joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020b1d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
or eax, 3
cmp dword [ebp + 0xc], esi
je 0x1020b5e
lea ebx, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x210]
push ebx
push esi
push eax
push esi
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x1020b6f
lea ebx, [ebp - 0x210]
push ebx
push eax
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1020bef
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call fcn.01020a10
cmp dword [ebp + 0xc], esi
je 0x1020bb3
cmp dword [ebp + 0x10], esi
jne 0x1020ba6
cmp eax, esi
je 0x1020be3
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
jmp 0x1020bd4
cmp dword [ebp + 0x10], esi
jne 0x1020bce
cmp eax, esi
jne 0x1020be3
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1020be3
push esi
push 0x1001420
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01023d2d
leave
ret 0xc

Function at 0x1020c27
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x90]
push ecx
push 1
xor esi, esi
push esi
push eax
push 0x80000002
mov dword [ebp - 0x88], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1020cf6
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x90]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x90]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1020cf6
push esi
lea eax, [ebp - 0x88]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x88]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1020cea
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023d2d
leave
ret 8
Function at 0x1020d4c
Capabilities:
Delete registry value
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x1020d61
push esi
call fcn.010228a7
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x1020d8c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x1020d7f
and eax, 0xfffffff9
jmp 0x1020d82
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1020dc7
cmp dword [ebp + 0x10], 0
je 0x1020da7
push dword [ebp + 8]
push 0x1002070
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1020dc7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x1002070
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop ebp
ret 0xc

Function at 0x1020e23
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call fcn.010228a7
mov edi, eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x29
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x1020e98
push 0
push esi
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret 8
Function at 0x1020fa4
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x104
test eax, eax
je 0x1021035
push 0x10021a0
lea eax, [ebp - 0x20c]
push eax
call fcn.01020f09
mov eax, dword [0x102837c]
test eax, eax
jne 0x1020fff
call fcn.0101f6e4
push ebx
lea ecx, [ebp - 0x414]
push ecx
push 0x10
push eax
call edi
test eax, eax
je 0x1021035
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x10021a0
lea eax, [ebp - 0x20c]
push eax
call fcn.01020f09
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1002168
push 0x10020f0
push 0x80000002
mov dword [ebp - 0x418], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x102108c
mov eax, dword [0x102837c]
test eax, eax
jne 0x102107b
call fcn.0101f6e4
push ebx
lea ecx, [ebp - 0x414]
push ecx
push 0x11
push eax
call edi
test eax, eax
je 0x10210c4
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
test eax, eax
je 0x10210c4
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x10021a0
lea eax, [ebp - 0x20c]
push eax
call fcn.01020f09
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023d2d
leave
ret

Function at 0x10210d8
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 2
push esi
push esi
push esi
push 0x1002248
push 0x80000001
mov edi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1021131
push 0x40
push 0x1002208
push 1
push esi
push 0x10021f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1021128
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1021c88
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
push esi
push edi
push eax
push 0x1001e48
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0101fe0b
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
mov edi, 0x1001fe8
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x80000001
push esi
mov dword [ebp - 0x214], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x210]
and eax, dword [ebp + 0xc]
push 4
or eax, dword [ebp + 0x10]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push 4
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret 0xc

Function at 0x1021d37
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x1021d8a
push 0
push dword [esi + edi*4]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1021d84
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push 0
push dword [ebp + 8]
push eax
call fcn.01021af1
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x1021d58
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret 0x10

Function at 0x1021d9f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x61c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1021eb4
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x1001c20
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
push edi
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.01021af1
mov eax, dword [0x102837c]
cmp eax, edi
jne 0x1021e0c
call fcn.0101f6e4
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x2db
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.01021af1
mov eax, dword [0x102837c]
test eax, eax
jne 0x1021e6c
call fcn.0101f6e4
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x2dd
push eax
call edi
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.01021af1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01023d2d
leave
ret 4
Function at 0x1021f44
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jl 0x1021fd4
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1021fd4
mov eax, dword [0x102837c]
test eax, eax
jne 0x1021f85
call fcn.0101f6e4
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x2da
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp + 8]
push eax
call fcn.01021af1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01023d2d
leave
ret 8

Function at 0x1021fe7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x10]
jl 0x102202e
push esi
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x102202e
push 1
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.01021af1
cmp dword [ebp + 0xc], 0
jl 0x1022056
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x102204d
test esi, esi
je 0x102204d
call fcn.010211b2
test al, al
je 0x1022056
push esi
push dword [ebp + 0xc]
call fcn.01021f44
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret 0xc

Function at 0x102206a
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1022113
push 0x1002544
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102135f
test eax, eax
jl 0x1022113
push 0x44
pop edi
push edi
lea eax, [ebp - 0x260]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x260], edi
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1022113
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x218]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret
Function at 0x1022126
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 2
pop ebx
push ebx
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x1022223
push esi
call fcn.01020c04
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.01021edc
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1022187
push 1
push esi
push 3
lea eax, [ebp - 0x20c]
push eax
call fcn.01021af1
push esi
push 1
push 0
call fcn.01021fe7
test esi, esi
jne 0x10221f8
push esi
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], 0x10
mov dword [ebp - 0x210], 0x19
call fcn.01021d37
push 0x17
pop esi
push 1
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], 6
call fcn.01021d37
push 1
push 1
lea eax, [ebp - 0x210]
push eax
push 4
mov dword [ebp - 0x210], esi
call fcn.01021d37
call fcn.01021ec8
push 0x1002568
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call fcn.01021220
pop esi
test al, al
jne 0x102221d
call fcn.0102206a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01023d2d
leave
ret 4
Function at 0x1023085
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push 2
push edi
push edi
push edi
push 0x1002698
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x102310c
push dword [ebp + 0xc]
push 0x1002670
push edi
push dword [ebp - 4]
call fcn.01024cf0
mov esi, eax
cmp esi, edi
jl 0x1023101
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push edi
push 0x1002688
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
jne 0x10230f3
xor esi, esi
jmp 0x1023101
jle 0x10230ff
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102311a
jle 0x1023118
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x10245d9
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
and dword [edi], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x102468a
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x102468a
push eax
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1024681
xor ebx, ebx
lea eax, [ebp + 0x10]
push eax
cmp dword [ebp + 0x14], ebx
je 0x1024659
lea eax, [ebp - 8]
push eax
push 0x10024e0
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1024681
cmp dword [ebp + 0x10], ebx
je 0x1024681
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
jmp 0x102467f
lea eax, [ebp - 0xc]
push eax
push 0x10027cc
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1024681
cmp dword [ebp + 0x10], ebx
je 0x1024681
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [edi], ecx
movzx eax, word [eax + 2]
mov dword [esi], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1024731
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x218]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002840
push 0x80000002
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102486b
push edi
push 4
pop edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
mov esi, 0x1002800
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102485e
push esi
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x102485e
lea eax, [ebp - 0x20c]
push eax
call fcn.010246d0
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x102485e
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov esi, 0x1002818
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102485e
push esi
push dword [ebp - 0x224]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x102485e
lea eax, [ebp - 0x20c]
push eax
call fcn.010246d0
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.01023d2d
leave
ret 4

Function at 0x1024886
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1028370], 0xffffffff
jne 0x10248f8
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10028c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10248f8
and dword [0x1028370], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x10028a4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10248ef
mov eax, 0x600
cmp word [ebp - 0xc], ax
sbb eax, eax
inc eax
mov dword [0x1028370], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1028370]
leave
ret
Function at 0x1024973
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x1002840
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024a0d
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x1002888
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1024a01
test esi, esi
je 0x1024a01
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.01024904
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [ebp - 0x20c], ax
pop esi
setne al
xor ecx, ebp
call fcn.01023d2d
leave
ret 8

Function at 0x1024a2d
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x41c], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.01024973
test eax, eax
je 0x1024b12
lea eax, [ebp - 0x20c]
push eax
call fcn.01024731
test eax, eax
je 0x1024b12
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024973
test eax, eax
je 0x1024b12
push ebx
push 0x1002818
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024bf5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x418], eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push 0x1001420
push dword [ebp - 0x41c]
push 0x1002830
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 0x418], 0xffffffff
je 0x1024b11
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01023d2d
leave
ret 4
Function at 0x1024b29
Capabilities:
Check os version
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1028374], 2
jne 0x1024bdf
and dword [0x1028374], 0
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x310], 2
jne 0x1024bdf
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x1002914
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024bf5
cmp dword [ebp - 0x31c], 5
pop esi
jae 0x1024bd5
call fcn.01024886
test eax, eax
jne 0x1024bd5
push 0x7550005
push 0x50083
lea eax, [ebp - 0x20c]
push eax
call fcn.01024696
test eax, eax
je 0x1024bdf
lea eax, [ebp - 0x20c]
push eax
call fcn.01024a2d
test eax, eax
jne 0x1024bdf
mov dword [0x1028374], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1028374]
xor ecx, ebp
call fcn.01023d2d
leave
ret

Function at 0x1024d9e
Capabilities:
Get common file path
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x234]
xor ebx, ebx
push eax
mov byte [ebp - 0x20d], bl
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x234], bx
jne 0x1024de2
cmp edi, 0x2a
jne 0x1024de2
push 0x26
pop edi
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1024e40
push 0x10029c0
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathAppendW
test eax, eax
je 0x1024e40
cmp byte [ebp + 0x14], bl
je 0x1024e25
push 0x10029a4
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathAppendW
test eax, eax
je 0x1024e40
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0101fc52
test eax, eax
jl 0x1024e40
mov byte [ebp - 0x20d], 1
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023d2d
leave
ret 0x10