joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102d126
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
push esi
push esi
push 4
mov dword [ebp - 0x208], esi
call fcn.0102fffb
test eax, eax
je 0x102d1e3
push edi
lea eax, [ebp - 0x208]
push eax
xor edi, edi
inc edi
push edi
push esi
push 0x10050a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102d1e0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x1005088
push dword [ebp - 0x208]
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x20c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102d1d4
cmp dword [ebp - 0x20c], edi
jne 0x102d1d4
lea eax, [ebp - 0x204]
push 0x100507c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102d1d4
mov esi, edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0102df7d
leave
ret

Function at 0x102d1f5
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
push eax
push 0x2a
push eax
xor edi, edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x102d24b
push 0x1002f08
lea eax, [ebp - 0x20c]
push eax
push 0x10031d4
push dword [ebp + 0xc]
push esi
call fcn.01027f64
add esp, 0x14
test eax, eax
jl 0x102d24b
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0102df7d
leave
ret 8
Function at 0x102d2ab
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x102d2cf
xor eax, eax
jmp 0x102d382
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, eax
test esi, esi
jl 0x102d37a
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 0x15
inc eax
inc eax
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jl 0x102d34d
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x102d336
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.01027ea2
mov esi, eax
jmp 0x102d33b
mov esi, 0x80004005
mov eax, dword [ebp - 0x210]
push dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jl 0x102d37a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102d362
sub eax, edx
sar eax, 1
cmp eax, 8
jae 0x102d37a
mov esi, 0x80004005
xor eax, eax
test esi, esi
setge al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0102df7d
leave
ret 0xc
Function at 0x102d7b3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x33c], edi
cmp esi, edi
je 0x102d8fb
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x10]
call fcn.0102d2ab
test eax, eax
je 0x102d8fb
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], edi
je 0x102d81f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x15
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x102d8df
lea eax, [ebp - 0x33c]
push eax
push ebx
push edi
push 0x1005100
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102d8fb
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x96
lea eax, [ebp - 0x338]
push eax
push 0x23
push dword [0x10405b0]
mov dword [ebp - 0x344], 0x208
xor esi, esi
mov dword [ebp - 0x340], ebx
call edi
test eax, eax
je 0x102d8c9
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x340]
push eax
push esi
lea eax, [ebp - 0x338]
push eax
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102d8ab
cmp dword [ebp - 0x340], ebx
jne 0x102d8ab
mov esi, ebx
jmp 0x102d8c9
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x15
push dword [0x10405b0]
call edi
mov esi, eax
neg esi
sbb esi, esi
neg esi
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x102d8fb
mov esi, dword [ebp - 0x348]
push esi
call fcn.0102e61a
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push esi
call fcn.01027f1e
mov eax, ebx
jmp 0x102d8fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0xc
Function at 0x102d913
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x544], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x102db60
push dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
call fcn.0102d2ab
test eax, eax
je 0x102db60
lea eax, [ebp - 0x544]
push eax
push 1
push 0
push 0x1005100
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
mov esi, 0x104
test eax, eax
jne 0x102da64
push 0x96
lea eax, [ebp - 0x540]
push eax
push 0x24
push dword [0x10405b0]
mov dword [ebp - 0x54c], 0x208
mov dword [ebp - 0x548], 1
call ebx
test eax, eax
je 0x102da58
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x548]
push eax
push 0
lea eax, [ebp - 0x540]
push eax
push dword [ebp - 0x544]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102da58
cmp dword [ebp - 0x548], 1
jne 0x102da58
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x102da58
lea eax, [ebp - 0x20c]
push eax
call fcn.0102e61a
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x102da58
lea eax, [ebp - 0x20c]
push eax
call fcn.0102fe6a
test eax, eax
je 0x102da58
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push edi
call fcn.01027ea2
test eax, eax
jl 0x102da58
push dword [ebp - 0x544]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x102db62
push dword [ebp - 0x544]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
call fcn.0102d2ab
test eax, eax
je 0x102daea
push esi
lea eax, [ebp - 0x414]
push eax
push 0x21
push dword [0x10405b0]
call ebx
test eax, eax
je 0x102daea
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x102daea
lea eax, [ebp - 0x20c]
push eax
call fcn.0102e61a
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x102daea
lea eax, [ebp - 0x20c]
push eax
call fcn.0102fe6a
test eax, eax
je 0x102daea
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push edi
call fcn.01027ea2
test eax, eax
jge 0x102da50
push dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
call fcn.0102d2ab
test eax, eax
je 0x102db60
push esi
lea eax, [ebp - 0x414]
push eax
push 0x25
push dword [0x10405b0]
call ebx
test eax, eax
je 0x102db60
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x102db60
lea eax, [ebp - 0x20c]
push eax
call fcn.0102e61a
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x102db60
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push edi
call fcn.01027ea2
test eax, eax
jge 0x102da50
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0xc
Function at 0x102db78
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x102db9c
xor eax, eax
jmp 0x102dc50
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, eax
test esi, esi
jl 0x102dc48
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 0x19
add eax, 6
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jl 0x102dc1b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x102dc04
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.01027ea2
mov esi, eax
jmp 0x102dc09
mov esi, 0x80004005
mov eax, dword [ebp - 0x210]
push dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jl 0x102dc48
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102dc30
sub eax, edx
sar eax, 1
cmp eax, 8
jae 0x102dc48
mov esi, 0x80004005
xor eax, eax
test esi, esi
setge al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0102df7d
leave
ret 0xc
Function at 0x102df6e
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x103d828
call fcn.0102e174
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1041758
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x102dd25
cmp eax, esi
jne 0x102dd18
xor esi, esi
inc esi
mov ebx, esi
jmp 0x102dd28
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x102dcff
xor esi, esi
inc esi
mov eax, dword [0x1041754]
cmp eax, esi
jne 0x102dd3b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x102dd6a
mov eax, dword [0x1041754]
test eax, eax
jne 0x102dd64
mov dword [0x1041754], esi
push 0x1001338
push 0x100132c
call fcn.0102dc64
pop ecx
pop ecx
test eax, eax
je 0x102dd6a
jmp 0x102de92
mov dword [0x1040e84], esi
mov eax, dword [0x1041754]
cmp eax, esi
jne 0x102dd8e
push 0x1001328
push 0x10012d0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1041754], 2
test ebx, ebx
jne 0x102dd9a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x104175c], 0
je 0x102ddbe
push 0x104175c
call fcn.0102e0e9
pop ecx
test eax, eax
je 0x102ddbe
push 0
push 2
push 0
call dword [0x104175c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x102de1a
test al, al
je 0x102ddd8
cmp dword [ebp - 0x1c], 0
jne 0x102de1a
mov al, byte [esi]
test al, al
je 0x102dde8
cmp al, 0x20
ja 0x102dde8
inc esi
mov dword [ebp - 0x20], esi
jmp 0x102ddd8
test byte [ebp - 0x3c], 1
je 0x102ddf4
movzx eax, word [ebp - 0x38]
jmp 0x102ddf7
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1040e80], eax
cmp dword [0x1040e74], 0
jne 0x102de6e
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x102de29
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x102de3c
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x102ddc5
cmp dword [0x1040e84], 0
jne 0x102de7d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1040e80]
jmp 0x102de9e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0102e1b9
ret
call fcn.0102e367
jmp 0x102dcc5

Function at 0x102e8b9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x102e8db
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x102e8db
test al, 0x10
jne 0x102e8db
xor eax, eax
inc eax
jmp 0x102e8dd
xor eax, eax
pop ebp
ret 4
Function at 0x102e8e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x102e920
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x102e920
push dword [ebp + 8]
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x102e90f
push 2
pop eax
jmp 0x102e925
test eax, 0x800
je 0x102e91c
mov dword [esi], 1
xor eax, eax
jmp 0x102e925
mov eax, 0xa0
pop esi
pop ebp
ret 8

Function at 0x102e92f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x198]
xor ebx, ebx
push eax
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x1a4], 0x80
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x198], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x102e983
xor edx, edx
jmp 0x102eaa8
push esi
mov esi, dword [ebp - 0x194]
xor eax, eax
shld eax, esi, 0x10
mov eax, dword [ebp - 0x190]
shl esi, 0x10
or esi, eax
cmp dword [ebp - 0x188], 2
lea eax, [ebp - 0x19c]
push eax
push 1
mov dword [ebp - 0x1ac], ebx
push ebx
jne 0x102ea2d
push 0x10054f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102ea9f
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push 0x10054c4
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102ea93
cmp dword [ebp - 0x1a0], 1
jne 0x102ea93
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov ecx, 0x10000
mov dword [ebp - 0x1a4], eax
mul ecx
add dword [ebp - 0x1ac], eax
adc esi, edx
jmp 0x102ea93
push 0x1005470
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102ea9f
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push 0x1005450
push dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102ea93
cmp dword [ebp - 0x1a0], 1
jne 0x102ea93
lea eax, [ebp - 0x84]
push eax
call fcn.0102e72d
mov dword [ebp - 0x1ac], eax
mov esi, edx
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1ac]
mov edx, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret

Function at 0x102eb79
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push 0x1005568
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x102ebc2
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push 0x100554c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x102f14f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1005680
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x102f1a6
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x1005650
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x102f1b6
push esi
push 0x1005608
push 2
call fcn.01039f55
add esp, 0xc
pop esi
leave
ret

Function at 0x102f1be
Capabilities:
Copy file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
jne 0x102f1d2
xor eax, eax
jmp 0x102f288
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x4000
test edi, eax
je 0x102f22c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
call fcn.0102e5ab
test eax, eax
je 0x102f224
push 0
push dword [ebp + 8]
call dword [ebp - 8]
test eax, eax
jne 0x102f224
call ebx
push eax
push dword [ebp + 0xc]
push 0x10056e4
push 2
call fcn.01039f55
add esp, 0x10
lea ecx, [ebp - 8]
call fcn.0102e597
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call esi
test edi, eax
je 0x102f282
xor esi, esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.0102e5ab
test eax, eax
je 0x102f27a
push esi
push dword [ebp + 0xc]
call dword [ebp - 8]
test eax, eax
jne 0x102f27a
call ebx
push eax
push dword [ebp + 0xc]
push 0x10056e4
push 2
call fcn.01039f55
add esp, 0x10
lea ecx, [ebp - 8]
call fcn.0102e597
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x102f8ce
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x102f9c1
push esi
lea eax, [ebp - 0x210]
push eax
push 0x2001f
xor esi, esi
push esi
push ebx
push edi
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x102f9c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
mov ebx, 0x103
jmp 0x102f99e
cmp eax, esi
jne 0x102f9a2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.0102f8ce
test eax, eax
jne 0x102f9a2
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
cmp eax, ebx
jne 0x102f95f
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 8

Function at 0x102f9d6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jne 0x102f9ec
push 6
pop eax
jmp 0x102fa32
cmp dword [ebp + 8], esi
jne 0x102fa1a
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102fa1a
cmp dword [ebp + 0x10], esi
jne 0x102fa13
cmp dword [ebp - 4], 2
jbe 0x102fa1a
mov eax, 0xb7
jmp 0x102fa32
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
leave
ret 0x1c
Function at 0x102fa3c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1005790
mov edi, 0x80000002
push edi
mov dword [ebp - 0x214], esi
call ebx
test eax, eax
jne 0x102fbc2
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x1005728
push edi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102fbb6
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
jmp 0x102fb90
inc dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], esi
call ebx
test eax, eax
jne 0x102fb78
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push 0x1002774
push dword [ebp - 0x21c]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102fb6c
cmp dword [ebp - 0x228], 4
jne 0x102fb6c
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x214]
mov dword [ebp - 0x220], 0x105
call edi
test eax, eax
je 0x102fad3
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret

Function at 0x102fdf6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
test eax, eax
je 0x102fe54
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.0102fbd6
test eax, eax
jl 0x102fe54
push 0x5c
lea eax, [ebp - 0x108]
push eax
call fcn.0102e6b9
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x102fe52
test al, 0x10
je 0x102fe52
inc esi
jmp 0x102fe54
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0102df7d
leave
ret 4