe 0x1026d4c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
adc eax, sym.imp.msvcrt.dll___set_app_type
pop ecx
or dword [0x10a6dcc], 0xffffffff
or dword [0x10a6dd0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10a6a74]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10a6a70]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10a6dc8], eax
call fcn.01017f0e
cmp dword [0x10a2000], edi
jne 0x1026dd5
push fcn.01017f0e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010271d1
push 0x10a10a8
push 0x10a10a4
call sub.msvcrt.dll__initterm
mov eax, dword [0x10a6a6c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10a6a68]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x10a10a0
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1026e3b
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x1026ef5
mov dword [ebp - 0x20], esi
cmp word [esi], 0x22
jne 0x1026e89
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1026e57
cmp ax, 0x22
jne 0x1026e44
cmp word [esi], 0x22
jne 0x1026e62
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1026e70
cmp ax, 0x20
jbe 0x1026e5d
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x54], 1
je 0x1026e96
movzx eax, word [ebp - 0x50]
jmp 0x1026e99
cmp word [esi], 0x20
jbe 0x1026e62
add esi, ebx
mov dword [ebp - 0x20], esi
jmp 0x1026e89
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], edi
jne 0x1026eba
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1026eef
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01027223
ret
Function at 0x102a248
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x108cf8c
call fcn.01027038
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
call fcn.0101d953
xor ebx, ebx
mov dword [esi + 4], 0x1004168
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.0103d33a
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 2
call fcn.01040a22
push ebx
push ebx
lea ecx, [esi + 0x24c]
mov byte [ebp - 4], 3
call fcn.01042d51
lea ecx, [esi + 0x270]
mov byte [ebp - 4], 4
call fcn.0103a30e
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x260], ebx
mov dword [esi + 0x264], ebx
mov byte [esi + 0x268], bl
mov dword [esi + 0x26c], ebx
mov dword [esi + 0x278], ebx
mov dword [esi + 0x27c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x102f23b
Capabilities:
Get common file path
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x10a1e18]
push esi
lea edx, [ebp - 0x644]
push edx
xor esi, esi
lea edx, [ebp - 0x638]
push edx
push esi
mov dword [ebp - 0x63c], ecx
push 0x20006
xor ecx, ecx
inc ecx
push ecx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x640], ecx
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x644], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x102f2a1
mov dword [ebp - 0x640], esi
jmp 0x102f374
push ebx
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1002a80
lea eax, [ebp - 0x428]
push eax
call ebx
push 0x1009ff0
lea eax, [ebp - 0x428]
push eax
call ebx
mov eax, dword [ebp + 0xc]
cmp eax, esi
jle 0x102f372
mov ebx, dword [ebp - 0x63c]
add ebx, 0x410
mov dword [ebp - 0x63c], eax
cmp dword [ebx + 4], esi
jne 0x102f3bd
lea eax, [ebp - 0x428]
push eax
push edi
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebx - 0x410]
push eax
push 0x1005418
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x102f364
mov eax, dword [ebx]
cmp eax, 4
jne 0x102f39b
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x634], esi
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x634], eax
push 4
lea eax, [ebp - 0x634]
push eax
push 4
push esi
lea eax, [ebx - 0x208]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add ebx, 0x418
dec dword [ebp - 0x63c]
jne 0x102f2f5
pop edi
pop ebx
cmp dword [ebp - 0x638], esi
pop esi
je 0x102f389
push dword [ebp - 0x638]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x640]
call fcn.0101cfd1
leave
ret 8
cmp eax, 1
jne 0x102f364
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x220]
push eax
push 1
jmp 0x102f350
cmp dword [ebx], 4
jne 0x102f364
mov dword [ebp - 0x634], esi
lea eax, [ebx - 0x410]
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc dword [ebp - 0x634]
push 0xa
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x634]
call dword [sym.imp.ntdll.dll__itow]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x428]
push eax
push edi
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x630]
push eax
push 0x1005418
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, esi
je 0x102f364
push 4
lea eax, [ebp - 0x648]
push eax
push 4
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x638]
mov dword [ebp - 0x648], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x102f3c8
Function at 0x102f465
Capabilities:
Get common file path
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x10a1e18]
push esi
lea edx, [ebp - 0x424]
push edx
xor esi, esi
lea edx, [ebp - 0x418]
push edx
push esi
mov dword [ebp - 4], eax
push 0x20006
xor eax, eax
inc eax
push eax
push esi
push esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x424], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x102f4c2
mov dword [ebp - 0x420], esi
jmp 0x102f59c
push ebx
push edi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1002a80
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x1009ff0
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push esi
push 0x100a040
push 0x1005418
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x102f59a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x414]
push eax
push 0x100a038
mov dword [ebp - 0x41c], esi
call edi
test eax, eax
jne 0x102f547
mov dword [ebp - 0x41c], 1
jmp 0x102f57d
lea eax, [ebp - 0x414]
push eax
push 0x100a028
call edi
test eax, eax
jne 0x102f561
mov dword [ebp - 0x41c], esi
jmp 0x102f57d
lea eax, [ebp - 0x414]
push eax
push 0x100a01c
call edi
test eax, eax
jne 0x102f59a
mov dword [ebp - 0x41c], 2
push 4
lea eax, [ebp - 0x41c]
push eax
push 4
push esi
push 0x100a008
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
cmp dword [ebp - 0x418], esi
pop esi
je 0x102f5b1
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
call fcn.0101cfd1
leave
ret

Function at 0x10321d1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
mov esi, ecx
push esi
push 0x1031ebf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x90], eax
pop esi
mov eax, ecx
leave
ret