joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e882
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x1001e892
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push 0
push eax
call fcn.10062dd0
add esp, 0xc
mov dword [ebp - 0x88], 0x40
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov esi, eax
test esi, esi
je 0x1001e902
mov eax, 0x4c00
cmp word [ebp - 0x84], ax
je 0x1001e902
lea eax, [ebp - 0x84]
mov ecx, edi
push eax
call fcn.1000b07f
xor ecx, ecx
mov eax, 0x80004005
test esi, esi
pop edi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006077c
leave
ret 4

Function at 0x1001e922
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push 0
push eax
call fcn.10062dd0
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test esi, esi
je 0x1001e990
mov eax, 0x4c00
cmp word [ebp - 0x204], ax
je 0x1001e990
lea eax, [ebp - 0x204]
mov ecx, edi
push eax
call fcn.1000b07f
xor ecx, ecx
mov eax, 0x80004005
test esi, esi
pop edi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006077c
leave
ret 4

Function at 0x1001eb02
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret 0x2c

Function at 0x1001ec22
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
ret 8

Function at 0x1001ec52
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]

Function at 0x1001eeb2
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetGetConnectedState]

Function at 0x1001f0f2
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.USER32.dll_GetClipboardData]
Function at 0x10022bc8
Capabilities:
Delete file

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
xor edi, edi
cmp dword [esi + 0x14], 8
jb 0x10022bec
mov eax, dword [esi]
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x10022c2d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 8
jb 0x10022c0e
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10022c2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1006077c
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x10022bc6

Function at 0x1002338f
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x228
mov eax, 0x1008d120
call fcn.100614ea
mov eax, dword [ebp + 0x14]
mov ecx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
call fcn.100169a2
xor ecx, ecx
mov eax, 0x200
cmp dword [ebp + 0x10], 1
mov edx, 0x100
cmove ecx, eax
xor eax, eax
cmp dword [ebp + 0x10], 2
cmove eax, edx
and dword [ebp - 0x230], 0
or ecx, eax
or ecx, 0x20019
cmp dword [esi + 0x14], 8
jb 0x100233e7
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push eax
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x100234a5
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x1002347c
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.1000890f
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.10011829
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.10009715
jmp 0x10023484
cmp edi, 0x103
jne 0x1002348b
inc ebx
test edi, edi
je 0x10023411
jmp 0x10023499
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.10061499
ret 0x10
Function at 0x1002481f
Capabilities:
Get common file path

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor esi, esi
mov dword [ebp - 0x210], 0x104
push esi
push eax
call fcn.10062dd0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryW]
test eax, eax
je 0x10024880
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.1000b07f
jmp 0x10024894
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1006077c
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x1002481d

Function at 0x100250a9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x180
mov eax, 0x1008d692
call fcn.100614ea
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x188], ebx
mov dword [esi], ebx
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ebx
mov edi, ebx
mov dword [ebp - 0x188], 1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push ebx
push 0x55
lea ecx, [ebp - 0x168]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
test eax, eax
jne 0x10025118
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea eax, [ebp - 0x168]
mov ecx, esi
push eax
call fcn.1000b07f
test edi, edi
jns 0x100251e7
mov edi, 0xaa
lea eax, [ebp - 0xbc]
push edi
push ebx
push eax
call fcn.10062dd0
add esp, 0xc
lea ecx, [ebp - 0x184]
push 0x100adfc8
call fcn.1000890f
push edi
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 2
push eax
push ebx
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x16c], edi
push eax
lea eax, [ebp - 0xbc]
push eax
push ebx
push str.UserLanguage
push str.SoftwareMicrosoftOneDrive
call sub.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jne 0x100251d9
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x184]
call fcn.1000b07f
cmp dword [ebp - 0x174], 0
je 0x100251d9
push 0x1009b834
lea ecx, [ebp - 0x184]
call fcn.1000b129
test al, al
je 0x100251cb
push str.en_US
lea ecx, [ebp - 0x184]
call fcn.1000b07f
lea eax, [ebp - 0x184]
mov ecx, esi
push eax
call fcn.10008877
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], bl
call fcn.10009715
mov edi, 0x100af9c8
jmp 0x100251fd
push 0x100afa1c
push 1
push eax
mov ecx, esi
call 0x1002cfe5
push ebx
push edi
mov ecx, esi
call fcn.10017bd3
cmp eax, 0xffffffff
jne 0x100251ee
mov eax, esi
call fcn.10061499
ret 4
Function at 0x10025217
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x14]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
shl eax, 8
push esi
add eax, 0x20019
cmp dword [ecx + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x1002524d
mov ecx, dword [ecx]
lea esi, [ebp - 0x830]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x82c], 0x820
test eax, eax
cmovle esi, eax
and dword [ebp - 0x828], 0
test esi, esi
js 0x100252f5
cmp dword [edi + 0x14], 8
jb 0x1002528a
mov edi, dword [edi]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push edi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x100252e9
cmp dword [ebp - 0x828], 1
je 0x100252d9
cmp dword [ebp - 0x828], 2
je 0x100252d9
mov esi, 0x8007065d
jmp 0x100252e9
lea eax, [ebp - 0x824]
mov ecx, ebx
push eax
xor esi, esi
call fcn.1000b07f
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006077c
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x10025215

Function at 0x10025ce6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
push 0x208
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.10062dd0
add esp, 0xc
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
call fcn.10025bdb
mov esi, eax
test esi, esi
js 0x10025d5f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10025da2
push 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x214]
push ebx
call fcn.10025bdb
mov esi, eax
test esi, esi
js 0x10025dba
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10025dba
test edi, edi
je 0x10025dbf
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x1c]
push edi
call fcn.1001660e
mov esi, eax
jmp 0x10025dbf
mov esi, 0x80070490
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006077c
leave
ret 0x18
Function at 0x10025e7d
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x2dc
mov eax, 0x1008d842
call fcn.100614ea
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2d0], esi
mov dword [ebp - 0x2cc], ebx
mov dword [esi], ebx
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x2cc], 1
call fcn.10062dd0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1c
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x10025f7c
push 0xb0
lea eax, [ebp - 0x2c8]
push ebx
push eax
call fcn.10062dd0
add esp, 0xc
lea ecx, [ebp - 0x2c8]
push 1
call fcn.10017abc
push edi
push 0x100af3a4
push 0x1009a3f4
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.10019d50
push eax
call fcn.10019d50
push eax
call fcn.10019d50
push eax
call fcn.1001d469
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.100189d5
lea eax, [ebp - 0x2e8]
mov ecx, esi
push eax
call fcn.100088a1
lea ecx, [ebp - 0x2e8]
call fcn.10009715
lea ecx, [ebp - 0x2c8]
call fcn.100168fc
mov eax, esi
call fcn.10061499
ret 8

Function at 0x10025f88
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor esi, esi
push esi
push eax
call fcn.10062dd0
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x1009b3f8
push str.SoftwareMicrosoftOneDrive
call fcn.10025ad5
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1002600a
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.1000b07f
jmp 0x1002600f
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1006077c
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x10025f86
Function at 0x100261f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
jne 0x10026222
mov eax, 0x80070057
jmp 0x100262a0
movzx eax, byte [ebp + 0x14]
shl eax, 8
add eax, 0x20019
cmp dword [ecx + 0x14], 8
jb 0x10026236
mov ecx, dword [ecx]
push esi
lea esi, [ebp - 0xc]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x1002629d
cmp dword [edi + 0x14], 8
jb 0x10026260
mov edi, dword [edi]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push ebx
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x10026294
xor eax, eax
mov esi, 0x8007065d
cmp dword [ebp - 8], 3
cmove esi, eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1006077c
leave
ret 0x18

Function at 0x100263ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
jne 0x100263d9
mov eax, 0x80070057
jmp 0x1002646c
movzx eax, byte [ebp + 0x14]
shl eax, 8
add eax, 0x20019
cmp dword [ecx + 0x14], 8
jb 0x100263ed
mov ecx, dword [ecx]
push esi
lea esi, [ebp - 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
push 8
cmovle esi, eax
pop eax
mov dword [ebp - 8], eax
test esi, esi
js 0x10026469
cmp dword [edi + 0x14], eax
jb 0x1002641c
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x10026460
cmp dword [ebp - 0xc], 0xb
jne 0x1002645b
mov eax, dword [ebp - 0x14]
xor esi, esi
mov ecx, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
jmp 0x10026460
mov esi, 0x8007065d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1006077c
leave
ret 0x14
Function at 0x10028455
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 4
xor ebx, ebx
cmp dword [eax + 0x14], 8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
jb 0x1002847f
mov eax, dword [eax]
push eax
push str.SoftwareMicrosoftOneDriveAccounts
lea eax, [ebp - 0x28]
push eax
call fcn.1002dff8
cmp dword [eax + 0x14], 8
jb 0x10028496
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x10
push str.IsGoSov
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.10009715
test esi, esi
pop esi
jne 0x100284cc
cmp dword [ebp - 8], 1
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1006077c
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x10028453

Function at 0x10029414
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
inc esi
xor ebx, ebx
push esi
push 8
push str.SoftwareClasses
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002949f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10029496
cmp dword [ebp - 8], ebx
jne 0x10029496
cmp dword [ebp - 0xc], esi
jne 0x10029496
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x1000ffff
push str.SymbolicLinkValue
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10029496
cmp dword [ebp - 0x10], 6
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1006077c
leave
ret
jmp 0x10029412
Function at 0x1002b149
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x1c], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b180
mov eax, dword [eax]
push 0
lea edi, [ebp - 8]
push edi
xor edi, edi
push edi
push ecx
push edi
push edi
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b1c9
cmp dword [esi + 0x10], eax
jne 0x1002b1a4
xor esi, esi
jmp 0x1002b1ac
cmp dword [esi + 0x14], 8
jb 0x1002b1ac
mov esi, dword [esi]
push dword [ebp + 0x18]
push ebx
push 3
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006077c
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b147

Function at 0x1002b30d
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b344
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b386
cmp dword [esi + 0x10], eax
jne 0x1002b362
xor esi, esi
jmp 0x1002b36a
cmp dword [esi + 0x14], 8
jb 0x1002b36a
mov esi, dword [esi]
push 4
push ebx
push 4
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006077c
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b30b
Function at 0x1002b3a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b3dd
mov eax, dword [eax]
push 0
lea edi, [ebp - 8]
push edi
xor edi, edi
push edi
push ecx
push edi
push edi
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b425
cmp dword [esi + 0x10], eax
jne 0x1002b401
xor esi, esi
jmp 0x1002b409
cmp dword [esi + 0x14], 8
jb 0x1002b409
mov esi, dword [esi]
push 8
push ebx
push 0xb
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006077c
leave
ret 0x14

Function at 0x1002b574
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100c5700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x1002b5ab
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x1002b603
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
lea ecx, [eax*2 + 2]
jb 0x1002b5d2
mov ebx, dword [ebx]
movzx eax, byte [ebp + 0x1c]
inc eax
cmp dword [esi + 0x10], 0
jne 0x1002b5e1
xor esi, esi
jmp 0x1002b5e9
cmp dword [esi + 0x14], 8
jb 0x1002b5e9
mov esi, dword [esi]
push ecx
push ebx
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006077c
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b572

Function at 0x1002b623
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea edx, [eax*2 + 2]
jb 0x1002b63b
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1002b646
mov eax, dword [eax]
push edx
push ecx
push 2
push eax
push str.Environment
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
mov edx, 0x80070000
or ecx, edx
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovle edx, ecx
shr edx, 0x1f
xor dl, 1
mov al, dl
pop ebp
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x1002b621