joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001af20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2104
call fcn.1000aeb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.1001abf0
add esp, 4
test eax, eax
je 0x1001b17f
push str.977B4CC2_9D55_4B84_B7E3_FBABFCDB022B
push 0
mov ecx, 0x10052320
call fcn.10021f00
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
test ebx, ebx
je 0x1001b17f
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001b178
push 0x1ffe
push eax
lea ecx, [ebp - 0x2102]
push ecx
mov word [ebp - 0x2104], ax
call fcn.1000ae30
add esp, 0xc
cmp byte [0x10052208], 0
jne 0x1001afb3
push 0x10052208
call fcn.1001ac20
add esp, 4
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
lea ecx, [ebp - 0x104]
push ecx
call fcn.10034612
push eax
push 0x10044318
lea edx, [ebp - 0x104]
push 0x80
push edx
call fcn.1000c6df
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x2104]
push 0x1000
push ecx
call fcn.1000c8da
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
lea ecx, [ebp - 0x104]
push ecx
call fcn.1003452d
push eax
push 0x10044318
lea edx, [ebp - 0x104]
push 0x80
push edx
call fcn.1000c6df
add esp, 0x4c
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x2104]
push 0x1000
push ecx
call fcn.1000c8da
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x100442f8
lea ecx, [ebp - 0x104]
push 0x80
push ecx
call fcn.1000c6df
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x2104]
push 0x1000
push eax
call fcn.1000c8da
lea eax, [ebp - 0x2104]
add esp, 0x24
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001b0d0
sub eax, edx
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edx
sar eax, 1
mov ecx, 0x1000
push 0xffffffffffffffff
sub ecx, eax
push ecx
lea edx, [ebp + eax*2 - 0x2104]
push edx
call fcn.10011da4
push 0x100442f4
lea eax, [ebp - 0x2104]
push 0x1000
push eax
call fcn.1000c8da
push 0x100442f0
push 0x10052208
call fcn.10034456
mov esi, eax
add esp, 0x28
test esi, esi
je 0x1001b171
lea ecx, [ebp - 0x2104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1001b145
xor eax, eax
jmp 0x1001b161
lea edi, [eax + eax]
mov eax, edi
call fcn.1000c680
mov eax, esp
push 3
push edi
lea edx, [ebp - 0x2104]
push edx
push eax
call fcn.10002080
push esi
push eax
call fcn.10034294
push esi
call fcn.1001a6b4
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [ebp - 0x2110]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001b420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push edi
test ecx, ecx
je 0x1001b49a
mov edi, dword [ebp + 0x18]
push edi
call fcn.1001b410
add esp, 4
cmp ecx, eax
jl 0x1001b49a
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov word [esi], ax
mov byte [ebp + 0x13], al
mov al, 0x40
add al, 0x40
mov byte [ebp + 0x13], al
nop
xor eax, eax
test edi, edi
jle 0x1001b490
mov dl, byte [ebp + 8]
push ebx
lea esp, [esp]
nop
nop
mov ecx, dword [ebp + 0x14]
mov cl, byte [eax + ecx]
xor cl, byte [ebp + 0x13]
nop
mov ebx, eax
and ebx, 3
mov bl, byte [ebx + 0x100443c0]
add bl, dl
xor bl, cl
movzx ecx, bl
mov word [esi + eax*2], cx
nop
xor ecx, ecx
mov word [esi + eax*2 + 2], cx
inc eax
cmp eax, edi
jl 0x1001b460
pop ebx
nop
pop esi
mov eax, 1
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret

Function at 0x1001b5c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.1000aeb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x1001b6c4
cmp word [ebp + 0x14], 0
je 0x1001b6c4
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x1001b6c4
xor eax, eax
push 0x3ffe
push eax
lea ecx, [ebp - 0x4002]
push ecx
mov word [ebp - 0x4004], ax
call fcn.1000ae30
add esp, 0xc
lea edx, [ebp - 0x400c]
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1001b6c4
cmp eax, 0x3fff
ja 0x1001b6c4
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1001b6c4
lea edx, [ebp - 0x4010]
push edx
lea eax, [ebp - 0x4008]
push eax
push 0x100418d4
lea ecx, [ebp - 0x4004]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1001b6c4
push edi
push 0
push esi
call fcn.1000ae30
mov ecx, dword [ebp - 0x4008]
movzx edx, word [ecx + 0xc]
movzx eax, word [ebp + 0x14]
push edx
movzx edx, word [ecx + 0xe]
push eax
push edx
movzx edx, word [ecx + 8]
push eax
push edx
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d_c_d_c_d_c_d
push 0xffffffffffffffff
push edi
push esi
call fcn.1000c6fd
add esp, 0x38
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001b890
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
push 0
lea ebx, [esi + 0x30]
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x1001b8b5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.1000b020
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.1000ae30
mov eax, dword [esi + 8]
add esp, 0x10
push eax
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1001b8ac
lea ecx, [ebp - 0x34]
push ecx
mov ecx, esi
call fcn.1001b6e0
test eax, eax
je 0x1001b8ac
mov eax, dword [ebp - 0x2c]
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [ebp - 0x28]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [ebp - 0x24]
shr ecx, 0x10
mov word [esi + 0xc], dx
mov edx, eax
mov word [esi + 0x10], cx
mov word [esi + 0x16], ax
mov eax, dword [ebp - 0x20]
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [ebp - 0x14]
shr edx, 0x10
mov word [esi + 0x14], dx
mov edx, dword [ebp - 0x1c]
mov word [esi + 0x1a], ax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x24], ecx
push 0x104
lea ecx, [esi + 0x238]
push ecx
mov dword [esi + 0x1c], edx
mov edx, dword [ebp - 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0xc]
push 0x100444c8
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.1001b770
push 0x104
lea edx, [esi + 0x648]
push edx
push 0x100444a8
mov ecx, esi
call fcn.1001b770
push 0x104
lea eax, [esi + 0x440]
push eax
push 0x10044490
mov ecx, esi
call fcn.1001b770
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c500
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x1001c5e7
mov eax, esi
lea edx, [eax + 2]
jmp 0x1001c530
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001c530
sub eax, edx
sar eax, 1
je 0x1001c5e7
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001c570
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1001c570
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
push esi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x20c]
push edi
push edx
call fcn.1001c500
add esp, 8
test eax, eax
je 0x1001c5e7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001cac0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1001cad5
push edi
call fcn.1001c920
add esp, 4
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1001cae5
push esi
call fcn.1001c920
add esp, 4
call fcn.1001d8f0
test eax, eax
je 0x1001cb05
xor eax, eax
test esi, esi
setne al
add eax, 4
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
pop ebp
ret
push esi
push edi
call fcn.1001c600
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x1001ce10
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
add esp, 0xc
push esi
mov dword [ebp - 0x66c], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001cfe3
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001ce63
sub eax, edx
sar eax, 1
cmp eax, 4
jb 0x1001cfe3
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
push esi
lea edx, [ebp - 0x414]
push edx
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x100446a8
lea eax, [ebp - 0x414]
push eax
call ebx
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x1001cfa4
lea esp, [esp]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
push esi
lea edx, [ebp - 0x20c]
push edx
call edi
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call ebx
test byte [ebp - 0x664], 0x10
jne 0x1001cf29
lea edx, [ebp - 0x20c]
push 1
push edx
call fcn.1001cb20
add esp, 8
jmp 0x1001cf6c
lea eax, [ebp - 0x638]
push eax
push 0x10042188
call fcn.1000c2f2
add esp, 8
test eax, eax
je 0x1001cf6c
lea ecx, [ebp - 0x638]
push ecx
push 0x10042180
call fcn.1000c2f2
add esp, 8
test eax, eax
je 0x1001cf6c
lea edx, [ebp - 0x20c]
push edx
call fcn.1001ce10
add esp, 4
test eax, eax
je 0x1001cf8d
mov ecx, dword [ebp - 0x668]
lea eax, [ebp - 0x664]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001ced0
lea edi, [eax + 1]
jmp 0x1001cf93
mov edi, dword [ebp - 0x66c]
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
jne 0x1001cfb7
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1001cfcd
push 1
push esi
call fcn.1001cb20
add esp, 8
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x1001d900
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1001d949
cmp dword [ebp - 0x114], 5
jne 0x1001d949
mov eax, 1
cmp dword [ebp - 0x110], eax
je 0x1001d94b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001d960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1001d9af
cmp dword [ebp - 0x114], 6
jb 0x1001d9af
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x1001df60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x10052d8c
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
call fcn.1001b4a0
push esi
lea ecx, [ebp - 0x210]
push ecx
push esi
push 0x20006
push esi
push esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1001e034
lea edx, [ebp - 0x214]
push edx
push 2
push eax
push edi
call fcn.1001de50
add esp, 4
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
jne 0x1001e034
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
call fcn.1001de50
mov edx, dword [ebp - 0x210]
add esp, 4
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1001e034
test ebx, ebx
je 0x1001e034
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x214]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.1000ae30
add esp, 0xc
mov ecx, 0x10052d8c
call fcn.1001b4a0
push edi
mov ebx, eax
call fcn.1001de50
push eax
push ebx
push 0x10041304
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.1000c6df
push 1
push str.NoExplorer
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10022a60
mov eax, dword [ebp - 0x214]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x28
test eax, eax
je 0x1001e0aa
push eax
call edi
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x1001e0b7
push eax
call edi
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001e0d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov ecx, 0x10052d8c
mov dword [ebp - 4], 0
call fcn.1001b4a0
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1001e11a
mov edx, dword [ebp + 8]
push edx
call fcn.1001de50
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1001e128
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001e140
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov ecx, 0x10052d6c
mov dword [ebp - 4], 0
call fcn.1001b4a0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 2
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1001e1df
push edi
mov edi, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
call fcn.1001de50
mov ecx, dword [ebp - 4]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x1001e1d4
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1001e1b6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
jmp 0x1001e1b8
xor eax, eax
push eax
push esi
push 1
push 0
push edi
call fcn.1001de50
mov edx, dword [ebp - 4]
add esp, 4
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001e1f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, 0x10052d6c
mov dword [ebp - 4], 0
call fcn.1001b4a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push eax
push SysReAllocString
call edi
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
jne 0x1001e245
push ebx
call fcn.1001de50
mov edx, dword [ebp - 4]
add esp, 4
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10052d6c
call fcn.1001b4a0
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1001e281
push ebx
call fcn.1001de50
mov edx, dword [ebp - 4]
add esp, 4
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e9e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1001eaca
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x1001eaca
push esi
call fcn.1001d960
test eax, eax
je 0x1001eaa5
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1001eab4
push str.SHGetKnownFolderPath
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001ea88
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xa520a1a4
mov dword [ebp - 0x10], 0x4ff61780
mov dword [ebp - 0xc], 0x731618bd
mov dword [ebp - 8], 0x16afc543
call eax
test eax, eax
js 0x1001ea88
mov eax, dword [ebp - 0x18]
push eax
push ebx
push edi
call fcn.1000c44d
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x1001eae0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x105
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1000ae30
push edi
push 0x100457a4
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call fcn.1000c6df
lea eax, [ebp - 0x210]
add esp, 0x1c
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x1001eb30
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x20e], dx
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov word [ebp - 0x214], ax
lea edx, [ebp - 0x230]
mov eax, 0x414
lea ecx, [ebp - 0x210]
push edx
mov word [ebp - 0x220], ax
mov dword [ebp - 0x21a], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x216], esi
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x22c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001ebe0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bd9b
mov eax, dword fs:[0]
push eax
sub esp, 0x528
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x10045860
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x524], esi
call fcn.10009aa0
push 0xfe
lea ecx, [ebp - 0x10e]
xor eax, eax
push esi
push ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x528], 1
mov dword [ebp - 0x52c], pe_nt_image_headers32
mov word [ebp - 0x110], ax
call fcn.1000ae30
mov edi, dword [ebp - 0x524]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x528]
push ecx
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerVersion_Vector
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea edx, [ebp - 0x110]
push 0
push edx
call fcn.10035c8d
fst qword [ebp - 0x534]
fldz
add esp, 8
fcompp
fnstsw ax
test ah, 1
jne 0x1001edb5
push 0x100457f0
lea ecx, [ebp - 0x524]
call fcn.10009aa0
mov edi, dword [ebp - 0x524]
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x528]
push edx
push edi
push str.SOFTWAREMicrosoftInternet_ExplorerVersion_Vector
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x528], 1
mov dword [ebp - 0x52c], pe_nt_image_headers32
call esi
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.10035c8d
fst qword [ebp - 0x534]
fldz
add esp, 8
fcompp
fnstsw ax
test ah, 1
jne 0x1001edb5
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x316]
push edx
mov word [ebp - 0x318], cx
call fcn.1000ae30
add esp, 0xc
lea eax, [ebp - 0x318]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x318]
push 0x104
push ecx
call fcn.1000c8da
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x51e]
push eax
mov word [ebp - 0x520], dx
call fcn.1000ae30
push 0x2e
push 0x104
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x318]
push edx
call fcn.1001b5c0
lea eax, [ebp - 0x520]
push 0
push eax
call fcn.10035c8d
fstp qword [ebp - 0x534]
add esp, 0x30
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.1000b015
fld qword [ebp - 0x534]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret