joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104a0ba
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push esi
push edi
push 0x1006acc
mov esi, ecx
push 3
mov dword [ebp - 0x220], esi
call fcn.01055c50
mov eax, dword [esi + 0x10]
test eax, eax
je 0x104a0fb
push eax
mov ecx, esi
call fcn.01049cd4
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea eax, [ebp - 0x210]
push eax
push 1
push 0
mov ebx, 0x1001b38
push ebx
push 0x80000001
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x104a241
and dword [ebp - 0x218], 0
push 4
pop eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1006a94
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x104a1d2
cmp dword [ebp - 0x218], 1
jne 0x104a1d2
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1006a60
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 0x208
call esi
test eax, eax
jne 0x104a1d2
cmp dword [ebp - 0x214], 1
jne 0x104a1d2
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.01049dcf
lea eax, [ebp - 0x20c]
push eax
push 0x1006a40
push 3
call fcn.01055c8a
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1001f20
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 0x208
call esi
test eax, eax
jne 0x104a235
cmp dword [ebp - 0x214], 1
jne 0x104a235
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.01049eb9
lea eax, [ebp - 0x20c]
push eax
push 0x1006a20
push 3
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push ebx
push 0x80000002
call edi
pop ebx
test eax, eax
jne 0x104a30d
push 4
pop edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x10069f4
push dword [ebp - 0x210]
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], 0x208
call esi
test eax, eax
jne 0x104a301
cmp dword [ebp - 0x218], 1
jne 0x104a301
mov ecx, 0x1001e44
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x104a2d0
test dx, dx
je 0x104a2cc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x104a2d0
add eax, edi
add ecx, edi
test dx, dx
jne 0x104a2ac
xor eax, eax
jmp 0x104a2d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x104a301
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.01049fb4
lea eax, [ebp - 0x20c]
push eax
push 0x10069d0
push 3
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01047480
leave
Function at 0x104b8ee
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0xa4], ebx
je 0x104bc70
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x104bc70
cmp dword [esi + 0xa0], ebx
je 0x104bc56
cmp dword [esi + 0xa8], ebx
je 0x104bc56
push eax
call fcn.010561eb
test eax, eax
je 0x104bc56
push 1
push ebx
push 1
push dword [esi + 0x3c]
call fcn.01057031
mov edi, eax
cmp edi, ebx
jge 0x104b973
push 1
push 1
push ebx
push dword [esi + 0x3c]
call fcn.01057031
mov edi, eax
cmp edi, ebx
jl 0x104bc66
push ebx
push ebx
push 0x105
lea eax, [ebp - 0x318]
push eax
push 0xffffffffffffffff
push dword [esi + 0x3c]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push 0x104af04
push ebx
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetA]
test eax, eax
je 0x104bc22
push dword [esi + 0x3c]
push 0x100721c
push 4
call fcn.01055c8a
add esp, 0xc
cmp dword [esi + 0xb0], ebx
je 0x104bc14
push dword [esi + 0x44]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 0x320], eax
cmp eax, ebx
je 0x104bc52
xor ecx, ecx
cmp cx, word [eax]
je 0x104bc52
push 0x1003d00
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x104bb8a
push dword [esi + 0x44]
lea eax, [ebp - 0x210]
push dword [esi + 0x40]
push 0x100720c
push 0x105
push eax
call fcn.0103592d
add esp, 0x14
test eax, eax
jl 0x104bc52
push 0x38
lea eax, [ebp - 0x358]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x48]
add esp, 0xc
cmp eax, ebx
je 0x104ba46
mov dword [ebp - 0x348], eax
mov ecx, dword [0x10746bc]
mov dword [ebp - 0x354], ecx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x34c], ecx
mov ecx, dword [esi + 0x40]
push eax
mov dword [ebp - 0x358], 0x40
mov dword [ebp - 0x35c], 0x3c
mov dword [ebp - 0x344], ecx
mov dword [ebp - 0x340], 1
call fcn.01047cd3
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10071f8
push 4
call fcn.01055c8a
add esp, 0x10
lea eax, [ebp - 0x35c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x104bb58
mov edi, 0x1f4
push 0x14
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x320], edi
call fcn.0105531d
push ebx
call fcn.0105508f
push edi
push dword [ebp - 0x324]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call edi
mov ebx, 0x102
jmp 0x104bb26
cmp dword [ebp - 0x31c], 0x14
je 0x104bb05
push dword [ebp - 0x31c]
call fcn.010553a3
inc dword [ebp - 0x31c]
cmp dword [ebp - 0x31c], 0xe
jbe 0x104bb18
add dword [ebp - 0x320], 0x12c
push dword [ebp - 0x320]
push dword [ebp - 0x324]
call edi
cmp eax, ebx
je 0x104baeb
push 0x14
call fcn.010553a3
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20
pop eax
cmp eax, dword [ebp - 0x33c]
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
xor ebx, ebx
jmp 0x104bb75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
invalid
Function at 0x104c823
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x68], ebx
jne 0x104c8dd
cmp dword [esi + 0x6c], ebx
jne 0x104c8dd
mov eax, dword [esi + 0x2c]
cmp eax, 1
je 0x104c884
jle 0x104c8dd
cmp eax, 4
jle 0x104c85d
cmp eax, 6
jne 0x104c8dd
mov eax, dword [esi + 0x18]
invalid

Function at 0x104ccdb
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x324], esi
cmp ecx, esi
je 0x104ce28
cmp eax, esi
je 0x104ce28
mov dword [ebp - 0x328], 0x80
mov dword [ebp - 0x318], esi
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x318]
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x104ce27
inc dword [ebp - 0x318]
lea eax, [ebp - 0x31c]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x314]
mov dword [ebp - 0x328], 0x80
mov dword [ebp - 0x31c], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x104ce27
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x320]
push eax
push esi
push 0x10077c4
push dword [ebp - 0x31c]
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x330], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x104ce00
cmp dword [ebp - 0x320], 1
jne 0x104ce00
push dword [ebp - 0x32c]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x104ce00
inc ebx
mov dword [ebp - 0x324], ebx
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x104cd2c
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x314]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x324]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 8
Function at 0x105443a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x28], edi
je 0x10546d8
cmp dword [esi + 0x24], edi
je 0x10546d8
cmp dword [ebp + 8], edi
je 0x105447d
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x105447a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x38], edi
lea eax, [esi + 0x38]
mov dword [ebp - 0x208], eax
cmp dword [eax], edi
jne 0x10546ce
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 0x218]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10073b8
push 0x80000000
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x21c], edi
call ebx
test eax, eax
jne 0x10546b2
mov ecx, esi
mov dword [ebp - 0x214], edi
call fcn.010543dc
test eax, eax
mov eax, 0x100740c
jne 0x10544e1
mov eax, 0x1007420
push edi
lea ecx, [ebp - 0x214]
push ecx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push dword [ebp - 0x218]
call ebx
test eax, eax
jne 0x105469e
push dword [esi + 0x24]
lea eax, [ebp - 0x204]
push dword [esi + 0x28]
mov dword [ebp - 0x210], edi
push 0x1008790
push 0xff
push eax
call fcn.0103592d
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push dword [ebp - 0x214]
call ebx
test eax, eax
jne 0x1054692
inc eax
cmp dword [ebp - 0x210], 2
mov dword [ebp - 0x21c], eax
mov ebx, 0x1002250
jne 0x105461d
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], 0x200
cmp dword [esi + 0x20], edi
je 0x1054620
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x208]
push edi
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1054620
cmp dword [ebp - 0x20c], 1
jne 0x1054620
fldz
lea eax, [ebp - 0x22c]
push eax
fst qword [ebp - 0x224]
lea eax, [ebp - 0x204]
fstp qword [ebp - 0x22c]
push 0x1009018
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
test eax, eax
je 0x1054620
lea eax, [ebp - 0x224]
push eax
push 0x1009018
push dword [esi + 0x20]
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
test eax, eax
je 0x1054620
fld qword [ebp - 0x22c]
fcomp qword [ebp - 0x224]
fnstsw ax
test ah, 0x41
je 0x105461b
xor eax, eax
inc eax
jmp 0x105461d
xor eax, eax
mov dword [esi + 0x14], eax
mov ecx, dword [esi + 0x20]
cmp ecx, edi
je 0x105465e
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x20c], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1054632
sub eax, dword [ebp - 0x20c]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x208]
push ecx
push 1
push edi
push ebx
push dword [eax]
push dword [esi + 0x14]
call fcn.01057a24
mov ecx, dword [esi + 0x18]
cmp ecx, edi
je 0x1054692
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x105466a
invalid
Function at 0x10576be
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x105774a
cmp dword [ebp + 0xc], ebx
je 0x105774a
cmp dword [ebp + 0x10], ebx
je 0x105774a
xor edi, edi
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
jbe 0x1057893
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
je 0x105774a
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.msvcrt.dll_malloc]
add eax, 2
push eax
call esi
pop ecx
mov dword [ebp - 0xc], eax
invalid

Function at 0x105791c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1057a0f
push esi
lea eax, [ebp - 0x210]
push eax
push 0x2001f
xor esi, esi
push esi
push ebx
push edi
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1057a0e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
mov ebx, 0x103
jmp 0x10579ec
cmp eax, esi
jne 0x10579f0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.0105791c
test eax, eax
jne 0x10579f0
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
invalid

Function at 0x1057a24
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jne 0x1057a3a
push 6
pop eax
jmp 0x1057a80
cmp dword [ebp + 8], esi
jne 0x1057a68
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1057a68
cmp dword [ebp + 0x10], esi
jne 0x1057a61
cmp dword [ebp - 4], 2
jbe 0x1057a68
mov eax, 0xb7
jmp 0x1057a80
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
leave
ret 0x1c
Function at 0x1057afe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push 1
xor esi, esi
push esi
push 0x1009af0
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1057b77
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x1009ad0
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], 3
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1057b6e
cmp dword [ebp - 4], 4
je 0x1057b63
cmp dword [ebp - 4], 3
jne 0x1057b6e
xor eax, eax
cmp dword [ebp - 0xc], 1
setne al
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x1057da6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebx
push edi
push 0x144
push 0
push esi
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [esi], 0
add esp, 0xc
push 0x32
lea eax, [esi + 0xe0]
push eax
push 0x1010
mov ebx, 0x400
push ebx
call edi
lea eax, [esi + 0xe0]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0x32
mov dword [esi + 0x14], eax
lea eax, [esi + 0xe0]
push eax
push 0x12
xor ecx, ecx
push ebx
mov word [eax], cx
call edi
lea eax, [esi + 0xe0]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0x32
mov dword [esi + 4], eax
lea eax, [esi + 0x18]
push eax
push 0xe
push ebx
call edi
lea eax, [esi + 0x18]
push 0x32
mov dword [esi + 0xc], eax
lea eax, [esi + 0x7c]
push eax
push 0xf
push ebx
call edi
lea eax, [esi + 0x7c]
push 0x32
mov dword [esi + 0x10], eax
lea eax, [esi + 0xe0]
push eax
push 0x10
xor ecx, ecx
push ebx
mov word [eax], cx
call edi
lea edi, [esi + 0xe0]
movzx eax, word [edi]
xor ecx, ecx
cmp cx, ax
je 0x1057e87
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
push 0x30
pop ecx
cmp cx, ax
je 0x1057e87
mov eax, dword [esi + 8]
imul eax, eax, 0xa
push edi
mov dword [esi + 8], eax
call dword [sym.imp.msvcrt.dll__wtoi]
add dword [esi + 8], eax
pop ecx
push edi
call ebx
push eax
call ebx
mov edi, eax
movzx eax, word [edi]
xor ecx, ecx
cmp cx, ax
jne 0x1057e59
pop edi
pop ebx
Function at 0x105864b
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x105866e
xor edx, edx
jmp 0x105875e
push esi
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01035831
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
xor eax, eax
pop ecx
test esi, esi
jne 0x10586a1
xor edx, edx
jmp 0x105875d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
inc esi
inc esi
mov word [esi], ax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x1058700
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10586de
push 0x57
pop eax
test eax, eax
jle 0x10586ea
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x1009de0
push 2
call fcn.01055c8a
add esp, 0xc
xor eax, eax
xor edx, edx
jmp 0x105875c
mov eax, dword [ebp - 0x210]
push ebx
mov ebx, dword [ebp - 0x214]
mov dword [ebp - 0x218], eax
test ebx, ebx
jne 0x1058753
test eax, eax
jne 0x1058753
mov word [esi - 2], ax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x1058753
mov eax, dword [ebp - 0x210]
mov ebx, dword [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
invalid

Function at 0x10587e2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
test eax, eax
je 0x1058840
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01035831
test eax, eax
jl 0x1058840
push 0x5c
lea eax, [ebp - 0x20c]
push eax
call fcn.01055ec0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x105883e
test al, 0x10
je 0x105883e
inc esi
jmp 0x1058840
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 4
Function at 0x10592bb
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x468], eax
mov dword [eax], 1
push esi
mov eax, ebx
push edi
mov dword [ebp - 0x46c], ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10592f0
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + 3]
mov edi, 0x104
push ebx
cmp eax, edi
ja 0x1059533
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01035831
test esi, esi
je 0x1059346
movzx eax, word [ebx + esi*2 - 2]
cmp ax, 0x3a
je 0x1059346
cmp ax, 0x5c
je 0x1059346
push 0x1005778
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
inc esi
push 0x1009f8c
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp eax, 0xffffffff
jne 0x105937d
push ebx
jmp 0x1059533
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + esi*2 - 0x20c]
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x460]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10593a4
sub eax, edx
sar eax, 1
lea eax, [ebp - 0x228]
jne 0x10593c0
lea eax, [ebp - 0x430]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
mov eax, dword [ebp - 0x45c]
mov esi, eax
test al, 0x10
je 0x105947a
mov ecx, 0x10086b0
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x105940f
test dx, dx
je 0x105940b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x105940f
add eax, 4
add ecx, 4
test dx, dx
jne 0x10593e9
xor eax, eax
jmp 0x1059414
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1059506
mov ecx, 0x1009f84
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x105944d
test dx, dx
je 0x1059449
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x105944d
add eax, 4
add ecx, 4
test dx, dx
jne 0x1059427
xor eax, eax
jmp 0x1059452
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1059506
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010592bb
test eax, eax
je 0x1059506
jmp 0x10594fd
test al, 1
je 0x105948b
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1059506
lea eax, [ebp - 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10594a5
sub eax, edx
sar eax, 1
je 0x10594f3
mov ecx, dword [ebp - 0x460]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x430]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
invalid
invalid
Function at 0x105954e
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
jne 0x105956a
mov eax, 0x80004003
jmp 0x1059730
push 0x14
pop eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x1059593
mov eax, 0x8007000e
jmp 0x1059730
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x1002568
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1059617
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x105960e
mov edi, 0x104
push edi
push ebx
call fcn.01058169
test eax, eax
je 0x1059607
push 0x100a0a4
push edi
push ebx
call fcn.010358a6
invalid

Function at 0x105973a
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x105982b
cmp dword [ebp + 0xc], ebx
je 0x105982b
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov edi, 0x1002568
push edi
push 0x80000002
call esi
cmp eax, ebx
je 0x105978d
lea eax, [ebp - 4]
push eax
push 3
push ebx
push edi
push 0x80000001
call esi
mov esi, eax
cmp esi, ebx
jne 0x10597ea
push dword [ebp + 0xc]
push 0x100a124
push dword [ebp - 4]
call fcn.010576be
mov edi, eax
cmp edi, ebx
je 0x10597d8
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10597a9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x10597dd
mov esi, 0x80004005
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x105980d
jle 0x10597f8
and esi, 0xffff
or esi, 0x80070000
push esi
push dword [ebp + 8]
push 0x100a0e0
push 2
call fcn.01055c8a
add esp, 0x10
jmp 0x1059825
push 0x100a0b8
push 4
call fcn.01055c50
or dword [0x10747d0], 1
mov esi, 0xd2af9
pop edi
mov eax, esi
pop esi
jmp 0x1059830
mov eax, 0x80004003
pop ebx
leave
ret 8