joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a4a
Capabilities:
Accept command line arguments
Query or enumerate registry value
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
push 0x1001d3c
xor ebx, ebx
push 0x20
push ebx
push 2
pop edi
push edi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [0x100e028], eax
je 0x1003b15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1003b22
mov eax, dword [0x10017dc]
push 0x4a
mov dword [ebp - 0x134], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x130]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x134]
push 0x12c
push eax
push 0x1f4
push dword [0x100f270]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1003ad6
lea eax, [ebp - 0x134]
push 0x1001d04
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x134]
push eax
push 0x1001cf4
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp esi, ebx
je 0x1003b09
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp esi, edi
je 0x1003b09
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [0x100e028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ax, word [esi]
cmp ax, 0x22
jne 0x1003b56
mov ax, word [esi + edi]
add esi, edi
cmp ax, bx
je 0x1003b4c
cmp ax, 0x22
jne 0x1003b3b
cmp word [esi], 0x22
jne 0x1003b64
add esi, edi
jmp 0x1003b64
cmp ax, 0x20
jbe 0x1003b64
add esi, edi
cmp word [esi], 0x20
ja 0x1003b5c
mov ax, word [esi]
cmp ax, bx
je 0x1003b76
cmp ax, 0x20
ja 0x1003b76
add esi, edi
jmp 0x1003b64
lea eax, [ebp - 0x210]
push 0x1001c50
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0x208
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push 0x10017cc
push eax
call edi
lea eax, [ebp - 0x210]
push 0x1001cd8
push eax
call edi
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x210]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003c12
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push 0x1001ccc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003c12
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp + eax*2 - 0x41a], bx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp - 4], ebx
je 0x1003c20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xa
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
mov esi, eax
call fcn.010039ac
push dword [0x100e028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
jmp 0x1003b17
Function at 0x1005650
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x208]
push esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10056f9
lea eax, [ebp - 0x208]
push 0x1001e88
push eax
lea eax, [ebp - 0x410]
push 0x1001e7c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call esi
cmp eax, 0xffffffff
je 0x10056c8
lea eax, [ebp - 0x410]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x208]
push 0x1001e68
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x208]
push eax
call esi
cmp eax, 0xffffffff
je 0x10056f9
test al, 0x10
je 0x10056f9
lea eax, [ebp - 0x208]
push eax
call fcn.010056fc
pop ecx
pop esi
leave
ret

Function at 0x10056fc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x1001eac
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
sete cl
test ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, 0x80
jne 0x10057fb
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push dword [ebp + 8]
push 0x1001970
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0x460], 0x10
jne 0x10057b6
lea eax, [ebp - 0x434]
push 0x1001ea8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10057cd
lea eax, [ebp - 0x434]
push 0x1001ea0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10057cd
lea eax, [ebp - 0x210]
push eax
call fcn.010056fc
pop ecx
jmp 0x10057cd
lea eax, [ebp - 0x210]
push ebx
push eax
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10057f1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x1005757
push ebx
push dword [ebp + 8]
call edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10058b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push edi
push eax
xor esi, esi
push 0x1001ee4
push 0x80000001
mov dword [ebp - 4], esi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1005916
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1001ebc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005916
cmp dword [ebp - 0xc], esi
je 0x1005916
push 1
pop edi
cmp dword [ebp - 4], esi
je 0x1005924
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1005ca6
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x100e038], ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetParent]
push edi
je 0x1005cd4
mov edx, dword [ebp + 0x14]
mov eax, dword [0x100f288]
or edx, 8
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x28]
jmp 0x1005d7d
cmp dword [ebp + 8], ebx
je 0x1005e4a
cmp dword [0x100f288], ebx
jne 0x1005d14
push 0x100f288
push 0x1002000
push 1
push ebx
push 0x1001ff0
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x1005d09
cmp dword [0x100f288], ebx
jne 0x1005d14
mov dword [0x100e034], ebx
jmp 0x1005e4a
cmp dword [0x100e020], ebx
jne 0x1005d6b
push 0xc
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x1005d31
mov ecx, eax
call fcn.01005b73
jmp 0x1005d33
xor eax, eax
mov dword [0x100e020], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push dword [ebp + 8]
call esi
mov ecx, dword [0x100e020]
push dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [0x100f288]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [0x100f288]
push dword [0x100e020]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edx, dword [ebp + 0x14]
mov eax, dword [0x100f288]
or edx, 8
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x1005da3
push dword [ebp + 0x10]
mov eax, dword [0x100f288]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x1005da3
push 1
pop eax
mov dword [0x100e038], eax
jmp 0x1005e4c
cmp dword [0x100f288], ebx
je 0x1005e4a
cmp dword [0x100e06c], ebx
jne 0x1005e4a
cmp dword [0x100e070], ebx
jne 0x1005e4a
lea eax, [ebp + 0x14]
push eax
push 0xf003f
push ebx
push 0x1001880
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005e4a
lea eax, [ebp + 0xc]
mov edi, 0x1002010
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
mov dword [ebp + 0x10], ebx
push dword [ebp + 0x14]
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [ebp + 0x12], 0x80
je 0x1005e4a
push ebx
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call esi
push eax
call fcn.01009b51
pop ecx
mov dword [0x100e040], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005e51
Capabilities:
Check if file exists
Get common file path
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
cmp dword [0x100f294], 0
push ebx
push 1
pop ebx
jne 0x1005f14
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1005f05
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x210]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_CharPrevW]
cmp word [eax], 0x5c
je 0x1005ec3
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push eax
call esi
push eax
mov word [eax], 0x5c
call esi
and word [eax], 0
lea eax, [ebp - 0x210]
push 0x1002070
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
push 0
push 0x1002054
push 0x100204c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jne 0x1005f05
push 0x1002024
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1005f05
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop esi
mov dword [eax], ecx
mov dword [0x100f294], ebx
mov eax, ebx
pop ebx
leave
ret

Function at 0x10064e7
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x20]
push 0x11
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x80]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push esi
push 0x1002088
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1006587
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, 0xff
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push esi
push eax
push 1
call edi
cmp eax, 1
jne 0x1006577
push 1
push esi
push esi
lea eax, [ebp - 0x3c]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x100656b
cmp dword [ebp - 0x38], 0x12
je 0x1006577
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1006546
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push esi
push eax
push 1
jmp 0x100653f
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x20]
call edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push 0x1001880
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10065df
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 3
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x10020a0
mov dword [ebp - 8], esi
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x10065e2
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10075fc
Capabilities:
Set registry value

Disassembly:
push 1
call fcn.01007615
pop ecx
push dword [0x100f270]
call fcn.01007cbb
pop ecx
jmp fcn.0100995f

Function at 0x1007615
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push edi
mov esi, 0xf003f
push eax
xor edi, edi
push esi
push edi
push 0x10021c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100768a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push edi
push edi
push edi
push 0x10020c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1007685
lea eax, [ebp - 8]
push 4
push eax
push 4
push edi
push 0x10021bc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
leave
ret

Function at 0x100768e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 4
lea eax, [ebp - 4]
pop esi
xor edi, edi
push eax
push 0xf003f
push edi
push 0x1002148
push 0x80000001
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10076f0
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x10021a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10076e7
cmp dword [ebp - 0x10], 1
sete al
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100786d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10017dc]
push edi
mov dword [ebp - 0x208], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x204]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x208]
push eax
call fcn.010076f6
cmp word [ebp - 0x208], 0
pop ecx
je 0x10078e5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x208]
push 0x10017cc
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push 0x100223c
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop edi
leave
ret
Function at 0x1007bee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x208
lea eax, [ebp - 0x418]
push edi
push eax
push 0x1f6
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x1007c2f
lea eax, [ebp - 0x418]
push 0x10020f8
push eax
call ebx
lea eax, [ebp - 0x210]
push edi
push eax
push 0x1f5
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1007c53
lea eax, [ebp - 0x210]
push 0x1002118
push eax
call ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.010078e8
pop ecx
lea eax, [ebp - 8]
pop ecx
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001880
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1007cb6
lea eax, [ebp + 8]
push 4
push eax
push 4
push esi
push 0x1002248
push dword [ebp - 4]
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1007cbb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push 0x1001880
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1007d1b
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1002248
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
je 0x1007d58
lea eax, [ebp - 0x218]
push 0x208
push eax
push 0x1f5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1007d4b
lea eax, [ebp - 0x218]
push 0x1002118
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x218]
push eax
call fcn.0100786d
pop ecx
pop esi
leave
ret

Function at 0x1007dcf
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x1007dfe
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
pop esi
ret 8
Function at 0x1007f2a
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea ecx, [ebp - 8]
push edi
xor eax, eax
push ecx
push 7
push eax
xor edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1007fef
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1007fcc
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x23a], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x1007f94
lea eax, [ebp - 0x238]
push 0x10017cc
push eax
call esi
lea eax, [ebp - 0x238]
push 0x1002344
push eax
call esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.01007ff5
test eax, eax
jl 0x1007fcc
push 1
pop edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x1007fef
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1007ff5
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x10027a8
push 1
push 0
push 0x10027b8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x10080dd
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test byte [esi + 4], 2
je 0x1008045
mov eax, dword [ebp - 4]
push dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test byte [esi + 4], 1
je 0x1008057
mov eax, dword [ebp - 4]
push dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test byte [esi + 4], 4
je 0x100806c
push dword [esi + 0x18]
mov eax, dword [ebp - 4]
push dword [esi + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
test byte [esi + 4], 8
je 0x100807e
mov eax, dword [ebp - 4]
push dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test byte [esi + 4], 0x20
je 0x1008090
mov eax, dword [ebp - 4]
push dword [esi + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
test byte [esi + 4], 0x10
je 0x10080a4
mov eax, dword [ebp - 4]
mov dx, word [esi + 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x10027f8
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x10080d4
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
leave
ret 8
Function at 0x10080ea
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea ecx, [ebp - 8]
push esi
xor eax, eax
push ecx
push 7
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x100818b
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1008168
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x216], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x100814d
lea eax, [ebp - 0x214]
push 0x10017cc
push eax
call esi
lea eax, [ebp - 0x214]
push 0x1002344
push eax
call esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x100818b
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop esi
leave
ret

Function at 0x100824b
Capabilities:
Shutdown system

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
xor esi, esi
push edi
sub eax, esi
je 0x1008262
dec eax
jne 0x100826a
mov dword [esp + 0x14], esi
jmp 0x100826a
mov dword [esp + 0x14], 2
call fcn.01007e4c
push 0x209
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
cmp ebp, esi
je 0x100839a
push 0x104
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [0x100e078]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
pop ecx
cmp edi, esi
je 0x1008320
push dword [0x100e078]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, 0x1002388
push ebx
push edi
call esi
push 0x1001ba8
push edi
call esi
push ebx
push edi
call esi
mov eax, dword [0x100e018]
mov eax, dword [eax + 0x14f8]
test eax, 0x200000
je 0x10082f5
push 0x1001ba0
jmp 0x100831d
test eax, 0x400000
je 0x1008303
push 0x1001b94
jmp 0x100831d
test eax, 0x800000
je 0x1008311
push 0x1001b84
jmp 0x100831d
test eax, 0x2000000
je 0x1008320
push 0x1001b7c
push edi
call esi
xor esi, esi
mov eax, edi
cmp edi, esi
jne 0x100832d

Function at 0x100995f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001880
push 0x80000001
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10099ba
lea eax, [ebp - 0xc]
push 4
push eax
push 3
push esi
push 0x1002580
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x1009cbf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push 0x45
pop ecx
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x1009d04
cmp dword [ebp - 0x110], 5
jb 0x1009d04
push 1
pop eax
jmp 0x1009d06
xor eax, eax
pop edi
leave
ret