joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104ad44
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x2d8]
push eax
push 3
xor esi, esi
push esi
push 0x1001b38
mov ebx, ecx
mov edi, 0x80000002
push edi
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x2d8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104aeb3
push dword [ebx + 0x10]
push 0x1001f20
push dword [ebp - 0x2d8]
call fcn.01047d8c
cmp dword [ebx + 0x18], esi
jne 0x104ae02
mov eax, dword [ebx + 0x10]
cmp eax, esi
je 0x104aea7
mov ecx, 0x1001e44
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x104addd
cmp dx, si
je 0x104add9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x104addd
add eax, 4
add ecx, 4
cmp dx, si
jne 0x104adb7
xor eax, eax
jmp 0x104ade2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x104aea7
push dword [ebx + 0x10]
push 0x10069f4
push dword [ebp - 0x2d8]
call fcn.01047d8c
jmp 0x104aea7
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2e4]
push eax
push esi
push 0x10069f4
push dword [ebp - 0x2d8]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e8], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x104aea1
cmp dword [ebp - 0x2e4], ebx
jne 0x104aea1
lea eax, [ebp - 0xcc]
push eax
push 0x1006530
lea eax, [ebp - 0x2d4]
push 0x208
push eax
call fcn.01035968
add esp, 0x10
test eax, eax
jl 0x104aea1
push esi
lea eax, [ebp - 0x2e0]
push eax
push esi
push 0x20006
push esi
push esi
push esi
lea eax, [ebp - 0x2d4]
push eax
push edi
mov dword [ebp - 0x2e0], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104aea1
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2dc]
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x2d8]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1002038
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104aef0
push dword [ebx + 0x20]
push 0x1002018
push dword [ebp - 0x2d8]
call fcn.01047d8c
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret
Function at 0x104c823
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x68], ebx
jne 0x104c8dd
cmp dword [esi + 0x6c], ebx
jne 0x104c8dd
mov eax, dword [esi + 0x2c]
cmp eax, 1
je 0x104c884
jle 0x104c8dd
cmp eax, 4
jle 0x104c85d
cmp eax, 6
jne 0x104c8dd
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x104c876
push ebx
push dword [esi + 0x14]
push eax
call fcn.0106337b
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], edx
jmp 0x104c8dd
push 0x10079a0
push 2
call fcn.01055c50
jmp 0x104c8dd
push dword [esi + 0x18]
mov dword [ebp - 4], ebx
call fcn.010561eb
test eax, eax
je 0x104c8dd
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x104c8dc
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x104c8d5
mov edx, dword [ebp - 4]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
cmp dword [esi + 0x54], ebx
jne 0x104c90b
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x104c90b
push eax
call fcn.010561eb
test eax, eax
jne 0x104c90b
push dword [esi + 0x1c]
call fcn.010561eb
test eax, eax
jne 0x104c90b
push 0x1007958
push 4
call fcn.01055c50
cmp dword [ebp + 8], ebx
je 0x104c918
mov eax, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
jmp 0x104c924
mov eax, dword [esi + 0x78]
add eax, dword [esi + 0x68]
mov edx, dword [esi + 0x7c]
adc edx, dword [esi + 0x6c]
pop esi
pop ebx
leave
ret 4
Function at 0x104ccdb
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x324], esi
cmp ecx, esi
je 0x104ce28
cmp eax, esi
je 0x104ce28
mov dword [ebp - 0x328], 0x80
mov dword [ebp - 0x318], esi
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x318]
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x104ce27
inc dword [ebp - 0x318]
lea eax, [ebp - 0x31c]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x314]
mov dword [ebp - 0x328], 0x80
mov dword [ebp - 0x31c], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x104ce27
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x320]
push eax
push esi
push 0x10077c4
push dword [ebp - 0x31c]
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x330], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x104ce00
cmp dword [ebp - 0x320], 1
jne 0x104ce00
push dword [ebp - 0x32c]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x104ce00
inc ebx
mov dword [ebp - 0x324], ebx
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x104cd2c
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x314]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x324]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 8
Function at 0x104d282
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x418], ebx
cmp edi, ebx
je 0x104d3b1
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x1007be0
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x104d2de
push 0x1007bbc
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x104d2de
mov dword [ebp - 0x418], 1
jmp 0x104d3b0
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x104d3b0
lea eax, [ebp - 0x414]
push eax
push 0x1007b9c
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0103592d
add esp, 0x10
test eax, eax
jl 0x104d3b0
cmp dword [ebp + 0xc], 0xd2af9
jne 0x104d397
lea eax, [ebp - 0x41c]
push eax
push 2
push ebx
push 0x1002568
push 0x80000002
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104d3b0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104d353
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
inc esi
push esi
push ebx
push 0x1007b74
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x41c]
mov dword [ebp - 0x418], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x104d3b0
push 0xffff
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0105983a
mov dword [ebp - 0x418], eax
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 8
Function at 0x104de87
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], edi
je 0x104df97
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x104deb9
sub eax, edx
sar eax, 1
lea edi, [eax + 0x15]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x104defd
push 0x1007d1c
push 2
call fcn.01055c50
mov eax, 0x8007000e
jmp 0x104dff7
mov eax, dword [0x1072c6c]
cmp eax, 0xff
jne 0x104df13
call fcn.01056455
mov dword [0x1072c6c], eax
test eax, eax
jbe 0x104df89
push eax
push dword [ebp + 0xc]
push 0x1007d08
push edi
push ebx
call fcn.0103592d
mov eax, dword [ebp + 0x14]
add esp, 0x14
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x104df4d
inc eax
cmp dword [ebp - 0xc], eax
je 0x104df82
push dword [ebp + 0xc]
push 0x1007cfc
push edi
push ebx
call fcn.0103592d
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x104dfc0
inc eax
cmp dword [ebp - 0xc], eax
jne 0x104dfc0
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
xor edi, edi
pop ecx
cmp dword [ebp - 0x10], edi
jne 0x104dfd0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x104dfc9
cmp dword [ebp - 0xc], 1
jne 0x104dfc9
mov dword [ebp - 4], edi
jmp 0x104dfd5
mov dword [ebp - 4], 0x80004005
jmp 0x104df89
mov dword [ebp - 4], 0x80004005
cmp dword [ebp - 4], edi
jl 0x104dff4
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x104dfe1
mov eax, 0x1007ad0
push eax
push dword [ebp + 0x10]
push 0x1007d34
push 4
call fcn.01055c8a
add esp, 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x104e003
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x430], 0
mov eax, ecx
cmp dword [eax + 4], 3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x434], ecx
jne 0x104e234
push ebx
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x104e233
push ebx
call fcn.010561eb
test eax, eax
je 0x104e233
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x104e053
push esi
sub eax, edx
sar eax, 1
push edi
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
pop ecx
mov dword [ebp - 0x42c], edi
test edi, edi
je 0x104e231
push ebx
push esi
push edi
call fcn.01035831
mov ebx, 0x1007d6c
push ebx
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x104e225
push 0x80000002
push dword [ebp - 0x42c]
xor eax, eax
mov word [esi], ax
call fcn.01057a8a
add esi, 2
push ebx
push esi
mov dword [ebp - 0x418], eax
call edi
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x104e0df
xor ecx, ecx
mov word [eax], cx
cmp esi, edi
je 0x104e225
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x104e0ec
sub eax, edx
sar eax, 1
je 0x104e225
lea eax, [ebp - 0x424]
push eax
push 0x20019
push edi
push esi
push dword [ebp - 0x418]
mov dword [ebp - 0x424], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104e225
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
xor ebx, ebx
mov esi, 0x104
push eax
inc ebx
mov dword [ebp - 0x418], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x420], ebx
jmp 0x104e209
inc dword [ebp - 0x418]
xor eax, eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x428], 0x208
cmp ax, word [ebp - 0x20c]
je 0x104e1de
cmp ax, word [ebp - 0x414]
je 0x104e1de
cmp dword [ebp - 0x420], ebx
je 0x104e1b3
cmp dword [ebp - 0x420], 2
jne 0x104e1cc
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x104e1bc
sub eax, edx
sar eax, 1
je 0x104e1de
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x430], ebx
test eax, eax
je 0x104e219
inc dword [eax]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
push dword [ebp - 0x424]
call edi
test eax, eax
je 0x104e178
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x42c]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x430]
xor ecx, ebp
call fcn.01047480
leave
ret 4
Function at 0x104e2b4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea esi, [edi + 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
cmp dword [esi], ebx
jne 0x104e3da
push 0x80
mov dword [ebp - 4], 0x80004005
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [esi], eax
cmp eax, ebx
jne 0x104e2f3
xor eax, eax
jmp 0x104e3e2
mov eax, dword [edi + 4]
cmp eax, ebx
jl 0x104e30e
cmp eax, 1
jle 0x104e304
cmp eax, 3
jne 0x104e30e
push 0x1007da0
jmp 0x104e3d1
mov dword [ebp - 0x14], ebx
cmp dword [edi + 0xc], ebx
je 0x104e3cc
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
test ebx, ebx
je 0x104e3cc
push ebx
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x104e3bc
push 0x5c
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x104e355
inc eax
inc eax
jmp 0x104e358
mov eax, dword [edi + 0xc]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
push ebx
mov dword [ebp - 8], eax
call fcn.01055e5e
push dword [ebp - 8]
push esi
push ebx
call fcn.010358a6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.010569c6
test eax, eax
jl 0x104e3bc
mov eax, dword [ebp - 0xc]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x10]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x1007d80
push esi
push ebx
call fcn.0103592d
add esp, 0x1c
push ebx
mov ecx, edi
call fcn.0104c142
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 1
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
cmp dword [ebp - 0x14], 0
pop ecx
jne 0x104e3da
mov esi, dword [ebp - 0x18]
push 0x1007d70
push esi
call fcn.0105849d
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], eax
setge al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x104ebfc
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], esi
mov eax, dword [ebp - 0x110]
sub eax, esi
je 0x104ec80
dec eax
je 0x104ec74
dec eax
je 0x104ec68
dec eax
je 0x104ec5c
mov dword [ebp - 0x108], 0x1007874
jmp 0x104ec8a
mov dword [ebp - 0x108], 0x1007860
jmp 0x104ec8a
mov dword [ebp - 0x108], 0x1007830
jmp 0x104ec8a
mov dword [ebp - 0x108], 0x1007848
jmp 0x104ec8a
mov dword [ebp - 0x108], 0x1007884
lea eax, [ebp - 0x10c]
push eax
push 0x2001f
push esi
push dword [ebp - 0x108]
push dword [ebp - 0x124]
call edi
cmp eax, esi
jne 0x104ed67
mov dword [ebp - 0x118], 0x80
xor ebx, ebx
mov dword [ebp - 0x114], esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x104ed5b
lea eax, [ebp - 0x114]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
mov dword [ebp - 0x118], 0x80
inc ebx
call edi
cmp eax, esi
jne 0x104ed5b
lea eax, [ebp - 0x104]
push eax
push 0x1007fcc
push 4
call fcn.01055c8a
mov ecx, dword [ebp - 0x120]
add esp, 0xc
push dword [ebp - 0x108]
push dword [ebp - 0x114]
call fcn.0104e9f9
cmp eax, esi
push dword [ebp - 0x114]
mov dword [ebp - 0x11c], eax
jl 0x104ed55
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x104ecbf
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x11c]
cmp eax, esi
jl 0x104ed84
inc dword [ebp - 0x110]
cmp dword [ebp - 0x110], 5
jl 0x104ec3d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 4
Function at 0x104ed9a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0xd8], eax
cmp eax, esi
jne 0x104edc9
mov eax, 0x80004003
jmp 0x104efd6
push ebx
mov ebx, dword [ecx]
cmp ebx, esi
je 0x104efd3
push edi
mov ecx, dword [ebx]
cmp ecx, esi
je 0x104efc7
mov edi, 0xc8
push edi
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xd4], esi
call fcn.0104e635
test eax, eax
jne 0x104efc7
lea eax, [ebp - 0xcc]
push eax
push 0x100789c
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x104efc7
lea eax, [ebp - 0xcc]
push eax
push 0x1007ff4
push 4
call fcn.01055c8a
add esp, 0xc
push esi
lea eax, [ebp - 0xd4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104efc7
mov ecx, dword [ebx]
push edi
lea eax, [ebp - 0xcc]
push eax
call fcn.0104e3ec
test eax, eax
je 0x104efbb
mov eax, dword [ebx]
cmp dword [eax + 4], 3
jne 0x104ee85
cmp dword [eax], 4
je 0x104efbb
mov edi, dword [eax + 0xc]
cmp edi, esi
je 0x104efbb
push edi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd4]
call fcn.01059fde
mov dword [ebp - 0xd0], eax
cmp eax, esi
je 0x104efbb
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x104eeb6
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push esi
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebx]
push 0x64
lea eax, [ebp - 0xcc]
push eax
call fcn.0104e3ec
test eax, eax
je 0x104ef27
lea eax, [ebp - 0xcc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x104eef7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push esi
push 0x100760c
push dword [ebp - 0xd0]
push dword [ebp + 0xc]
call fcn.01057a24
mov ecx, dword [ebx]
push 0xc8
lea eax, [ebp - 0xcc]
push eax
call fcn.0104e635
test eax, eax
jl 0x104ef77
lea eax, [ebp - 0xcc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x104ef47
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push esi
push 0x10077e0
push dword [ebp - 0xd0]
push dword [ebp + 0xc]
call fcn.01057a24
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
cmp ecx, esi
je 0x104efaf
mov eax, ecx
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x104ef85
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push esi
push 0x1007578
push dword [ebp - 0xd0]
push dword [ebp + 0xc]
call fcn.01057a24
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebx + 4]
cmp ebx, esi
jne 0x104edd5
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 8
Function at 0x104f068
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x48], 0
push edi
je 0x104f16b
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x104f16b
mov eax, ecx
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x104f09b
sub eax, edi
sar eax, 1
cmp eax, 6
jbe 0x104f16b
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
push ebx
push 0x5c
push ecx
call edi
push dword [esi + 0x18]
mov ebx, eax
push 0x1008030
push 4
mov dword [ebp - 0x418], 1
call fcn.01055c8a
add esp, 0x14
test ebx, ebx
je 0x104f0e5
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x414]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x104f16a
lea eax, [ebp - 0x414]
push eax
call fcn.01055e5e
push dword [esi + 0x18]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01035831
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x104f12f
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x104f15d
lea eax, [ebp - 0x418]
push eax
push dword [esi + 0x18]
call fcn.010592bb
push dword [esi + 0x18]
jmp 0x104f164
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop ebx
xor edi, edi
cmp dword [esi + 0x4c], edi
je 0x104f185
cmp dword [ebp + 8], edi
je 0x104f185
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x104f185
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x50], edi
je 0x104f1a4
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x104f1a4
push eax
call fcn.010587e2
test eax, eax
je 0x104f1a4
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 4
Function at 0x104f27f
Capabilities:
Get common file path
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push eax
lea edi, [esi + 4]
push edi
call fcn.0105849d
mov dword [ebp - 0x210], eax
test eax, eax
jl 0x104f381
mov ecx, esi
call fcn.0104f1b9
cmp dword [esi + 0x84], 0
je 0x104f381
push ebx
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x104f380
lea eax, [ebp - 0x20c]
push eax
call fcn.01055e5e
push dword [edi]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.010358a6
lea eax, [ebp - 0x20c]
push eax
call fcn.010561eb
test eax, eax
je 0x104f380
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x104f380
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x104f379
mov ecx, dword [ebp - 0x214]
xor edx, edx
or edx, eax
or ecx, edi
cmp edx, dword [esi + 0x70]
jne 0x104f379
cmp ecx, dword [esi + 0x74]
jne 0x104f379
lea eax, [ebp - 0x20c]
push eax
add esi, 0x1c
push esi
call fcn.0105849d
mov dword [ebp - 0x210], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 4