joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10153c3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x78]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x24]
mov ebp, dword [eax + 0x18]
mov eax, dword [eax + 0x2c]
push edi
shr ebp, 4
push 2
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x3c]
pop ecx
and ebp, 1
mov dword [esp + 0x10], ecx
mov ebx, edx
mov edi, edx
mov dword [esp + 0x14], eax
test eax, eax
je 0x10153d3f
test dword [eax + 0x14], 0x100000
je 0x10153d21
test byte [eax + 0x14], 4
jne 0x10153ca2
test ebp, ebp
je 0x10153d21
test ebx, ebx
jne 0x10153ccf
push edx
push edx
push edx
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ebx, eax
test ebx, ebx
je 0x10153d30
push 0
push ebx
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov ecx, eax
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10153d30
xor edx, edx
test edi, edi
jne 0x10153ce3
push edx
push edx
push edx
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov edi, eax
test edi, edi
je 0x10153d3b
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x18]
call fcn.10070092
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
push edi
call dword [sym.imp.GDI32.dll_SetRectRgn]
push 4
push edi
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10153d30
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [eax + 0x34]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10153c8b
test edi, edi
je 0x10153d3b
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x10]
test byte [esi + 0x14], 0x80
je 0x10153d99
cmp ecx, 1
je 0x10153d99
test ebp, ebp
jne 0x10153d99
cmp dword [0x10239d4c], ebp
jne 0x10153d99
mov eax, dword [esi + 0x1c]
mov eax, dword [eax]
test dword [eax], 0x80000000
je 0x10153d99
test byte [esi + 0xe8], 0x20
jne 0x10153d99
push 0x16
push esi
call fcn.1015692e
test eax, eax
je 0x10153d99
mov edi, dword [esi + 0x3c]
jmp 0x10153d95
test dword [edi + 0x14], 0x200000
je 0x10153d92
push 1
push 1
push 0
push edi
call fcn.10153b6f
mov edi, dword [edi + 0x34]
test edi, edi
jne 0x10153d7d
test ebx, ebx
je 0x10153da4
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.USER32.dll_BeginPaint]
cmp dword [esp + 0x10], 1
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 1
mov eax, dword [ebx + 0x354]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x20]
mov dword [ebx + 0x354], eax
je 0x10153dfa
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x28]
push 0xf
push dword [esi + 0x30]
push esi
call fcn.1015692e
cmp dword [esp + 0x64], 0
je 0x10153e0d
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp + 0x68]
pop edi
pop esi
mov dword [ebx + 0x354], ecx
mov ecx, dword [esp + 0x74]
pop ebp
xor eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.10001e57
add esp, 0x70
ret 8
Function at 0x1015692e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1015693d
pop dword [ebp - 0x34]
mov eax, 0xb365790c
sub eax, 0xa3500fcf
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x4f111
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xd49ad0d8
sub ecx, 0xd49a9886
mov esi, eax
mov edi, 0x1027e000
add edi, dword [ebp - 0x34]
mov ebx, 0xf919ba8a
add ebx, 0x374e5ab7
add dword [ebp - 0x14], 0x2b82dbd6
mov edx, dword [edi]
xor dword [ebp - 8], edi
add edx, ebx
add dword [ebp - 0x30], ecx
mov dword [esi], edx
xor dword [ebp - 0x30], ebx
add esi, 4
add edi, 0xaf02984
add edi, 0xf50fd680
loop 0x10156991
add eax, 0xd41b
xor ebx, ebx
add ebx, eax
add eax, 0x586fb23b
sub eax, 0x586fb236
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10157da5
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x234
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
and dword [esp], 0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24c]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
call fcn.1000e7de
mov ecx, edi
call fcn.1001b16d
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.kernel32.dll_DeleteFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10157f43
lea ecx, [esp + 0x1c]
call fcn.1000e7de
mov ecx, edi
call fcn.1015692e
test eax, eax
je 0x10157e66
mov ecx, edi
call fcn.1015692e
cmp byte [eax], 0
je 0x10157e66
push edi
lea ecx, [esp + 0x20]
call fcn.100c9daa
lea eax, [esp + 0x34]
push eax
push 0
push 0x1014c46c
lea ecx, [esp + 0x28]
call fcn.1015692e
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
jne 0x10157e7b
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10156455
mov esi, eax
lea ecx, [esp + 0x1c]
call fcn.1001b92f
jmp 0x10157f8a
lea eax, [esp + 0x1c]
push eax
call fcn.100fc516
test eax, eax
jne 0x10157e2a
mov esi, 0x80030005
jmp 0x10157e58
lea ecx, [esp + 0x1c]
call fcn.1001b92f
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
call fcn.100dcd86
push 0x1001
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100cbafb
mov esi, eax
test esi, esi
js 0x10157f8a
push edi
lea ecx, [esp + 0x2c]
call fcn.100c9daa
push 0
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.100cbafb
mov esi, eax
test esi, esi
jns 0x10157edd
push 0
push dword [esp + 0x14]
call fcn.1015692e
jmp 0x10157f8a
push dword [esp + 0x14]
call fcn.10158c2e
push eax
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.10157929
push 0
push dword [esp + 0x14]
mov esi, eax
call fcn.1015692e
push 0
push dword [esp + 0x18]
call fcn.1015692e
mov ecx, edi
call fcn.1001b16d
push eax
test esi, esi
jns 0x10157f25
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.kernel32.dll_MoveFileA]
jmp 0x10157f8a
call ebx
test eax, eax
jne 0x10157f43
lea eax, [esp + 0x34]
push eax
call ebx
mov ecx, edi
call fcn.1001b16d
push eax
call fcn.10157d20
mov esi, eax
jmp 0x10157f8a
mov ecx, edi
call fcn.1001b16d
mov ecx, dword [esp + 0x18]
push eax
call fcn.1001b16d
mov esi, dword [sym.imp.kernel32.dll_MoveFileA]
push eax
call esi
test eax, eax
jne 0x10157f7c
mov ecx, edi
call fcn.1001b16d
push eax
call ebx
mov ecx, edi
call fcn.1001b16d
push eax
lea eax, [esp + 0x38]
push eax
call esi
jmp 0x10157f32
cmp ebp, 0xffffffff
je 0x10157f88
lea eax, [esp + 0x34]
push eax
call ebx
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.1001b92f
mov ecx, dword [esp + 0x240]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x234
ret 8
Function at 0x10158307
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x1023904c]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.1015692e
mov esi, eax
test esi, esi
je 0x1015844d
mov al, byte [esi]
test al, al
je 0x1015844d
mov byte [ebp - 0x74], al
lea eax, [ebp - 0x74]
push eax
mov word [ebp - 0x73], 0x5c3a
mov byte [ebp - 0x71], 0
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, 3
je 0x1015844d
cmp eax, 5
je 0x1015844d
cmp eax, 6
je 0x1015844d
cmp eax, 2
je 0x1015844d
mov dword [ebp - 0x7c], 0x100
call fcn.10166738
test eax, eax
je 0x1015839e
push eax
call fcn.100fc596
test eax, eax
jns 0x1015839e
xor eax, eax
jmp 0x10158450
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
call dword [0x10242b10]
test eax, eax
jne 0x1015844d
push dword [ebp - 0x70]
mov esi, dword [sym.imp.kernel32.dll_IsDBCSLeadByte]
call esi
test eax, eax
jne 0x1015844d
cmp byte [ebp - 0x70], 0x5c
jne 0x1015844d
push dword [ebp - 0x6f]
call esi
test eax, eax
jne 0x1015844d
cmp byte [ebp - 0x6f], 0x5c
jne 0x1015844d
push eax
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebx + 4]
mov ecx, ebx
call fcn.100e1bec
push dword [ebp - 0x78]
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
call edi
lea esi, [eax + 1]
lea eax, [ebp - 0x70]
push eax
call edi
add eax, esi
push eax
call dword [sym.imp.msvcr100.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10158397
lea eax, [ebp - 0x70]
push eax
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
push dword [ebp - 0x78]
push esi
call dword [sym.imp.kernel32.dll_lstrcatA]
test byte [ebx + 8], 1
push esi
mov ecx, ebx
je 0x1015843a
call fcn.1001b0b5
jmp 0x1015843f
call fcn.100dcd86
push esi
mov edi, eax
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov eax, edi
jmp 0x10158450
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001e57
add ebp, 0x94
leave
ret

Function at 0x101590ce
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
inc ebp
test dword [esi + 0x14], 0x2000000
push edi
mov ebx, 0x202
je 0x101590ec
mov esi, dword [esi + 0x44]
mov edi, dword [esp + 0x18]
xor eax, eax
cmp dword [esi + 0x30], edi
sete al
mov dword [esp + 0x14], eax
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1015913f
cmp dword [esp + 0x14], 0
jne 0x10159120
push 0x80018001
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1015913f
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x1015912f
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push 0x80018001
push 0
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_CallWindowProcA]
xor eax, eax
cmp ebp, 1
setne al
lea ebp, [eax*2 + 2]
xor eax, eax
cmp ebx, 0x202
setne al
lea ebx, [eax - 1]
and ebx, 0xfffffffd
add ebx, 0x208
cmp ebp, 4
jne 0x101590fc
push 0
push 0
push 0x1f
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10159cc0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x108
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
mov ebp, 0x104
push ebp
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.kernel32.dll_lstrcatA]
push 0x10159e24
lea eax, [esp + 0x14]
push eax
call edi
mov ebx, dword [sym.imp.kernel32.dll_LoadLibraryA]
lea eax, [esp + 0x10]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x10159d37
push ebp
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
push 0x10159e24
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x10]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x10159e04
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x10159e34
push esi
call edi
xor ebx, ebx
test eax, eax
je 0x10159de3
call eax
mov ecx, 0x229
cmp ax, cx
jb 0x10159de3
push 0x10159e88
push esi
call edi
mov dword [0x10244254], eax
test eax, eax
je 0x10159de3
push 0x10159e40
push esi
call edi
mov dword [0x1024424c], eax
test eax, eax
je 0x10159de3
push 0x10159e50
push esi
call edi
mov dword [0x10241760], eax
test eax, eax
je 0x10159de3
push 0x10159e64
push esi
call edi
mov dword [0x10244248], eax
test eax, eax
je 0x10159de3
push 0x10159e78
push esi
call edi
mov dword [0x10244250], eax
test eax, eax
je 0x10159de3
call dword [0x10244254]
test eax, eax
jne 0x10159e04
mov eax, dword [0x1024424c]
test eax, eax
je 0x10159dd1
push dword [0x1023a224]
call eax
jmp 0x10159dd3
mov eax, ebx
test eax, eax
je 0x10159de3
mov dword [0x10241fc0], 1
jmp 0x10159e04
push esi
mov dword [0x1024424c], ebx
mov dword [0x10241760], ebx
mov dword [0x10244248], ebx
mov dword [0x10244250], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov esi, ebx
mov ecx, dword [esp + 0x114]
pop edi
mov dword [0x10241fbc], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x108
ret
Function at 0x1015b94f
Capabilities:
Get common file path

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1bc]
push edi
push esi
xor ebx, ebx
xor edi, edi
xor ebp, ebp
call dword [sym.imp.kernel32.dll_lstrlenA]
mov dword [esp + 0x10], eax
push 0x21
lea eax, [esp + 0x18]
push eax
push esi
call fcn.100c9dce
or ecx, 0xffffffff
cmp eax, ecx
jne 0x1015ba3c
mov eax, dword [esp + 0x14]
dec eax
dec eax
je 0x1015ba19
dec eax
je 0x1015b9c4
sub eax, 0x1d
jne 0x1015ba3a
cmp ebx, 9
ja 0x1015ba3a
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 0x30]
xor edi, edi
mov byte [esi + ecx - 1], al
inc ebx
jmp 0x1015b97f
test ebp, ebp
jne 0x1015ba3a
push 0x90
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov ebp, dword [sym.imp.kernel32.dll_lstrcatA]
push 0x1001b980
lea eax, [esp + 0x120]
push eax
call ebp
push 0x1015ba58
lea eax, [esp + 0x120]
push eax
call ebp
lea esi, [esp + 0x11c]
mov eax, esi
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
xor ebp, ebp
xor edi, edi
inc ebp
jmp 0x1015b97b
test edi, edi
jne 0x1015ba3a
push 0x1000
lea eax, [esp + 0x18]
push eax
push esi
inc edi
call fcn.100c9dce
push eax
call dword [sym.imp.kernel32.dll__lclose]
jmp 0x1015b97f
mov eax, ecx
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x1ac
ret 4
Function at 0x10161ead
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0xfc]
sub esp, 0x17c
mov eax, dword [0x1023904c]
xor eax, ebp
mov dword [ebp + 0xf8], eax
mov ecx, dword [ebp + 0x108]
mov eax, dword [ebp + 0x104]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp + 0x10c]
push esi
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp + 0x110]
push edi
mov dword [ebp - 0x7c], ecx
push 0x27
lea ecx, [ebp + 0xd0]
push ecx
push eax
xor esi, esi
mov dword [ebp - 0x78], 0x104
call fcn.1015692e
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0xd0]
push eax
lea eax, [ebp + 0x94]
push 0x1014c3b8
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10161ff6
lea eax, [ebp - 0x70]
test eax, 0xffff0000
je 0x10161f77
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10161f54
sub ecx, edx
lea eax, [ecx*2 + 2]
call fcn.1000c5c0
mov eax, esp
lea ecx, [ebp - 0x70]
push ecx
push eax
call fcn.1001ce5b
jmp 0x10161f7a
lea eax, [ebp - 0x70]
push dword [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x10161ffb
lea eax, [ebp + 0xd0]
push eax
lea eax, [ebp + 0x94]
push 0x1014c3cc
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10161ffb
mov edi, dword [sym.imp.msvcr100.dll_strtoul]
push 0x10
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
call edi
mov ecx, dword [ebp - 0x80]
mov word [ecx], ax
mov eax, dword [ebp - 0x74]
add esp, 0xc
cmp byte [eax], 0x2e
jne 0x10161ffb
push 0x10
lea ecx, [ebp - 0x74]
push ecx
inc eax
push eax
call edi
mov ecx, dword [ebp - 0x7c]
add esp, 0xc
mov word [ecx], ax
jmp 0x10161ffb
mov esi, 0x80004005
mov eax, esi
lea esp, [ebp - 0x88]
pop edi
pop esi
mov ecx, dword [ebp + 0xf8]
xor ecx, ebp
call fcn.10001e57
add ebp, 0xfc
leave
ret 0x10
Function at 0x10164746
Capabilities:
Delete file

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x18]
call fcn.1000e7de
and dword [esp + 0x10], 0
push 1
mov ecx, edi
xor ebp, ebp
call fcn.1015692e
push ebp
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.1015692e
mov ebx, dword [esp + 0x2c]
mov esi, eax
test esi, esi
jne 0x101648d8
mov ecx, edi
call fcn.1000c528
test byte [eax], 2
je 0x10164823
test ebx, ebx
je 0x101647a2
mov eax, dword [esp + 0x28]
mov ecx, ebx
mov dword [esp + 0x10], ecx
jmp 0x101647b9
push 0x1001
push dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
call fcn.100cbafb
mov ecx, dword [esp + 0x10]
test eax, eax
jns 0x101647cf
push 0x793c
push eax
call fcn.100d79f3
mov esi, eax
jmp 0x101648d8
push dword [esp + 0x30]
push dword [esp + 0x2c]
push dword [edi + 0x1c]
push ecx
call fcn.10088bfd
mov esi, eax
test esi, esi
jne 0x101648d8
test ebx, ebx
jne 0x101647f8
push ebx
push dword [esp + 0x14]
call fcn.1015692e
push dword [esp + 0x10]
mov ecx, edi
call fcn.1015692e
mov esi, eax
test esi, esi
jne 0x101648d8
test ebx, ebx
jne 0x101648d8
push dword [esp + 0x10]
call fcn.100dc9ac
jmp 0x101648d8
test ebx, ebx
je 0x1016482d
mov dword [esp + 0x10], ebx
jmp 0x10164869
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0x34]
push eax
call fcn.101658ba
mov esi, eax
test esi, esi
jne 0x101648d8
push 0x1001
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100cbafb
test eax, eax
jns 0x10164869
push eax
call fcn.100d7c0e
mov esi, eax
test esi, esi
jne 0x101648d8
mov eax, dword [edi + 0x80]
xor ebp, ebp
inc ebp
cmp eax, 2
je 0x10164881
cmp eax, 5
je 0x10164881
cmp eax, 6
jne 0x10164895
lea eax, [edi + 0xe0]
push eax
push 1
push dword [esp + 0x18]
call fcn.1015692e
mov esi, eax
test esi, esi
jne 0x101648d8
push dword [esp + 0x10]
mov ecx, edi
call fcn.1015692e
push dword [esp + 0x10]
mov esi, eax
call fcn.100dc9ac
test esi, esi
jne 0x101648d8
test ebx, ebx
jne 0x101648d6
push dword [esp + 0x28]
push dword [esp + 0x14]
call fcn.1015692e
test eax, eax
jns 0x101648d6
push 0xffffffffffffffff
push eax
call fcn.100d79f3
mov esi, eax
test esi, esi
jne 0x101648d8
xor ebp, ebp
mov eax, dword [edi + 0x68]
xor eax, dword [esp + 0x14]
and eax, 1
xor dword [edi + 0x68], eax
test esi, esi
je 0x101648f6
cmp dword [esp + 0x34], 0
jne 0x101648f6
push esi
call fcn.10156628
cmp dword [esp + 0x10], 0
je 0x1016490a
test ebx, ebx
jne 0x1016490a
push dword [esp + 0x10]
call fcn.1007de95
test ebp, ebp
je 0x1016491d
lea ecx, [esp + 0x18]
call fcn.1001b16d
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [esp + 0x18]
call fcn.1001b92f
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
Function at 0x101658ba
Capabilities:
Get common file path

Disassembly:
sub esp, 0x310
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x30c], eax
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetTempFileNameA]
push ebp
mov ebp, dword [esp + 0x320]
push esi
push edi
mov edi, dword [esp + 0x324]
xor esi, esi
test edi, edi
je 0x10165913
mov ecx, edi
call fcn.100c4046
test eax, eax
je 0x10165913
lea eax, [esp + 0x114]
push eax
push esi
push 0x1014c46c
mov ecx, edi
call fcn.1015692e
push eax
call ebx
test eax, eax
jne 0x1016595d
lea eax, [esp + 0x114]
push eax
push esi
mov edi, 0x1014c46c
push edi
push 0x10024628
call ebx
test eax, eax
jne 0x1016595d
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x1016595a
lea eax, [esp + 0x114]
push eax
push esi
push edi
lea eax, [esp + 0x1c]
push eax
call ebx
test eax, eax
jne 0x1016595d
push 0x39
pop esi
lea eax, [esp + 0x114]
push eax
mov ecx, ebp
call fcn.100dcd86
test eax, eax
jne 0x10165973
push 7
pop esi
mov ecx, dword [esp + 0x31c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x310
ret 8

Function at 0x10169db2
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov edi, dword [esp + 0x228]
and dword [edi], 0
push str.TypeLib
push 0x1024046c
push ebp
lea eax, [esp + 0x124]
push 0x1014cbb0
push eax
mov dword [esp + 0x24], 0x100
call esi
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x120]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10169ef6
push str.VERSION
push 0x1024046c
push ebp
lea eax, [esp + 0x124]
push 0x1014cbb0
push eax
call esi
mov ebp, dword [sym.imp.kernel32.dll_lstrcatA]
add esp, 0x14
push 0x10023524
lea eax, [esp + 0x1c]
push eax
call ebp
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], 0xc
call dword [sym.imp.kernel32.dll_lstrlenA]
lea eax, [esp + eax + 0x1c]
push eax
lea eax, [esp + 0x120]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10169ef6
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1015692e
test eax, eax
jne 0x10169efc
push dword [esp + 0x14]
lea eax, [esp + 0x11c]
push 0x10169f18
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x1c]
push eax
call ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
push eax
call dword [sym.imp.msvcr100.dll_malloc]
pop ecx
mov dword [edi], eax
test eax, eax
jne 0x10169ee6
mov eax, 0x8007000e
jmp 0x10169efc
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
xor eax, eax
jmp 0x10169efc
push eax
call fcn.100bb880
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x20c
ret 0xc
Function at 0x10169fc9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 8]
push edi
lea ecx, [esp + 0xc]
push ecx
push eax
push ebp
mov dword [esp + 0x1c], eax
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1016a00d
mov dword [esp + 0xc], esi
push eax
call fcn.100bb859
mov esi, eax
test esi, esi
je 0x1016a030
jmp 0x1016a05f
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x10]
call fcn.10169fc9
test eax, eax
je 0x1016a030
mov esi, eax
inc edi
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1016a01b
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.100bb859
test eax, eax
je 0x1016a05f
mov esi, eax
push dword [esp + 0x10]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
call fcn.100bb859
test eax, eax
je 0x1016a076
mov esi, eax
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.10001e57
add esp, 0x114
ret 8

Function at 0x1016a092
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [esp + 0x68]
mov eax, dword [esi]
push edi
mov edi, dword [esp + 0x64]
push edi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push 0x1016a160
push eax
call ebp
add esp, 0xc
push esi
push ebx
lea eax, [esp + 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x1016a0e7
xor eax, eax
inc eax
jmp 0x1016a14b
cmp dword [esp + 0x70], 0
je 0x1016a0f2
xor eax, eax
jmp 0x1016a14b
push edi
lea eax, [esp + 0x18]
push 0x1016a178
push eax
call ebp
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
mov dword [esi], eax
push ebx
lea eax, [esp + 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x1016a0e2
push edi
lea eax, [esp + 0x18]
push 0x1016a190
push eax
call ebp
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
mov dword [esi], eax
push ebx
lea eax, [esp + 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x50
ret 0x10