joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c6b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100d0ac]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x41
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x10c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
push 0x20019
xor edi, edi
push edi
push 0x10012a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002d53
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x11c]
push eax
push edi
push 0x10013b4
push dword [ebp - 0x114]
mov dword [ebp - 0x118], 0x105
mov dword [ebp - 0x11c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002d47
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x110], edi
call fcn.010027f9
push 0x10013a0
lea ecx, [ebp - 0x110]
call fcn.0100283f
cmp eax, edi
jne 0x1002d2c
xor esi, esi
inc esi
jmp 0x1002d38
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push esi
call eax
mov esi, eax
lea ecx, [ebp - 0x110]
call fcn.01002823
mov eax, esi
jmp 0x1002d56
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0x10
Function at 0x1003b9b
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push esi
mov esi, 0x400
push esi
mov dword [ebp - 4], esi
call fcn.0100a087
test eax, eax
mov dword [ebp - 8], eax
je 0x1003c6f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
push edi
push dword [ebp + 8]
mov edi, 0x1001548
push esi
push eax
push edi
call ebx
lea ecx, [eax + 2]
cmp ecx, esi
jne 0x1003c09
push dword [ebp - 8]
add dword [ebp - 4], esi
call fcn.0100a0a7
push dword [ebp - 4]
call fcn.0100a087
test eax, eax
mov dword [ebp - 8], eax
je 0x1003c6d
push dword [ebp + 8]
push dword [ebp - 4]
push eax
push edi
call ebx
lea ecx, [eax + 2]
cmp ecx, dword [ebp - 4]
je 0x1003bdd
test eax, eax
je 0x1003c6d
push dword [ebp - 4]
call fcn.0100a087
test eax, eax
mov dword [ebp - 0xc], eax
je 0x1003c6d
mov esi, dword [ebp - 8]
mov ebx, eax
jmp 0x1003c51
push esi
push 0x1001538
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1003c46
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [ebx + eax + 1]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x1003c23
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push 0
push edi
call esi
push dword [ebp + 8]
push dword [ebp - 0xc]
push edi
call esi
pop edi
pop ebx
push dword [ebp - 8]
call fcn.0100a0a7
push dword [ebp - 0xc]
call fcn.0100a0a7
pop esi
leave
ret 4

Function at 0x1003c89
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x100d0ac]
mov ecx, dword [ebp + 0xc]
push edi
lea edx, [ebp - 0x110]
push edx
push 0xf003f
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jle 0x1003cd6
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jl 0x1003d97
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
lea eax, [ebp - 0x124]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 0x110]
mov dword [ebp - 0x114], 0x104
call ebx
mov edi, 0x103
jmp 0x1003d55
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x110]
call fcn.01003c89
lea eax, [ebp - 0x124]
push eax
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push eax
push dword [ebp - 0x110]
mov dword [ebp - 0x114], 0x104
call ebx
mov esi, eax
cmp esi, edi
jne 0x1003d16
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1003d6f
cmp esi, edi
jne 0x1003d83
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
jle 0x1003d93
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.01009b9d
leave
ret 8
Function at 0x1003f18
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1001278
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003f6a
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1003f61
cmp dword [ebp - 8], esi
jbe 0x1003f61
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x1004ec8
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100d0ac]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 4], eax
xor edi, edi
call fcn.0100438f
test eax, eax
je 0x1004f7a
push 0x41
pop ecx
xor eax, eax
push 0x100
mov byte [ebp - 0x10c], bl
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
push ebx
push ebx
stosb byte es:[edi], al
push esi
mov eax, 0x105
push eax
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.01003258
cmp eax, ebx
jge 0x1004f2e
and eax, 0xffff
jmp 0x1004f78
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], 3
mov dword [ebp - 0x120], ebx
mov word [ebp - 0x11c], 0x414
mov dword [ebp - 0x11a], ebx
mov dword [ebp - 0x116], ebx
mov dword [ebp - 0x112], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 4
Function at 0x1005227
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp + 0x10]
call fcn.010049e4
test eax, eax
jl 0x10052f6
push edi
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x10c]
rep stosd dword es:[edi], eax
push 0x104
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push eax
push 0xc9
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x10c]
push 0x1001728
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x80
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x10052f5
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x33c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x33c]
push eax
mov dword [ebp - 0x338], 3
mov word [ebp - 0x32c], 0x14
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0xc
Function at 0x100566c
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x10056ec
cmp dword [ebp + 0x14], ebx
je 0x10056ec
push esi
push edi
mov esi, 0x104
push esi
call fcn.0100a087
mov edi, eax
cmp edi, ebx
je 0x10056e6
push dword [ebp + 0x14]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esi - 2]
cmp eax, ecx
jne 0x10056b6
cmp dword [ebp + 8], ebx
je 0x10056c7
cmp dword [ebp + 0xc], ebx
je 0x10056c7
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x10056da
cmp dword [ebp + 8], ebx
je 0x10056da
cmp dword [ebp + 0xc], ebx
je 0x10056da
add esi, esi
cmp esi, 0x100000
ja 0x10056e6
push esi
push edi
call fcn.0100a064
jmp 0x100568b
cmp eax, ebx
jne 0x10056e6
push edi
call fcn.0100a0a7
xor edi, edi
mov eax, edi
pop edi
pop esi
jmp 0x10056ee
xor eax, eax
pop ebx
pop ebp
ret 0x10

Function at 0x1005730
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.010056f8
test eax, eax
je 0x10057a8
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100579e
push esi
lea eax, [ebp - 0x10]
push eax
push 0x10018bc
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
pop esi
push dword [ebp - 4]
je 0x10057a2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10057b4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
leave
ret 8
Function at 0x10057bd
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x100d0ac]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10059ed
mov ecx, esi
call fcn.0100a62b
test eax, eax
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 0x1001754
mov ebx, 0x40046
je 0x100595f
push 0x10018fc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x32c]
call fcn.0100abed
lea ecx, [ebp - 0x32c]
call fcn.0100ab9e
cmp eax, ebx
jb 0x10059e2
lea ecx, [ebp - 0x32c]
call fcn.0100ab9e
cmp eax, ebx
jne 0x1005872
lea ecx, [ebp - 0x32c]
call fcn.0100abaa
cmp eax, 0x4bf
jb 0x10059e2
push 0x10018ec
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x444]
call fcn.0100abed
lea ecx, [ebp - 0x444]
call fcn.0100ab9e
cmp eax, ebx
jb 0x10059d7
lea ecx, [ebp - 0x444]
call fcn.0100ab9e
cmp eax, ebx
jne 0x10058d5
lea ecx, [ebp - 0x444]
call fcn.0100abaa
cmp eax, 0x47a
jb 0x10059d7
push 0x10018e0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x55c]
call fcn.0100abed
lea ecx, [ebp - 0x55c]
call fcn.0100ab9e
cmp eax, 0x40028
jb 0x10059cc
lea ecx, [ebp - 0x55c]
call fcn.0100ab9e
cmp eax, 0x40028
jne 0x100593e
lea ecx, [ebp - 0x55c]
call fcn.0100abaa
cmp eax, 0x1370000
jb 0x10059cc
lea ecx, [ebp - 0x55c]
call fcn.0100ab57
lea ecx, [ebp - 0x444]
call fcn.0100ab57
lea ecx, [ebp - 0x32c]
call fcn.0100ab57
push 0x10018d0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x674]
call fcn.0100abed
lea ecx, [ebp - 0x674]
call fcn.0100ab9e
cmp eax, ebx
jb 0x10059fe
lea ecx, [ebp - 0x674]
call fcn.0100ab9e
cmp eax, ebx
jne 0x10059ba
lea ecx, [ebp - 0x674]
call fcn.0100abaa
cmp eax, 0x515
jb 0x10059fe
xor esi, esi
inc esi
lea ecx, [ebp - 0x674]
call fcn.0100ab57
mov eax, esi
jmp 0x10059ef
lea ecx, [ebp - 0x55c]
call fcn.0100ab57
lea ecx, [ebp - 0x444]
call fcn.0100ab57
lea ecx, [ebp - 0x32c]
call fcn.0100ab57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 4
xor esi, esi
jmp 0x10059bd
Function at 0x1005a07
Capabilities:
Query environment variable
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x100d0ac]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
and dword [ebp - 0x324], 0
and dword [ebp - 0x320], 0
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x10c]
push 0x1001918
push eax
mov dword [ebp - 0x328], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, 0x104
push edi
lea eax, [ebp - 0x31c]
push eax
mov esi, 0x100190c
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1005b5b
cmp eax, edi
ja 0x1005b5b
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x31c]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1005b5b
push ebx
lea eax, [ebp - 0x31c]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + eax - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
push esi
lea eax, [ebp - 0x10c]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x320]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push 0x1001278
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
pop ebx
jne 0x1005b5b
lea eax, [ebp - 0x10c]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
xor esi, esi
inc esi
push esi
push 0
push dword [ebp - 0x328]
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1005b5b
mov dword [ebp - 0x324], esi
cmp dword [ebp - 0x320], 0
pop edi
pop esi
je 0x1005b72
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x324]
call fcn.01009b9d
leave
ret 0xc
Function at 0x100611a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x100d0ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xa4c], eax
je 0x10062ef
cmp byte [eax], bl
je 0x10062ef
cmp esi, ebx
je 0x10062ef
cmp byte [esi], bl
je 0x10062ef
push edi
xor eax, eax
mov edx, 0x82
mov ecx, edx
mov byte [ebp - 0x318], bl
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [ebp - 0x62c], bl
lea edi, [ebp - 0x62b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa44]
push eax
xor eax, eax
cmp dword [ebp + 0xc], ebx
push 0x20019
setne al
push ebx
push 0x1001278
mov dword [ebp - 0xa3c], 1
mov dword [ebp - 0xa48], 0x104
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10062e6
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
push ebx
push esi
push dword [ebp - 0xa44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10062e6
push 0x104
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10062e6
lea eax, [ebp - 0x10c]
push eax
call fcn.0100a023
test eax, eax
je 0x10062e6
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0xa38]
call fcn.0100a825
mov edi, dword [ebp - 0xa4c]
lea eax, [ebp - 0x82e]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10062ac
cmp dword [ebp + 0x18], ebx
jne 0x10062df
push 0x209
lea eax, [ebp - 0x318]
push eax
push 0xe9
push dword [ebp - 0xa40]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
lea eax, [ebp - 0x82e]
push eax
push edi
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x62c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10062df
push edi
push 0x100d0f8
lea eax, [ebp - 0x420]
push 0x1001974
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
call fcn.01005e9f
test eax, eax
jne 0x10062e6
or dword [ebp - 0xa3c], 0xffffffff
mov eax, dword [ebp - 0xa3c]
pop edi
jmp 0x10062f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0x14
Function at 0x10066c9
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x520]
push eax
push 0x20019
push 0
push 0x10012a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1006816
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x528], eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x528]
push eax
push 0
push 0x10019d0
push dword [ebp - 0x520]
call esi
test eax, eax
jne 0x10067a0
push ebx
lea ecx, [ebp - 0x518]
call fcn.0100a825
push 0x100143c
lea eax, [ebp - 0x30e]
push eax
lea eax, [ebp - 0x40f]
push eax
lea eax, [ebp - 0x413]
push eax
lea eax, [ebp - 0x10c]
push 0x10019c4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
push 0xffffffffffffffff
push 0x10018b4
push 0x1001888
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [ebp - 0x51c], eax
ja 0x1006806
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x528]
push eax
push 0
push 0x10019b0
push dword [ebp - 0x520]
call esi
test eax, eax
jne 0x10067d3
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp + 8]
ja 0x1006806
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x528]
push eax
push 0
push 0x100199c
push dword [ebp - 0x520]
call esi
test eax, eax
jne 0x100680a
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp + 0xc]
jbe 0x100680a
xor eax, eax
jmp 0x1006819
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0xc

Function at 0x100682c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
mov dword [ebp - 8], 0x8000ffff
call edi
mov esi, eax
test esi, esi
je 0x10068bb
push ebx
mov ebx, 0x10019e8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
lea eax, [esi + 1]
push eax
call fcn.0100a087
test eax, eax
mov dword [ebp - 4], eax
je 0x10068b3
push esi
push eax
call edi
test eax, eax
je 0x10068a9
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 4]
call fcn.0100a023
test eax, eax
je 0x10068a2
push 0x100
push 0x1001948
push dword [ebp - 4]
call fcn.0100acd2
mov dword [ebp - 8], eax
jmp 0x10068a9
mov dword [ebp - 8], 1
push dword [ebp - 4]
call fcn.0100a0a7
jmp 0x10068ba
mov dword [ebp - 8], 0x8007000e
pop ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x1006e99
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp + 0x14]
push 0x41
mov dword [ebp - 0x630], eax
xor eax, eax
pop ecx
mov byte [ebp - 0x10c], 0
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x628], al
mov ecx, 0xc3
lea edi, [ebp - 0x627]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x318], al
mov ecx, 0x82
lea edi, [ebp - 0x317]
push ebx
rep stosd dword es:[edi], eax
call fcn.0100a023
test eax, eax
je 0x1006fa4
push ebx
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0x10012fc
push 0x10012f0
push 0x10014a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1006fa4
cmp dword [ebp + 0x1c], 0
jne 0x1006fa0
push 0x208
lea eax, [ebp - 0x318]
push eax
push 0xe8
push dword [ebp - 0x62c]
call dword [sym.imp.USER32.dll_LoadStringA]
push dword [ebp - 0x630]
lea eax, [ebp - 0x10c]
push eax
push esi
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x41000
push esi
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x1006fa7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0x18
Function at 0x1007fb3
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov edx, dword [ecx + 8]
push esi
xor esi, esi
cmp edx, esi
je 0x100802a
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x1001c78
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], 0x1001c70
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
jne 0x100802a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100801a
call esi
mov esi, eax
jmp 0x100802a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
leave
ret

Function at 0x1008034
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7e8
mov eax, dword [0x100d0ac]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
je 0x10081cf
test esi, esi
je 0x10081cf
cmp byte [eax], 0
je 0x10081cf
cmp byte [esi], 0
je 0x10081cf
lea ecx, [ebp - 0x3d8]
call fcn.0100a525
push esi
lea ecx, [ebp - 0x7e4]
call fcn.0100a825
push esi
push 0
push 0x10018b4
push 0x1001888
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 4
jae 0x10081cf
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x1001d68
lea eax, [ebp - 0x5da]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x31c]
push 0x1001d60
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x31c]
push eax
call fcn.0100a023
test eax, eax
je 0x10081cf
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x31c]
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push 0x10012fc
push 0x1001d30
push 0x10012e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x214], 0
je 0x10081e0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push 0x1001d54
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea eax, [ebp - 0x7e8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x10c]
push eax
mov ebx, 0x80000000
push ebx
call edi
test eax, eax
jne 0x10081cf
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3d8]
call fcn.0100a67c
test eax, eax
jne 0x10081e0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push 0x1001d3c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x7e8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x10c]
push eax
push ebx
call edi
test eax, eax
jne 0x10081e0
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 8
xor eax, eax
inc eax
jmp 0x10081d1