joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10294e2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push esi
xor edi, edi
inc edi
push edi
push 5
mov dword [ebp - 0x214], esi
call fcn.01034068
test eax, eax
je 0x10296a5
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10024d8
push 0x80000002
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10296a5
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x10030c4
push dword [ebp - 0x210]
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x10295b8
cmp dword [ebp - 0x21c], 1
jne 0x10295b8
lea eax, [ebp - 0x20c]
push 0x10024b0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
neg eax
pop ecx
mov dword [ebp - 0x214], eax
je 0x1029682
push 8
push 0x10024b0
push 1
push esi
push 0x10030a4
push dword [ebp - 0x210]
call edi
push esi
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01028de2
test eax, eax
je 0x1029682
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x1003004
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x1029682
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1002db8
push 0x80000002
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1029682
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102964c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003040
push dword [ebp - 0x218]
call edi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 8
push 0x10024b0
push 1
push esi
push 0x10030c4
push dword [ebp - 0x210]
call edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret
Function at 0x1029e2b
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
push 0x2001f
xor esi, esi
push esi
push 0x1003768
push 0x80000002
mov dword [ebp - 0x210], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1029ed8
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push 0x1003750
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
mov dword [ebp - 0x214], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029ec8
cmp dword [ebp - 0x214], 1
jne 0x1029ec8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x1029eee
push 0x1003730
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003728
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100371c
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003710
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003704
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x10036cc
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003694
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100365c
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003628
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x10035f0
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x10035b8
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003580
call fcn.010280c0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1003548
call fcn.010280c0
push 0x1003544
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x100351c
push esi
call fcn.010280c0
push 0x1003510
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x1003504
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034f8
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034ec
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034e0
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034d8
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034cc
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034c0
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034b4
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
push 0x10034a8
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010280c0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret
Function at 0x102b6e6
Capabilities:
Delete registry value
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
push esi
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.01034382
xor edi, edi
test eax, eax
je 0x102b861
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x1002f14
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102b861
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 8], edi
mov dword [ebp - 0x210], edi
je 0x102b76a
and eax, 0xfffffff9
jmp 0x102b76d
or eax, 6
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1004d80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102b93e
cmp dword [ebp + 8], edi
push ebx
jne 0x102b908
push 0x1004d18
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01028aa1
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 2
pop ebx
jl 0x102b803
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x102b7da
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push 0x1004cec
push dword [ebp - 0x210]
call esi
push 0x1004c80
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01028aa1
test eax, eax
jl 0x102b84f
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x102b826
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
invalid
call dword [eax + 0x53]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1004cec
push dword [ebp - 0x210]
call ebx
push 0x1004c54
push dword [ebp - 0x210]
call ebx
jmp 0x102b854
Function at 0x102bcdf
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x634]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1004f78
push 0x80000002
mov dword [ebp - 0x634], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102bea2
push esi
push edi
mov esi, 0x105
push esi
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x102be19
push 0x1004f68
lea eax, [ebp - 0x41c]
push eax
push 0x1004f5c
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102bdb1
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102bdb1
push 8
lea eax, [ebp - 0x630]
push eax
push 3
push ebx
push 0x1004f68
push dword [ebp - 0x634]
call edi
push 0x10029f4
lea eax, [ebp - 0x41c]
push eax
push 0x1004f5c
lea eax, [ebp - 0x210]
push esi
push eax
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 0x630], ebx
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102be19
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102be19
push 8
lea eax, [ebp - 0x630]
push eax
push 3
push ebx
push 0x10029f4
push dword [ebp - 0x634]
call edi
push esi
push 1
lea eax, [ebp - 0x628]
push eax
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 0x630], ebx
call fcn.01034382
test eax, eax
je 0x102be94
push 0x1002f14
lea eax, [ebp - 0x628]
push eax
push 0x1004f5c
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102be94
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102be94
push 8
lea eax, [ebp - 0x630]
push eax
push 3
push ebx
push 0x1002f14
push dword [ebp - 0x634]
call edi
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret
Function at 0x102beb4
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102bf8f
lea eax, [ebp - 0x210]
push eax
call fcn.01032458
push 0x10029f4
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.01028adc
test eax, eax
jl 0x102bf8f
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
xor esi, esi
push eax
mov dword [ebp - 0x218], esi
call fcn.010337d4
test eax, eax
je 0x102bf8f
cmp word [ebp - 0x218], 0x409
je 0x102bf8f
push esi
lea eax, [ebp - 0x214]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x1002db8
push 0x80000001
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102bf8f
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push esi
push 0x1004fe8
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret
Function at 0x102c463
Capabilities:
Create process on windows

Disassembly:
call fcn.0102c077
jmp fcn.0102c3df

Function at 0x102c472
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xca8
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xd
pop ecx
mov esi, 0x1005434
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xa
pop ecx
mov esi, 0x1005408
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push 0xd
movsw word es:[edi], word [esi]
pop ecx
mov esi, 0x10053d0
lea edi, [ebp - 0xca4]
rep movsd dword es:[edi], dword [esi]
push 0x1d2
xor ebx, ebx
lea eax, [ebp - 0xc6e]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
push 0x11
pop ecx
mov esi, 0x1005388
lea edi, [ebp - 0xa9c]
rep movsd dword es:[edi], dword [esi]
push 0x1c2
lea eax, [ebp - 0xa56]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
push 0x12
pop ecx
mov esi, 0x1005338
lea edi, [ebp - 0x894]
rep movsd dword es:[edi], dword [esi]
push 0x1be
lea eax, [ebp - 0x84a]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
add esp, 0x24
mov esi, 0x105
push esi
lea eax, [ebp - 0x480]
push eax
call fcn.0102c028
test eax, eax
je 0x102c5e2
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x480]
push eax
mov edi, 0x1005328
push edi
lea eax, [ebp - 0x68c]
push esi
push eax
call fcn.01028b64
add esp, 0x18
test eax, eax
jl 0x102c5e2
lea eax, [ebp - 0x68c]
push eax
call fcn.010326f3
test eax, eax
je 0x102c5e2
lea ebx, [ebp - 0xca4]
mov dword [ebp - 0xca8], 3
lea eax, [ebp - 0x3c]
push eax
push ebx
lea eax, [ebp - 0x480]
push eax
push edi
lea eax, [ebp - 0x274]
push esi
push eax
call fcn.01028b64
add esp, 0x18
test eax, eax
jl 0x102c5d4
lea eax, [ebp - 0x274]
push eax
call fcn.010326f3
test eax, eax
je 0x102c5be
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
add ebx, 0x208
dec dword [ebp - 0xca8]
jne 0x102c580
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret
Function at 0x102c5f6
Capabilities:
Create process on windows
Delete registry value
Modify service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2238
call fcn.01031a20
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x2214]
push eax
push 3
xor esi, esi
push esi
xor edi, edi
push 0x10054d8
inc edi
push 0x80000001
mov dword [ebp - 0x2210], edi
mov dword [ebp - 0x2214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102c65d
push 0x10054c0
push dword [ebp - 0x2214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034382
test eax, eax
je 0x102c6be
push 0x10054a4
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01028b1e
test eax, eax
jl 0x102c6be
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102c6be
push 0xa
push esi
push 0x1005494
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
je 0x102c6be
mov dword [ebp - 0x2210], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 0x2218], eax
je 0x102c7ab
push ebx
push 0x27
push 0x1005478
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x102c79e
lea eax, [ebp - 0x221c]
push eax
push 0x2000
lea eax, [ebp - 0x220c]
push eax
push ebx
mov dword [ebp - 0x221c], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x102c71f
cmp dword [ebp - 0x2208], 2
jne 0x102c73d
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x102c73d
mov dword [ebp - 0x2210], esi
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x2238], esi
lea edi, [ebp - 0x2234]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2238]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x102c77d
test byte [ebp - 0x2230], 1
je 0x102c797
cmp dword [ebp - 0x2234], 3
je 0x102c797
cmp dword [ebp - 0x2234], 1
je 0x102c797
lea eax, [ebp - 0x2238]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x102c797
mov dword [ebp - 0x2210], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x2218]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2210]
pop edi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret
Function at 0x102c7c4
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
cmp edi, esi
je 0x102c8a4
push dword [ebp + 0xc]
push edi
call fcn.010289b7
test eax, eax
jne 0x102c871
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push 0x8035
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x102c8a4
push 0x1005598
lea eax, [ebp - 0x414]
push eax
push 0x1004f5c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102c8a4
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x102c8a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100558c
push dword [ebp + 0xc]
push edi
call fcn.01028b9f
add esp, 0x14
test eax, eax
jl 0x102c8a4
push esi
xor ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x102c8a4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x102c8a4
xor ebx, ebx
call esi
push eax
push edi
push 0x1005548
push 4
call fcn.01036b8b
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 8
Function at 0x102c8bc
Capabilities:
Enumerate files on windows
Move file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc84
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc84], 0
push esi
mov esi, 0x208
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028928
test eax, eax
je 0x102cab5
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102c7c4
test eax, eax
je 0x102cab5
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x1005654
mov ebx, 0x104
lea eax, [ebp - 0xa2c]
push ebx
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x102cab4
push edi
lea eax, [ebp - 0xc7c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc80], eax
je 0x102ca18
mov esi, 0x1004f5c
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102c9ef
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102c9ef
xor eax, eax
inc eax
push eax
mov dword [ebp - 0xc84], eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x102c9ef
and dword [ebp - 0xc84], eax
call edi
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
push 0x1005620
push 4
call fcn.01036b8b
add esp, 0x14
lea eax, [ebp - 0xc7c]
push eax
push dword [ebp - 0xc80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102c961
push dword [ebp - 0xc80]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x102ca24
push 0x1005600
push 4
call fcn.01036b51
xor esi, esi
cmp dword [ebp - 0xc84], esi
je 0x102cab3
push esi
lea eax, [ebp - 0xc80]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1002db8
push 0x80000002
mov dword [ebp - 0xc80], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102cab3
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102ca63
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1002e10
push dword [ebp - 0xc80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x102caa7
call edi
push eax
push 0x10055b8
push 2
call fcn.01036b8b
add esp, 0xc
push dword [ebp - 0xc80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc84]
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret
Function at 0x102cb03
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
push eax
push 0x26
push eax
xor edi, edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x102cb60
push 0x1005710
lea eax, [ebp - 0x20c]
push eax
push 0x1004f5c
push dword [ebp + 0xc]
push esi
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x102cb60
push esi
call fcn.01033ed9
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 8
Function at 0x102cb77
Capabilities:
Enumerate files on windows
Get common file path
Get file attributes
Set current directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa84
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0xa80], edi
call fcn.01028a29
test eax, eax
je 0x102cd5c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102cb03
test eax, eax
je 0x102cd5b
push 0x100574c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jl 0x102cd5b
lea eax, [ebp - 0x414]
push eax
push edi
push edi
push 0x17
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x102cd5b
lea eax, [ebp - 0x824]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x102cd5b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x102cd5a
lea eax, [ebp - 0xa74]
push eax
push 0x1005740
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xa84], eax
je 0x102cd5a
lea eax, [ebp - 0xa78]
push eax
push 0x100d430
push 1
push edi
push 0x100d440
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x102cd45
mov eax, dword [ebp - 0xa78]
mov ecx, dword [eax]
lea edx, [ebp - 0xa7c]
push edx
push 0x100d420
push eax
call dword [ecx]
test eax, eax
jl 0x102cd24
mov eax, dword [ebp - 0xa7c]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0xa48]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x102cccd
mov eax, dword [ebp - 0xa78]
mov ecx, dword [eax]
push edi
push edi
push esi
lea edx, [ebp - 0x61c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x102cccd
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x102cce6
lea eax, [ebp - 0xa74]
push eax
push dword [ebp - 0xa84]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102cc81
jmp 0x102cd18
lea eax, [ebp - 0xa48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 8], edi
je 0x102ccfd
and eax, 0xfffffffd
jmp 0x102cd00
or eax, 2
push eax
lea eax, [ebp - 0xa48]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0xa80], 1
mov eax, dword [ebp - 0xa7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xa78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
lea eax, [ebp - 0x414]
push eax
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp - 0xa84]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x824]
push eax
call ebx
pop ebx
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa80]
xor ecx, ebp
pop edi
call fcn.01031a01
leave
ret 4