joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c357a88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x7c357aa8
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.7c349ee2
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x7c357acb
test byte [esp + 8], 2
je 0x7c357acb
call sym.MSVCR71.dll__errno
mov dword [eax], 0xd
call sym.MSVCR71.dll___doserrno
mov dword [eax], 5
jmp 0x7c357aa4
xor eax, eax
ret

Function at 0x7c357ace
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x230
push 0x7c380d58
call fcn.7c34230b
mov eax, dword [0x7c38b118]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x230]
xor ebx, ebx
mov dword [ebp - 0x238], ebx
or dword [ebp - 0x234], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x7c357bdc
mov eax, edi
push eax
push 0x105
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
mov dword [ebp - 0x23c], esi
cmp esi, 0x104
jle 0x7c357b8e
mov dword [ebp - 4], ebx
lea eax, [esi + esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.7c341395
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x240], edi
jmp 0x7c357b7b
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x7c357bdc
push edi
inc esi
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebx
je 0x7c357bdc
mov ax, word [edi]
cmp ax, 0x5c
je 0x7c357ba1
cmp ax, 0x2f
jne 0x7c357ba7
cmp ax, word [edi + 2]
je 0x7c357bd6
mov word [ebp - 0x24], 0x3d
xor eax, eax
mov ax, word [edi]
push eax
call sym.MSVCR71.dll_towupper
pop ecx
mov word [ebp - 0x22], ax
mov word [ebp - 0x20], 0x3a
mov word [ebp - 0x1e], bx
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x7c357bdc
mov dword [ebp - 0x234], ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.7c349ee2
pop ecx
cmp dword [ebp - 0x238], ebx
je 0x7c357bf8
push edi
call sym.MSVCR71.dll_free
pop ecx
mov eax, dword [ebp - 0x234]
lea esp, [ebp - 0x24c]
mov ecx, dword [ebp - 0x1c]
call fcn.7c341aed
call fcn.7c342346
ret

Function at 0x7c357c12
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7c357c3f
test byte [esp + 8], 0x80
je 0x7c357c2d
and eax, 0xfffffffe
jmp 0x7c357c30
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
jne 0x7c357c50
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.7c349ee2
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x7c3631e0
Capabilities:
Create pipe

Disassembly:
push 0x24
push 0x7c381ef0
call fcn.7c34230b
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov dword [ebp - 0x34], 0xc
and dword [ebp - 0x30], 0
mov al, byte [ebp + 0x10]
and al, 0x80
neg al
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
jne 0x7c36323c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.7c349ee2
pop ecx
mov eax, esi
jmp 0x7c3633d4
call fcn.7c3531c6
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
je 0x7c363398
and dword [ebp - 4], 0
mov ecx, edi
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov byte [ecx + eax*4 + 4], 0x89
mov dword [ebp - 4], esi
call fcn.7c36335a
call fcn.7c3531c6
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x7c363378
mov dword [ebp - 4], 1
mov ecx, esi
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov byte [ecx + eax*4 + 4], 0x89
or dword [ebp - 4], 0xffffffff
call fcn.7c36336b
mov eax, 0x8000
test dword [ebp + 0x10], eax
jne 0x7c3632c3
test byte [ebp + 0x11], 0x40
jne 0x7c3632f9
cmp dword [sym.MSVCR71.dll__fmode], eax
jne 0x7c3632f9
mov ecx, edi
sar ecx, 5
mov eax, edi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
and byte [eax], 0x7f
mov ecx, esi
sar ecx, 5
mov eax, esi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
and byte [eax], 0x7f
test byte [ebp + 0x10], 0x80
je 0x7c363335
mov ecx, edi
sar ecx, 5
mov eax, edi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
or byte [eax], 0x10
mov ecx, esi
sar ecx, 5
mov eax, esi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
or byte [eax], 0x10
push dword [ebp - 0x24]
push edi
call fcn.7c352fc8
push dword [ebp - 0x28]
push esi
call fcn.7c352fc8
add esp, 0x10
call sym.MSVCR71.dll__errno
and dword [eax], 0
jmp 0x7c3633a6
mov ecx, edi
sar ecx, 5
mov eax, edi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov byte [ecx + eax*4 + 4], 0
call sym.MSVCR71.dll__errno
jmp 0x7c3633a0
call sym.MSVCR71.dll__errno
mov esi, dword [ebp - 0x20]
mov dword [eax], 0x18
call sym.MSVCR71.dll__errno
cmp dword [eax], 0
je 0x7c3633cd
push dword [ebp - 0x24]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
call sym.MSVCR71.dll___doserrno
and dword [eax], 0
or eax, 0xffffffff
jmp 0x7c3633d4
mov dword [ebx], edi
mov dword [ebx + 4], esi
xor eax, eax
call fcn.7c342346
ret
Function at 0x7c366d53
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x7c3916c0]
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x7c366d9c
call ebp
mov esi, eax
cmp esi, ebx
je 0x7c366d82
mov dword [0x7c3916c0], 1
jmp 0x7c366da1
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c366d97
push 2
pop eax
mov dword [0x7c3916c0], eax
jmp 0x7c366d9c
mov eax, dword [0x7c3916c0]
cmp eax, 1
jne 0x7c366df9
cmp esi, ebx
jne 0x7c366db4
call ebp
mov esi, eax
cmp esi, ebx
jne 0x7c366db4
xor eax, eax
jmp 0x7c366ea0
cmp word [esi], bx
mov eax, esi
je 0x7c366dc9
inc eax
inc eax
cmp word [eax], bx
jne 0x7c366dbb
inc eax
inc eax
cmp word [eax], bx
jne 0x7c366dbb
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call sym.MSVCR71.dll_malloc
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x7c366dec
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x7c366ea0
push ebp
push esi
push edi
call fcn.7c35c2a2
add esp, 0xc
jmp 0x7c366dde
cmp eax, 2
je 0x7c366e02
cmp eax, ebx
jne 0x7c366dad
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x7c366dad
cmp byte [ebp], bl
mov esi, ebp
je 0x7c366e38
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x7c366dad
push esi
add edi, eax
call sym.MSVCR71.dll_strlen
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x7c366e15
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call sym.MSVCR71.dll_malloc
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7c366eb1
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x7c366e92
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x7c366ea7
push edi
call sym.MSVCR71.dll_strlen
push esi
lea edi, [edi + eax + 1]
call sym.MSVCR71.dll_wcslen
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x7c366e58
push ebp
mov word [esi], bx
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call sym.MSVCR71.dll_free
pop ecx
push ebp
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
jmp 0x7c366dad
Function at 0x7c370627
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x7c370648
lea eax, [ebp - 4]
push eax
call fcn.7c35c2a2
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call fcn.7c35c2a2
test eax, eax
pop ecx
jne 0x7c370669
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x7c37076a
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp.kernel32.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x7c37075b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c37075b
push edi
call fcn.7c35c2a2
test eax, eax
pop ecx
je 0x7c37075b
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x7c37075b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c37075b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sym.MSVCR71.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp.kernel32.dll_SetFileTime]
test eax, eax
je 0x7c37075b
xor eax, eax
jmp 0x7c370769
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x7c3707a4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x7c3707cb
lea eax, [ebp - 0x30]
push eax
call fcn.7c35c2a2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x38]
lea eax, [edi + 8]
push eax
call fcn.7c35c2a2
test eax, eax
pop ecx
jne 0x7c3707ec
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x7c3708ed
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
push esi
mov esi, dword [sym.imp.kernel32.dll_SystemTimeToFileTime]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x7c3708de
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c3708de
push edi
call fcn.7c35c2a2
test eax, eax
pop ecx
je 0x7c3708de
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x7c3708de
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c3708de
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call sym.MSVCR71.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp.kernel32.dll_SetFileTime]
test eax, eax
je 0x7c3708de
xor eax, eax
jmp 0x7c3708ec
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x10029a7
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
je 0x1005306
cmp dword [ebp - 4], 0
je 0x1005319
lea eax, [ebp - 8]
push eax
call fcn.01003c62
pop ecx
test eax, eax
jne 0x100531d
push esi
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 4]
call esi
test eax, eax
je 0x10029fc
mov al, 1
pop esi
leave
ret
lea eax, [ebp - 8]
push eax
call fcn.01002a24
pop ecx
test eax, eax
jne 0x1005325
push dword [ebp - 8]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10029f7
jmp 0x100532d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005528
call fcn.0100b375
pop ecx
pop ecx
xor al, al
leave
ret
push eax
push 0x1005490
jmp 0x1005312
push eax
push 0x1005408
jmp 0x1005341
lea eax, [ebp - 8]
push eax
call fcn.0100804e
pop ecx
test eax, eax
je 0x100534f
push eax
push 0x1005368
call fcn.0100b375
pop ecx
pop ecx
xor al, al
jmp 0x10029f9
push dword [ebp - 8]
push dword [ebp - 4]
call esi
test eax, eax
setne al
jmp 0x10029f9
Function at 0x100479c
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa30], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
call fcn.010024b3
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0xa20]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0xa28], 0x401
push 0
push edi
mov dword [ebp - 0xa38], eax
call esi
test eax, eax
jne 0x100486d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa34]
push eax
push 0x20019
push 0
push dword [ebp - 0x21c]
push edi
call fcn.01002171
add esp, 0x14
mov dword [ebp - 0xa40], eax
test eax, eax
jne 0x1005762
push dword [ebp - 0xa34]
call fcn.0100465a
pop ecx
test al, al
je 0x10056da
inc dword [ebp - 0xa30]
push dword [ebp - 0xa34]
call ebx
push dword [ebp - 0xa38]
push dword [ebp - 0x21c]
push dword [ebp - 0xa30]
push edi
call esi
test eax, eax
je 0x1004807
cmp eax, 0x103
jne 0x100575a
lea ecx, [ebp - 0xa2c]
call fcn.010048a9
cmp dword [ebp - 0x218], 0x105
jg 0x10057c2
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
push dword [ebp - 0xa34]
call ebx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xa3c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0xa3c]
push ecx
push eax
push 1
push eax
push 0x403
push eax
push 2
call fcn.010087d4
push dword [ebp - 0x21c]
push 0x1005918
push dword [ebp - 0xa28]
push dword [ebp - 0xa2c]
call fcn.01008f2a
add esp, 0x30
test eax, eax
jl 0x100573b
push 0
push dword [ebp - 0xa2c]
call fcn.0100b375
pop ecx
pop ecx
push dword [ebp - 0x21c]
push edi
call fcn.0100bc73
pop ecx
pop ecx
test al, al
jne 0x100484c
push 0
push 0x10058a8
jmp 0x1005791
push eax
push 0x1005840
jmp 0x1005791
push dword [ebp - 0x21c]
push 0x10057d8
push dword [ebp - 0xa28]
push dword [ebp - 0xa2c]
call fcn.01008f2a
add esp, 0x10
test eax, eax
jl 0x1005798
push dword [ebp - 0xa40]
push dword [ebp - 0xa2c]
call fcn.0100b375
pop ecx
pop ecx
lea ecx, [ebp - 0xa2c]
call fcn.010048a9
cmp dword [ebp - 0x218], 0x105
jle 0x10057bb
push dword [ebp - 0x21c]
call fcn.0100884e
pop ecx
xor al, al
jmp 0x1004895
push dword [ebp - 0x21c]
call fcn.0100884e
pop ecx
jmp 0x1004893

Function at 0x1004a2c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x114
mov byte [eax], 0
lea eax, [ebp - 0x118]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1007bd4
cmp dword [ebp - 0x114], 5
jbe 0x1007bc5
push 0x1004aa8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001d10
leave
ret
jne 0x1007bd4
cmp dword [ebp - 0x110], 1
jae 0x1004a8e
push 0x1004aa8
call fcn.01004361
pop ecx
jmp 0x1004a99
Function at 0x1008869
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100fe04]
cmp eax, 0xffffffff
je 0x100888f
test eax, eax
setne al
jmp 0x10088f9
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x10088f0
cmp dword [ebp - 0x114], 5
jb 0x10088f0
and dword [ebp - 0x11c], 0
push 0
push 4
lea eax, [ebp - 0x11c]
push eax
push 0x1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x100fe34]
test eax, eax
jl 0x10088f0
cmp dword [ebp - 0x11c], 0
je 0x10088f0
xor eax, eax
inc eax
mov dword [0x100fe04], eax
jmp 0x10088f9
and dword [0x100fe04], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001d10
leave
ret

Function at 0x1008fb1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov byte [ebp - 0x205], 1
xor ebx, ebx
jmp 0x1009076
mov eax, dword [esi]
add esi, 4
push dword [esi]
mov dword [ebp - 0x20c], ebx
push eax
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.01008f2a
add esp, 0x10
add esi, 4
test eax, eax
jl 0x1009093
mov eax, dword [esi]
push ebx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x204]
add esi, 4
mov edi, dword [esi]
push eax
push 0x80000000
add esi, 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1009064
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x210]
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100906a
mov byte [ebp - 0x205], bl
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], ebx
jne 0x1008fda
mov al, byte [ebp - 0x205]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
xor al, al
jmp 0x1009084

Function at 0x100909c
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, 1
jmp 0x1009101
mov eax, dword [esi]
add esi, 4
push dword [esi]
push eax
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.01008f2a
add esp, 0x10
test eax, eax
jl 0x1009116
lea eax, [ebp - 0x204]
push eax
push 0x80000000
add esi, 0xc
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 0x3fa
je 0x1009101
cmp eax, 2
je 0x1009101
test eax, eax
je 0x1009101
xor bl, bl
cmp dword [esi], 0
jne 0x10090ba
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
xor al, al
jmp 0x1009108
Function at 0x10096c7
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], 0x100fdf4
mov ebx, 0x1002090
push dword [ebx]
mov esi, 0x100fcd0
push 0x1007f18
push 0x28
push 0x100f470
call fcn.01008f2a
add esp, 0x10
cmp eax, edi
jl 0x1009853
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
cmp eax, edi
je 0x100973a
push eax
push 0x28
push 0x100f420
call fcn.01008e44
cmp eax, edi
jl 0x1009853
cmp dword [0x100fcd0], edi
je 0x10097a1
lea ecx, [esi + 4]
cmp dword [ecx], edi
je 0x100979d
cmp dword [esi + 8], edi
je 0x100979d
mov eax, dword [esi]
mov esi, ecx
mov ecx, dword [esi]
push ecx
push eax
lea eax, [ebp - 0xa4]
push 0x50
push eax
add esi, 4
call fcn.01008f2a
add esp, 0x10
cmp eax, edi
jl 0x1009853
lea eax, [ebp - 0xa4]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 0x3fa
je 0x100979a
cmp eax, 2
je 0x100979a
cmp eax, edi
je 0x100979a
inc dword [ebp - 0xac]
add esi, 0xc
cmp dword [esi], edi
jne 0x1009742
add dword [ebp - 0xa8], 4
add ebx, 0x10
cmp ebx, 0x10020a0
jl 0x10096f6
mov esi, 0x2001f
call fcn.01008869
movzx ebx, al
cmp ebx, edi
je 0x10097cd
mov esi, 0x2011f
lea eax, [ebp - 0xa8]
push eax
push esi
push edi
mov edi, 0x10020d0
push edi
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1009814
test ebx, ebx
jne 0x10097f7
push 0x1007ef4
jmp 0x10097fc
push 0x1007edc
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1009820
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
call fcn.0100890a
test al, al
je 0x1009834
push 0x100fd24
call fcn.0100909c
pop ecx
call fcn.0100890a
test al, al
jne 0x1009846
call fcn.01008869
test al, al
je 0x1009851
push 0x100fde0
call fcn.0100909c
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001d10
leave
ret
Function at 0x1009e41
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x100e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
push 0x100f9f8
push dword [0x100e014]
xor eax, eax
mov word [0x100fbfe], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1009e83
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1009fcd
xor eax, eax
and dword [ebp - 0x80c], eax
push esi
mov word [0x100fbfe], ax
mov esi, 0x100fd48
cmp dword [0x100fd4c], eax
je 0x1009fa9
push ebx
push edi
push 4
pop ebx
mov edi, 0x401
mov eax, dword [esi]
add esi, ebx
test eax, eax
jne 0x1009f9a
mov ecx, dword [esi]
add esi, ebx
mov edx, dword [esi]
add esi, ebx
mov eax, dword [esi]
add esi, ebx
test eax, eax
je 0x1009ede
push eax
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f2a
add esp, 0x14
jmp 0x1009ef0
push edx
push ecx
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f2a
add esp, 0x10
xor ecx, ecx
cmp eax, ecx
jge 0x1009f04
inc dword [ebp - 0x80c]
add esi, 8
jmp 0x1009f9d
push ecx
lea eax, [ebp - 0x810]
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x808]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1009f31
inc dword [ebp - 0x80c]
mov eax, dword [esi]
test eax, eax
je 0x1009f89
add esi, ebx
push dword [esi]
push eax
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.01008f2a
add esp, 0x10
add esi, ebx
test eax, eax
jl 0x1009f81
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x808]
push eax
push 1
push 0
push 0
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1009f8c
inc dword [ebp - 0x80c]
jmp 0x1009f8c
add esi, 8
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1009f9d
add esi, 0x14
cmp dword [esi + 4], 0
jne 0x1009ead
pop edi
pop ebx
push 0
push 0
push 0x1000
push 0x8000000
call dword [0x100fe20]
mov eax, dword [ebp - 0x80c]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001d10
leave
ret