joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104e4f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x430], 0
mov eax, ecx
cmp dword [eax + 4], 3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x434], ecx
jne 0x104e726
push ebx
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x104e725
push ebx
call fcn.01056f43
test eax, eax
je 0x104e725
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x104e545
push esi
sub eax, edx
sar eax, 1
push edi
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x42c], edi
je 0x104e723
push ebx
push esi
push edi
call fcn.01034c79
mov ebx, 0x1007e00
push ebx
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
call edi
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x104e717
and word [esi], 0
push reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp - 0x42c]
call fcn.010587f2
add esi, 2
push ebx
push esi
mov dword [ebp - 0x418], eax
call edi
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x104e5ce
mov word [eax], bx
cmp esi, ebx
je 0x104e717
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104e5db
sub eax, edx
sar eax, 1
je 0x104e717
lea eax, [ebp - 0x424]
push eax
push 0x20019
push ebx
push esi
push dword [ebp - 0x418]
mov dword [ebp - 0x424], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104e717
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
mov esi, 0x104
push eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x418], ebx
push ebx
jmp 0x104e6fb
inc dword [ebp - 0x418]
cmp word [ebp - 0x20c], bx
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x428], 0x208
je 0x104e6d1
cmp word [ebp - 0x414], bx
je 0x104e6d1
cmp dword [ebp - 0x420], 1
je 0x104e6a2
cmp dword [ebp - 0x420], 2
jne 0x104e6bb
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104e6ab
sub eax, edx
sar eax, 1
je 0x104e6d1
mov eax, dword [ebp - 0x434]
cmp eax, ebx
mov dword [ebp - 0x430], 1
je 0x104e70b
inc dword [eax]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
push dword [ebp - 0x424]
call edi
test eax, eax
je 0x104e668
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x42c]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x430]
xor ecx, ebp
call fcn.01047417
leave
ret 4
Function at 0x104e7a6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea esi, [edi + 0x10]
cmp dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
jne 0x104e8cc
push 0x80
mov dword [ebp - 4], 0x80004005
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, ebx
pop ecx
mov dword [esi], eax
jne 0x104e7e5
xor eax, eax
jmp 0x104e8d4
mov eax, dword [edi + 4]
cmp eax, ebx
jl 0x104e800
cmp eax, 1
jle 0x104e7f6
cmp eax, 3
jne 0x104e800
push 0x1007e34
jmp 0x104e8c3
cmp dword [edi + 0xc], ebx
mov dword [ebp - 0x14], ebx
je 0x104e8be
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x104e8be
push ebx
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x104e8ae
push 0x5c
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x104e847
inc eax
inc eax
jmp 0x104e84a
mov eax, dword [edi + 0xc]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
push ebx
mov dword [ebp - 8], eax
call fcn.01056bba
push dword [ebp - 8]
push esi
push ebx
call fcn.01034cee
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.010577fc
test eax, eax
jl 0x104e8ae
mov eax, dword [ebp - 0xc]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x10]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x1007e14
push esi
push ebx
call fcn.01034d76
add esp, 0x1c
push ebx
mov ecx, edi
call fcn.01048121
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 1
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
cmp dword [ebp - 0x14], 0
pop ecx
jne 0x104e8cc
mov esi, dword [ebp - 0x18]
push 0x1007e04
push esi
call fcn.010593e7
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], eax
setge al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x104f0ed
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], esi
mov eax, dword [ebp - 0x110]
sub eax, esi
je 0x104f171
dec eax
je 0x104f165
dec eax
je 0x104f159
dec eax
je 0x104f14d
mov dword [ebp - 0x108], 0x1007964
jmp 0x104f17b
mov dword [ebp - 0x108], 0x1007950
jmp 0x104f17b
mov dword [ebp - 0x108], 0x1007920
jmp 0x104f17b
mov dword [ebp - 0x108], 0x1007938
jmp 0x104f17b
mov dword [ebp - 0x108], 0x1007974
lea eax, [ebp - 0x10c]
push eax
push 0x2001f
push esi
push dword [ebp - 0x108]
push dword [ebp - 0x124]
call edi
cmp eax, esi
jne 0x104f258
mov dword [ebp - 0x118], 0x80
xor ebx, ebx
mov dword [ebp - 0x114], esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x104f24c
lea eax, [ebp - 0x114]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
mov dword [ebp - 0x118], 0x80
inc ebx
call edi
cmp eax, esi
jne 0x104f24c
lea eax, [ebp - 0x104]
push eax
push 0x1008064
push 4
call fcn.0105e5ad
mov ecx, dword [ebp - 0x120]
add esp, 0xc
push dword [ebp - 0x108]
push dword [ebp - 0x114]
call fcn.0104eeea
cmp eax, esi
push dword [ebp - 0x114]
mov dword [ebp - 0x11c], eax
jl 0x104f246
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x104f1b0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x11c]
cmp eax, esi
jl 0x104f275
inc dword [ebp - 0x110]
cmp dword [ebp - 0x110], 5
jl 0x104f12e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 4
Function at 0x104f28b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0xd8], eax
jne 0x104f2ba
mov eax, 0x80004003
jmp 0x104f4c7
push ebx
mov ebx, dword [ecx]
cmp ebx, esi
je 0x104f4c4
push edi
mov ecx, dword [ebx]
cmp ecx, esi
je 0x104f4b8
mov edi, 0xc8
push edi
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xd4], esi
call fcn.0104eb26
test eax, eax
jne 0x104f4b8
lea eax, [ebp - 0xcc]
push eax
push 0x100798c
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x104f4b8
lea eax, [ebp - 0xcc]
push eax
push 0x100808c
push 4
call fcn.0105e5ad
add esp, 0xc
push esi
lea eax, [ebp - 0xd4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104f4b8
mov ecx, dword [ebx]
push edi
lea eax, [ebp - 0xcc]
push eax
call fcn.0104e8de
test eax, eax
je 0x104f4ac
mov eax, dword [ebx]
cmp dword [eax + 4], 3
jne 0x104f376
cmp dword [eax], 4
je 0x104f4ac
mov edi, dword [eax + 0xc]
cmp edi, esi
je 0x104f4ac
push edi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd4]
call fcn.0105b2ea
cmp eax, esi
mov dword [ebp - 0xd0], eax
je 0x104f4ac
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x104f3a7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push esi
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebx]
push 0x64
lea eax, [ebp - 0xcc]
push eax
call fcn.0104e8de
test eax, eax
je 0x104f418
lea eax, [ebp - 0xcc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x104f3e8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push esi
push 0x10076fc
push dword [ebp - 0xd0]
push dword [ebp + 0xc]
call fcn.0105878c
mov ecx, dword [ebx]
push 0xc8
lea eax, [ebp - 0xcc]
push eax
call fcn.0104eb26
test eax, eax
jl 0x104f468
lea eax, [ebp - 0xcc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x104f438
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push esi
push 0x10078d0
push dword [ebp - 0xd0]
push dword [ebp + 0xc]
call fcn.0105878c
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
cmp ecx, esi
je 0x104f4a0
mov eax, ecx
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x104f476
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push esi
push 0x1007668
push dword [ebp - 0xd0]
push dword [ebp + 0xc]
call fcn.0105878c
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebx + 4]
cmp ebx, esi
jne 0x104f2c6
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 8
Function at 0x104f572
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x48], 0
push edi
je 0x104f673
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x104f673
mov eax, ecx
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x104f5a5
sub eax, edi
sar eax, 1
cmp eax, 6
jbe 0x104f673
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
push ebx
push 0x5c
push ecx
call edi
push dword [esi + 0x18]
mov ebx, eax
push 0x10080c8
push 4
mov dword [ebp - 0x418], 1
call fcn.0105e5ad
add esp, 0x14
test ebx, ebx
je 0x104f5ee
and word [ebx], 0
lea eax, [ebp - 0x414]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x104f672
lea eax, [ebp - 0x414]
push eax
call fcn.01056bba
push dword [esi + 0x18]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01034c79
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x104f637
and word [eax + 2], 0
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f665
lea eax, [ebp - 0x418]
push eax
push dword [esi + 0x18]
call fcn.0105a39e
push dword [esi + 0x18]
jmp 0x104f66c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop ebx
xor edi, edi
cmp dword [esi + 0x4c], edi
je 0x104f68d
cmp dword [ebp + 8], edi
je 0x104f68d
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x104f68d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x50], edi
je 0x104f6ac
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x104f6ac
push eax
call fcn.0105970f
test eax, eax
je 0x104f6ac
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 4
Function at 0x104f7dc
Capabilities:
Get common file path
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push eax
lea edi, [esi + 4]
push edi
call fcn.010593e7
test eax, eax
mov dword [ebp - 0x210], eax
jl 0x104f8de
mov ecx, esi
call fcn.0104f6c1
cmp dword [esi + 0x84], 0
je 0x104f8de
push ebx
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x104f8dd
lea eax, [ebp - 0x20c]
push eax
call fcn.01056bba
push dword [edi]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01034cee
lea eax, [ebp - 0x20c]
push eax
call fcn.01056f43
test eax, eax
je 0x104f8dd
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x104f8dd
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x104f8d6
mov ecx, dword [ebp - 0x214]
xor edx, edx
or edx, eax
or ecx, edi
cmp edx, dword [esi + 0x70]
jne 0x104f8d6
cmp ecx, dword [esi + 0x74]
jne 0x104f8d6
lea eax, [ebp - 0x20c]
push eax
add esi, 0x1c
push esi
call fcn.010593e7
mov dword [ebp - 0x210], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 4
Function at 0x1050394
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1c], edi
je 0x10504e1
cmp dword [esi + 0x18], edi
je 0x10504e1
push 0x26e9
call fcn.0105db8a
push 1
push edi
push 1
push dword [esi + 0x1c]
call fcn.01057e61
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x10504e6
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
push 0x5c
push dword [esi + 0x18]
call edi
push 0x5c
push dword [esi + 0x1c]
mov ebx, eax
call edi
add esp, 0x10
test ebx, ebx
je 0x1050415
test eax, eax
je 0x1050415
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1050415
push dword [esi + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x10504dc
push 0x26ea
call fcn.0105db8a
mov eax, dword [esi + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1050425
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x105044d
mov eax, 0x8007000e
jmp 0x10504e6
cmp edi, 0x7fffffff
jbe 0x105045f
mov eax, 0x80070057
jmp 0x10504e6
push 0xffffffffffffffff
push edi
push dword [esi + 0x1c]
push ebx
call fcn.01048179
test eax, eax
jne 0x105047d
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, 0x80004005
jmp 0x10504e6
push esi
push 0x105036a
push 0
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetA]
test eax, eax
je 0x10504a4
push dword [esi + 0x1c]
push 0x10072fc
push 4
call fcn.0105e5ad
add esp, 0xc
jmp 0x10504d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10504b3
push 0x57
pop eax
test eax, eax
jle 0x10504bf
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [esi + 0x1c]
mov dword [ebp - 4], eax
push 0x10071e4
push 2
call fcn.0105e5ad
add esp, 0x10
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 4]
jmp 0x10504e6
mov eax, 0x80004003
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10504f0
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x41c], 0
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1050603
push edi
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x10075a4
push edi
push 0x1008290
push 0x1002378
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x10505eb
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10505eb
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1050565
sub eax, edx
sar eax, 1
cmp eax, 0x26
jb 0x105057f
and word [ebp - 0x1c0], cx
lea eax, [ebp - 0x20c]
push eax
push 0x1008208
push 0x1002b4c
lea eax, [ebp - 0x418]
push 0x105
push eax
call fcn.01034d76
add esp, 0x14
test eax, eax
jl 0x1050602
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x418]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1050602
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x41c], 1
jmp 0x1050602
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10081cc
push 4
call fcn.0105e5ad
add esp, 0x10
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 4

Function at 0x105073a
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x23c], 0
je 0x1050762
xor eax, eax
jmp 0x10507e4
push ebx
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x10507da
push edi
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10507c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x186a0
div ecx
lea eax, [ebp - 0x20c]
push edx
push eax
push 0x10082c0
push edi
push ebx
call fcn.01034db1
add esp, 0x14
test eax, eax
jl 0x10507c9
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10507c9
mov dword [esi + 0x23c], ebx
cmp dword [esi + 0x23c], 0
pop edi
jne 0x10507e1
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, 0x80004005
jmp 0x10507e3
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret
Function at 0x10507f6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [eax + 0x24]
push esi
xor esi, esi
cmp ecx, esi
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x298], ecx
jne 0x1050839
mov eax, 0x80004005
jmp 0x10509ea
mov eax, dword [eax + 0x1c]
push ebx
xor ebx, ebx
inc ebx
cmp eax, esi
je 0x1050858
cmp eax, ebx
je 0x1050858
cmp eax, 2
je 0x1050858
mov dword [ebp - 0x294], ebx
jmp 0x10509e3
push esi
push 0xb
push 0x10075c0
lea eax, [ebp - 0x28c]
push 0x208
push eax
call fcn.01034db1
add esp, 0x14
test eax, eax
jl 0x10509d9
push esi
lea eax, [ebp - 0x290]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x28c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10509d9
push edi
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x2a4]
push eax
push esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x29c], esi
mov esi, 0x10082f0
push esi
push dword [ebp - 0x290]
mov dword [ebp - 0x2b0], 0x80
mov dword [ebp - 0x2a4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x1050948
cmp dword [ebp - 0x2a4], ebx
jne 0x1050948
lea eax, [ebp - 0x84]
push eax
call fcn.01056c56
push dword [ebp - 0x298]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], edx
call fcn.01056c56
cmp edx, dword [ebp - 0x29c]
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2a8], edx
jb 0x1050976
ja 0x1050948
cmp eax, dword [ebp - 0x2a0]
jbe 0x1050976
mov eax, dword [ebp - 0x298]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1050951
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x298]
push ebx
push 0
push esi
push dword [ebp - 0x290]
call edi
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x2a8], eax
jb 0x10509ca
ja 0x1050994
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x2ac], eax
jb 0x10509ca
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x10509ca
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10509a6
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push ebx
push 0
push 0x10082e0
push dword [ebp - 0x290]
call edi
push dword [ebp - 0x290]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
jmp 0x10509e3
mov dword [ebp - 0x294], 0x80004005
mov eax, dword [ebp - 0x294]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret
Function at 0x105141a
Capabilities:
Check for time delay via gettickcount
Create directory
Get common file path
Get file size

Disassembly:
mov ecx, dword [ecx + 0x60]
test ecx, ecx
jne 0x1051427
mov eax, 0x80004005
ret
jmp fcn.0104ff58
Function at 0x1051bc5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x88
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edx, edx
cmp eax, edx
pop ecx
je 0x1051c0a
mov ecx, eax
call fcn.0104f4db
mov dword [ebp - 0x418], eax
jmp 0x1051c10
mov dword [ebp - 0x418], edx
cmp dword [ebp - 0x418], edx
jne 0x1051c22
mov eax, 0x8007000e
jmp 0x1051e17
push ebx
push esi
push edx
mov esi, 0x208
push esi
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x1007810
push ebx
push edi
call fcn.0104e379
mov edi, eax
test edi, edi
jge 0x1051c59
push ebx
push 0x100853c
push 2
call fcn.0105e5ad
add esp, 0xc
jmp 0x1051dee
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0104ccc4
cmp dword [edi + 0x2c], 1
jne 0x1051c9f
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1007874
push dword [ebp - 0x41c]
call fcn.0104e379
test eax, eax
jl 0x1051c9f
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0104cee3
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x1007828
push ebx
push dword [ebp - 0x41c]
call fcn.0104e379
mov edi, eax
test edi, edi
jl 0x1051c44
mov ecx, dword [ebp - 0x418]
cmp dword [ecx + 0x2c], 1
je 0x1051d55
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1051d1f
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1051cf0
lea ecx, [ebp - 0x20c]
push ecx
sub eax, edx
lea ecx, [ebp - 0x414]
push ecx
sar eax, 1
sub edi, eax
push 0x1008528
mov eax, ecx
push edi
push eax
call fcn.01034d76
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
call fcn.01056f43
test eax, eax
jne 0x1051d47
push ebx
push 0x10084f8
xor edi, edi
push 2
inc edi
call fcn.0105e5ad
add esp, 0xc
jmp 0x1051df2
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
jmp 0x1051d5b
lea eax, [ebp - 0x20c]
push eax
call fcn.01051af1
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x1007860
push ebx
push dword [ebp - 0x41c]
call fcn.0104e379
mov edi, eax
test edi, edi
jl 0x1051c44
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0104ce9d
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1007840
push dword [ebp - 0x41c]
call fcn.0104e379
test eax, eax
jl 0x1051dc8
lea eax, [ebp - 0x20c]
push eax
lea eax, [edi + 0x14]
push eax
call fcn.010593e7
mov ecx, edi
call fcn.0104cc80
test eax, eax
je 0x1051deb
cmp dword [edi + 0x58], 2
je 0x1051deb
mov ecx, dword [ebp - 0x420]
push 0
push edi
call fcn.0104cfab
mov edi, eax
jmp 0x1051dee
xor edi, edi
inc edi
test edi, edi
je 0x1051e13
mov ecx, dword [ebp - 0x418]
push 1
call fcn.01051b9f
test edi, edi
jge 0x1051e13
push edi
push 0x10084a0
push 2
call fcn.0105e5ad
add esp, 0xc
pop esi
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01047417
leave
ret 4