joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10302d9
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.0102c812
mov dword [ebp - 0x18], eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x14], edx
je 0x1030361
push 2
push ebx
push ebx
push dword [ebp + 8]
call fcn.0102c812
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
je 0x1030361
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
js 0x10303f6
jg 0x103033a
cmp esi, ebx
jbe 0x10303f6
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x103036d
call fcn.0102511f
mov dword [eax], 0xc
call fcn.0102511f
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.0103050e
pop ecx
pop ecx
mov dword [ebp - 8], eax
test edi, edi
jl 0x103038d
jg 0x1030389
cmp esi, ebx
jb 0x103038d
mov eax, ebx
jmp 0x103038f
mov eax, esi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0102c9ba
add esp, 0xc
cmp eax, 0xffffffff
je 0x10303d9
cdq
sub esi, eax
sbb edi, edx
js 0x10303b0
jg 0x103037f
test esi, esi
ja 0x103037f
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0103050e
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x103045f
call fcn.01025137
cmp dword [eax], 5
jne 0x10303ee
call fcn.0102511f
mov dword [eax], 0xd
or esi, 0xffffffff
mov dword [ebp - 0xc], esi
jmp 0x10303b3
cmp edi, ebx
jg 0x103046b
jl 0x1030400
cmp esi, ebx
jae 0x103046b
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0102c812
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x1030361
push dword [ebp + 8]
call fcn.0102ebea
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x103046b
call fcn.0102511f
mov dword [eax], 0xd
call fcn.01025137
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x1030361
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.0102c812
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x1030361
xor eax, eax
jmp 0x1030368
Function at 0x1033e5f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1033eb3
push 3
lea eax, [ebp - 0x44]
push 0x1008500
push eax
call fcn.0102f7b7
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0102177f
leave
ret

Function at 0x1033ed9
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.01021bf0
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x1033f32
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x1033f86
dec ecx
jne 0x1033fa9
cmp edx, 5
jne 0x1033f7e
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x1033f7a
dec ecx
je 0x1033f6f
dec ecx
je 0x1033f60
push 0x14
jmp 0x1033fd1
cmp word [ebp - 0xc], 1
jb 0x1033f6a
push 0x10
pop eax
or eax, 4
jmp 0x1033fa9
cmp word [ebp - 0xc], 2
jb 0x1033f6a
push 8
jmp 0x1033f69
push 4
jmp 0x1033fd1
cmp edx, 4
ja 0x1033fb5
push 2
pop eax
cmp edx, 4
jne 0x1033fa9
cmp dword [ebp - 0x118], 0
je 0x1033fa6
cmp dword [ebp - 0x118], 0xa
je 0x1033fa6
cmp dword [ebp - 0x118], 0x5a
jne 0x1033fa9
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0102177f
leave
ret
cmp edx, 6
jne 0x1033fd4
cmp dword [ebp - 0x118], 0
jne 0x1033fd4
cmp dword [ebp - 0x114], 0x1554
jae 0x1033fd4
push 0x40
pop eax
jmp 0x1033fa9
push 0x20
jmp 0x1033fd1

Function at 0x1034104
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x10656d4], si
jne 0x103419c
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x1008430
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103419c
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10084e8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x103419c
push 3
push dword [esi*8 + 0x1008280]
lea eax, [ebp - 0xc]
push eax
call fcn.01054099
add esp, 0xc
test eax, eax
je 0x103418e
inc esi
cmp esi, 0x1c
jb 0x103416d
jmp 0x103419c
mov ax, word [esi*8 + 0x1008284]
mov word [0x10656d4], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x10656d4]
xor ecx, ebp
pop esi
call fcn.0102177f
leave
ret
Function at 0x1034f92
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1034ffc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1034ff3
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0102177f
leave
ret

Function at 0x103507a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 6
pop edi
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.01021bf0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1035154
cmp dword [ebp - 0x108], 2
jne 0x1035125
cmp dword [ebp - 0x114], 4
ja 0x10350df
xor edi, edi
inc edi
jmp 0x1035154
cmp dword [ebp - 0x114], 5
jne 0x103510f
cmp dword [ebp - 0x110], 0
jne 0x10350f5
push 2
jmp 0x1035122
cmp dword [ebp - 0x110], 1
jne 0x1035102
push 3
jmp 0x1035122
cmp dword [ebp - 0x110], 2
jne 0x1035154
push 4
jmp 0x1035122
cmp dword [ebp - 0x114], edi
jne 0x1035154
cmp dword [ebp - 0x110], 0
jne 0x1035154
push 5
pop edi
jmp 0x1035154
cmp dword [ebp - 0x108], 1
jne 0x1035154
cmp dword [ebp - 0x114], 4
jne 0x1035154
cmp dword [ebp - 0x110], 0
je 0x1035152
cmp dword [ebp - 0x110], 0xa
je 0x1035152
cmp dword [ebp - 0x110], 0x5a
jne 0x1035154
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0102177f
leave
ret

Function at 0x1035262
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x103527b
xor al, al
jmp 0x1035280
shr eax, 4
and al, 1
pop ebp
ret 4

Function at 0x1035289
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10352a2
xor al, al
jmp 0x10352a9
shr eax, 4
not al
and al, 1
pop ebp
ret 4

Function at 0x10352b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10352cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10352d5
shr eax, 3
and eax, 2
pop ebp
ret 4
Function at 0x10352de
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x80
push dword [esi]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x103535c
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x20c]
push ecx
xor ebx, ebx
push ebx
push 0x100ad28
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
je 0x1035354
mov eax, dword [esi]
push 1
lea ecx, [ebp - 0x20c]
push ecx
push eax
call edi
test eax, eax
je 0x1035354
push 4
push ebx
lea eax, [ebp - 0x20c]
push eax
jmp 0x1035359
push 4
push ebx
push dword [esi]
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0102177f
leave
ret 4
Function at 0x1035c79
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
mov ebx, 0x100ad44
je 0x1035d19
push edi
call fcn.010216b0
cmp eax, esi
pop ecx
mov dword [ebp - 0xc], eax
je 0x1035d19
push eax
push edi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1035d0b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x1005f7c
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1035d0b
cmp dword [ebp + 0xc], esi
je 0x1035d0b
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
call fcn.01015d39
add esp, 0x18
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call fcn.010215c9
cmp dword [ebp - 4], esi
pop ecx
jne 0x1035d2e
cmp dword [ebp + 0xc], esi
je 0x1035d2e
push esi
push esi
push esi
push esi
push ebx
push dword [ebp + 0xc]
call fcn.01015d39
add esp, 0x18
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x103620e
Capabilities:
Copy file

Disassembly:
push 0x14
mov eax, 0x1055aa2
call fcn.01022092
lea ecx, [ebp - 0x1c]
call fcn.010155dc
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.010155dc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010155dc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.010155dc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.010155dc
mov byte [ebp - 4], 4
cmp dword [ebp + 0x14], ebx
jne 0x10362a1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.010151a6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.010151a6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010151a6
xor eax, eax
call fcn.0102217e
ret 0x10
mov ecx, dword [ebp + 0x14]
call fcn.01014eae
mov esi, dword [ebp + 8]
push esi
call fcn.01035289
test al, al
jne 0x10362c0
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x103625c
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.01036003
test eax, eax
je 0x103625c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.01035e1c
test al, al
je 0x103625c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], ebx
jne 0x1036307
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.01035d59
test al, al
jne 0x1036310
jmp 0x103625c
push eax
lea ecx, [ebp - 0x14]
call fcn.01015b0a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.01035e1c
test al, al
je 0x103625c
lea eax, [ebp - 0x10]
push eax
call fcn.01035289
test al, al
jne 0x103639b
push dword [ebp - 0x10]
call fcn.0105232e
test eax, eax
jne 0x103625c
mov eax, dword [esi]
push ebx
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x103639b
xor esi, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.010151a6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.010151a6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010151a6
mov eax, esi
jmp 0x1036299
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.01015b0a
xor esi, esi
inc esi
jmp 0x1036359
Function at 0x1036d28
Capabilities:
Delete registry key

Disassembly:
push 0x10
mov eax, 0x1055bcb
call fcn.01022092
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
call fcn.010155dc
mov dword [ebp - 4], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x1036d67
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.010151a6
mov eax, esi
call fcn.0102217e
ret 4
mov ebx, 0x100ade8
push ebx
lea ecx, [ebp - 0x1c]
call fcn.01016a0f
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.01035e1c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.010151a6
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x1036df2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x1036df9
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1036de7
mov dword [ebp - 0x18], 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1036df9
mov dword [ebp - 0x18], 1
mov esi, dword [ebp - 0x18]
jmp 0x1036d51
Function at 0x1036ec9
Capabilities:
Create directory

Disassembly:
push 0x20
mov eax, 0x1055c4b
call fcn.01022092
lea ecx, [ebp - 0x10]
call fcn.010155dc
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
call fcn.010157a2
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
call fcn.0103645b
test eax, eax
je 0x1036f1b
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov al, bl
jmp 0x10370c9
lea eax, [ebp - 0x10]
push eax
call fcn.01035262
test al, al
je 0x1036f2c
mov bl, 1
jmp 0x1036f08
push 0xa
lea ecx, [ebp - 0x2c]
call fcn.0101ac95
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
push 3
pop edi
cmp ecx, edi
jl 0x1036fcd
test ecx, ecx
jge 0x1036f59
push 0x80070057
call fcn.01014904
movzx eax, word [eax]
push eax
call fcn.0102d5c7
pop ecx
push 0x5c
test eax, eax
mov eax, dword [ebp - 0x10]
pop ebx
je 0x1036f8d
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jl 0x1036f4f
movzx edx, word [eax + 2]
cmp dx, 0x3a
jne 0x1036f8d
cmp ecx, 2
jl 0x1036f4f
movzx ecx, word [eax + 4]
cmp cx, bx
je 0x1036fde
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x1036f4f
movzx ecx, word [eax]
cmp cx, bx
jne 0x1036fcd
cmp edx, 1
jl 0x1036f4f
movzx eax, word [eax + 2]
cmp ax, bx
jne 0x1036fcd
push 2
push ebx
lea ecx, [ebp - 0x10]
call fcn.01035950
test eax, eax
jl 0x1036fcd
inc eax
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.01035950
mov edi, eax
test edi, edi
jl 0x1036fcd
inc edi
jns 0x1036fde
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.01014f7b
jmp 0x1036f28
push ebx
lea ecx, [ebp - 0x10]
call fcn.010355de
mov esi, eax
cmp esi, edi
jg 0x1036ff1
mov esi, edi
jmp 0x1036ff2
inc esi
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.01035b77
mov byte [ebp - 4], 3
push dword [eax]
lea ecx, [ebp - 0x2c]
call fcn.01036e9b
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.010151a6
cmp esi, edi
jle 0x1037051
dec esi
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0101aff5
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.01015b0a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.010151a6
lea eax, [ebp - 0x10]
push eax
call fcn.01035262
test al, al
je 0x1036fde
xor esi, esi
cmp dword [ebp - 0x24], esi
je 0x1036fcd
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x10370af
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.010157a2
mov byte [ebp - 4], 5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.01014be7
push eax
lea eax, [ebp + 8]
push eax
call fcn.01035e1c
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10370d1
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.010151a6
cmp dword [ebp - 0x14], esi
jne 0x1037066
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.01014f7b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov al, 1
call fcn.0102217e
ret 4
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.010151a6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.01014f7b
jmp 0x1036f06
Function at 0x1037161
Capabilities:
Copy file

Disassembly:
push 0xc
mov eax, 0x1055cc3
call fcn.01022092
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.010155dc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.010155dc
mov byte [ebp - 4], 3
lea eax, [ebp + 8]
push eax
call fcn.01035289
test al, al
jne 0x10371db
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.010151a6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.010151a6
xor eax, eax
call fcn.0102217e
ret 0xc
lea eax, [ebp + 0xc]
push eax
call fcn.01036ec9
test al, al
je 0x10371a1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
call fcn.01036003
test eax, eax
je 0x10371a1
push 0x2e
lea ecx, [ebp + 8]
call fcn.010355de
cmp eax, 0xffffffff
je 0x10371a1
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.0103598b
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.0101580d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.01035e1c
test al, al
jne 0x1037256
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.010151a6
jmp 0x10371a1
lea eax, [ebp - 0x10]
push eax
call fcn.01035289
test al, al
jne 0x10372c5
push dword [ebp - 0x10]
call fcn.0105232e
test eax, eax
jne 0x1037245
xor esi, esi
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10372c5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.010151a6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.010151a6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.010151a6
mov eax, esi
jmp 0x10371d3
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
call fcn.01015b0a
xor esi, esi
inc esi
jmp 0x1037282
Function at 0x103af7b
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0
mov eax, 0x105985b
call fcn.01022092
mov esi, ecx
and dword [ebp - 4], 0
call fcn.0103ad2a
test eax, eax
jne 0x103afae
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.010151a6
mov eax, esi
call fcn.0102217e
ret 8
push 0x100d278
lea ecx, [ebp + 8]
call fcn.01014f10
test eax, eax
je 0x103aff2
push 0x100d250
lea ecx, [ebp + 8]
call fcn.01014f10
test eax, eax
je 0x103aff2
push 0x100b36c
lea ecx, [ebp + 8]
call fcn.01014f10
test eax, eax
je 0x103aff2
push 0x100d21c
lea ecx, [ebp + 8]
call fcn.01014f10
test eax, eax
jne 0x103af96
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], 0
jne 0x103b012
lea ecx, [ebp + 8]
call fcn.01014f3a
push eax
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
inc esi
jmp 0x103af98
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
call fcn.01035a81
mov edi, eax
test edi, edi
je 0x103af96
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push 7
push 0
lea ecx, [ebp + 8]
call fcn.0101f8d5
push eax
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.010213d8
xor eax, eax
test esi, esi
sete al
pop ecx
mov esi, eax
jmp 0x103af98
Function at 0x103b0b7
Capabilities:
Copy file
Set file attributes

Disassembly:
push 4
mov eax, 0x10564d0
call fcn.01022092
mov esi, ecx
mov dword [ebp - 4], 1
xor edi, edi
cmp dword [esi + 0x14], edi
jne 0x103b0f7
mov esi, 0x10a
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.010151a6
mov eax, esi
jmp 0x103b20f
lea ecx, [ebp - 0x10]
call fcn.010155dc
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
je 0x103b1e8
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], edi
je 0x103b1e8
lea eax, [ebp + 8]
push eax
call fcn.01035289
test al, al
jne 0x103b139
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
push 2
pop esi
jmp 0x103b0d8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
add esi, 8
push esi
call fcn.01035e1c
push dword [ebp - 0x10]
call fcn.0105232e
mov esi, eax
cmp esi, edi
je 0x103b169
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
jmp 0x103b0d8
push edi
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x103b1c0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
cmp ebx, 5
jne 0x103b1ad
push 0x80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push dword [ebp - 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x103b1c0
call esi
mov esi, eax
jmp 0x103b158
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov esi, ebx
jmp 0x103b0d8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.010151a6
xor eax, eax
jmp 0x103b20f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.010151a6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.010151a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.010151a6
push 0x57
pop eax
call fcn.0102217e
ret 8