joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43924a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x43928c
call fcn.00450a42
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x43928c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x439283
xor eax, eax
jmp 0x439294
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0043929a
pop edi
pop esi
pop ebx
ret 4

Function at 0x43b239
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x43b25b
cmp dword [edi + 0x3c], 0
jne 0x43b25b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00450a42
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0043b288
pop edi
pop esi
pop ebx
ret 8

Function at 0x43b2d6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00450a42
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43b307
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0043b31a
pop edi
pop esi
pop ebx
ret 8
Function at 0x43b617
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4653dc
call fcn.004254cc
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00450a42
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x43b656
call fcn.00450a42
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43b664
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x43b672
or eax, 0xffffffff
jmp 0x43b75a
mov ecx, esi
call fcn.0043b58d
mov dword [ebp - 0x14], eax
call fcn.004371c3
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x43b6a9
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x43b6a9
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00437177
push dword [ebp - 0x14]
call fcn.00436cc5
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0043b31a
cmp eax, edi
je 0x43b71c
test byte [esi + 0x24], 0x10
je 0x43b6ea
push 4
mov ecx, esi
pop ebx
call fcn.00439aea
test ah, 1
je 0x43b6e2
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004394a1
cmp dword [esi + 0x1c], edi
je 0x43b71c
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00439c5b
jmp 0x43b71c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x43b730
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x43b749
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x43b749
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0043b5c7
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x451411
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00450a42
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x45144e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45144e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x451452
xor eax, eax
jmp 0x4514d0
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00436762
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x45148a
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x451474
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004515c1
push ebx
mov edi, eax
call fcn.0043678b
test edi, edi
pop ecx
je 0x4514cc
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0045138a
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004514d5
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x452fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x452ffe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45301c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00452f36
jmp 0x45301c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45301c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00452f36
test edi, edi
mov eax, edi
jne 0x453006
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x101f229
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102737c]
test eax, eax
jne 0x101f2e6
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x101f2d8
cmp dword [ebp - 0x318], 2
jne 0x101f2ce
cmp dword [ebp - 0x324], 6
jae 0x101f2ce
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x1027380]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x101f2d8
push 0
push 8
lea eax, [ebp - 0x20c]
push eax
call fcn.01024b99
cmp eax, dword [0x1027380]
mov dword [0x102737c], eax
jne 0x101f2d8
push eax
call fcn.010247c7
jmp 0x101f2d8
mov eax, dword [0x1027380]
mov dword [0x102737c], eax
mov eax, dword [0x102737c]
test eax, eax
jne 0x101f2e6
mov eax, dword [0x1027380]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010234cb
leave
ret

Function at 0x101f31b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x101f3a7
push 0x10013f4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101f3a7
push 1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01023d69
mov ecx, dword [ebp - 0x210]
cmp ecx, 0x50000
mov eax, 0x60000
jb 0x101f397
cmp ecx, 0x50032
jae 0x101f39f
push 2
jmp 0x101f3a9
cmp ecx, 0x50032
jb 0x101f3a7
cmp ecx, eax
jae 0x101f3a7
push 3
jmp 0x101f3a9
push 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop eax
call fcn.010234cb
leave
ret
Function at 0x101f4d3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push 4
pop ebx
push ebx
push esi
push esi
push esi
push 0x1001460
push 0x80000001
call edi
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x101f574
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001448
push dword [ebp - 0x10]
call edi
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x101f56b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
mov edi, 0x1001430
push edi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 4], 0x100000
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.01024431
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101fa2c
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push 0x214
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 0x62c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101f43d
test eax, eax
je 0x101fb5e
cmp dword [ebp + 0x14], edi
lea eax, [ebp - 0x20c]
push eax
push esi
je 0x101fb20
lea eax, [ebp - 0x620]
push eax
call fcn.0101f785
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101fb05
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x101fb05
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
or eax, 4
mov dword [ebp - 0x418], eax
push edi
lea eax, [ebp - 0x62c]
push eax
push edi
call sub.ADVPACK.dll_ExecuteCabW
jmp 0x101fb5e
test byte [ebp + 0x18], 4
jne 0x101fb5e
lea eax, [ebp - 0x20c]
push eax
push 0x40
push 0xc
push 0xb
push edi
call fcn.0101f948
jmp 0x101fb5e
lea eax, [ebp - 0x414]
push eax
call fcn.0101f785
push ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101fb5e
push edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push edi
push edi
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x414]
push eax
push edi
call sub.ADVPACK.dll_RunSetupCommandW
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010234cb
leave
ret 0x14
Function at 0x101fb74
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x630]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, 0x1001708
push ebx
push SysStringLen
call edi
test eax, eax
jne 0x101fd28
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
push 0x10016f0
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x101fd1c
mov eax, 0x104
push ebx
push eax
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], esi
call fcn.0101f785
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x101fd10
mov ebx, 0x10016ec
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x101fc7d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x10016cc
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x101fcd4
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x80000001
call edi
test eax, eax
jne 0x101fcd4
push dword [ebp - 0x620]
push esi
push esi
call sub.ADVPACK.dll_RegRestoreAllW
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x62c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x62c]
mov dword [ebp - 0x628], 0x104
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x101fc30
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010234cb
leave
ret
Function at 0x10200b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
je 0x1020123
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x1001978
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020123
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x100195c
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102011a
test byte [ebp - 4], bl
je 0x102011a
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.010242b4
test eax, eax
jne 0x1020148
cmp esi, edi
mov eax, 0x1001938
jne 0x102013a
mov eax, 0x100191c
push dword [ebp + 0x14]
push esi
push esi
push eax
push dword [ebp + 0xc]
call fcn.0101fa2c
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0101fa2c
cmp esi, edi
je 0x102016d
push 0xd
push ebx
push esi
push 0x10018fc
push dword [ebp + 0xc]
call fcn.0101fa2c
push dword [ebp - 8]
push esi
call fcn.0101fdc6
cmp esi, edi
pop edi
pop esi
pop ebx
jne 0x1020182
call fcn.0101fb74
leave
ret 0x10

Function at 0x102018b
Capabilities:
Check os version
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10201cf
call fcn.0101f586
call fcn.0101f3bb
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x10201c9
call sub.iertutil.dll_Ordinal_37
call sub.iertutil.dll_Ordinal_33
call dword [sym.imp.SHELL32.dll_SHFlushSFCache]
cmp dword [ebp + 8], edi
mov eax, 0x1001a94
mov ebx, eax
je 0x1020272
call fcn.0101f31b
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push 2
push 8
lea eax, [ebp - 0x120]
push eax
push 0xb
push 0x1001a7c
push 0x1001a28
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0x114
lea eax, [ebp - 0x118]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1020266
cmp dword [ebp - 0x114], 6
jb 0x102024f
mov ebx, 0x10019fc
jmp 0x1020266
cmp dword [ebp - 0x114], 5
jne 0x1020266
cmp dword [ebp - 0x110], 2
jne 0x1020266
mov ebx, 0x10019d4
push edi
push ebx
push 0x10019bc
push dword [ebp + 8]
jmp 0x102027a
push edi
push eax
push 0x10019bc
push edi
call fcn.010200b4
cmp dword [ebp + 8], edi
pop edi
pop ebx
je 0x102028b
call fcn.0101f4d3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010234cb
leave
ret 4
Function at 0x10205b9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
or eax, 3
cmp dword [ebp + 0xc], esi
je 0x10205fa
lea ebx, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x210]
push ebx
push esi
push eax
push esi
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x102060b
lea ebx, [ebp - 0x210]
push ebx
push eax
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x102068b
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call fcn.010204ae
cmp dword [ebp + 0xc], esi
je 0x102064f
cmp dword [ebp + 0x10], esi
jne 0x1020642
cmp eax, esi
je 0x102067f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
jmp 0x1020670
cmp dword [ebp + 0x10], esi
jne 0x102066a
cmp eax, esi
jne 0x102067f
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x102067f
push esi
push 0x10013f0
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010234cb
leave
ret 0xc

Function at 0x10206d5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x90]
push ecx
push 1
xor esi, esi
push esi
push eax
push SysStringLen
mov dword [ebp - 0x88], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10207a4
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x90]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x90]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x10207a4
push esi
lea eax, [ebp - 0x88]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x88]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1020798
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010234cb
leave
ret 8
Function at 0x10207fa
Capabilities:
Delete registry value
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x102080f
push esi
call fcn.0102204d
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x102083a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x102082d
and eax, 0xfffffff9
jmp 0x1020830
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1020875
cmp dword [ebp + 0x10], 0
je 0x1020855
push dword [ebp + 8]
push 0x1001f98
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1020875
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x1001f98
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop ebp
ret 0xc

Function at 0x10208d1
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0102204d
mov esi, eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010234cb
leave
ret 8
Function at 0x1020a34
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x104
je 0x1020ac5
push 0x10020c8
lea eax, [ebp - 0x20c]
push eax
call fcn.01020999
mov eax, dword [0x102737c]
test eax, eax
jne 0x1020a8f
call fcn.0101f229
push ebx
lea ecx, [ebp - 0x414]
push ecx
push 0x10
push eax
call edi
test eax, eax
je 0x1020ac5
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x10020c8
lea eax, [ebp - 0x20c]
push eax
call fcn.01020999
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1002090
push 0x1002018
push SysStringLen
mov dword [ebp - 0x418], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1020b1c
mov eax, dword [0x102737c]
test eax, eax
jne 0x1020b0b
call fcn.0101f229
push ebx
lea ecx, [ebp - 0x414]
push ecx
push 0x11
push eax
call edi
test eax, eax
je 0x1020b54
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
test eax, eax
je 0x1020b54
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x10020c8
lea eax, [ebp - 0x20c]
push eax
call fcn.01020999
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010234cb
leave
ret

Function at 0x1020b68
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 2
push esi
push esi
push esi
push 0x1002170
push 0x80000001
mov edi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1020bc1
push 0x40
push 0x1002130
push 1
push esi
push 0x100211c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1020bb8
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret