joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104a002
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0x18
mov eax, 0x105911e
call fcn.01021eb9
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov dword [eax], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
call fcn.010151da
mov dword [ebp - 4], ebx
push dword [0x1064698]
lea ecx, [ebp - 0x20]
call fcn.010161a7
mov byte [ebp - 4], 1
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.010360f6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.01015174
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push ebx
push dword [ebp - 0x1c]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x104a0a7
push dword [esi]
cmp eax, 2
je 0x104a096
push eax
push 0x1011110
push 3
call fcn.0103ac75
add esp, 0x10
mov dword [ebp - 0x14], ebx
jmp 0x104a0e2
push 0x10113c8
push 1
call fcn.0103ac75
add esp, 0xc
jmp 0x104a0e2
cmp dword [ebp + 0x10], ebx
jne 0x104a0b5
mov dword [ebp - 0x24], 1
jmp 0x104a0e2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 7
push ebx
push dword [0x106469c]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x104a0db
push dword [esi]
push eax
push 0x1011308
jmp 0x104a087
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x10], ebx
je 0x104a0f0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], ebx
je 0x104a0ff
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp + 0x18], ebx
je 0x104a1c9
lea ecx, [ebp + 0x10]
call fcn.010151da
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 2
call fcn.0103b80d
test eax, eax
jne 0x104a13c
push 0x100bb50
push 3
call fcn.0103ac75
pop ecx
pop ecx
mov dword [ebp - 0x18], ebx
jmp 0x104a1be
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.0103afc1
test eax, eax
jne 0x104a161
push dword [ebp + 0x10]
push 0x1011298
push 3
call fcn.0103ac75
add esp, 0xc
jmp 0x104a134
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 0x10]
inc edi
push 0x1011248
push edi
call fcn.0103ac75
add esp, 0x10
cmp dword [ebp + 0xc], edi
je 0x104a194
jbe 0x104a1a4
cmp dword [ebp + 0xc], 4
ja 0x104a1a4
mov ecx, dword [ebp + 0x1c]
push esi
lea eax, [ebp + 0x10]
push eax
call fcn.01049a28
jmp 0x104a1a1
push dword [ebp + 0x1c]
lea eax, [ebp + 0x10]
push esi
push eax
call fcn.010497e2
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x1c], ebx
je 0x104a1bb
push dword [ebp + 0x10]
push 0x10111f0
push 3
call fcn.0103ac75
add esp, 0xc
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.01015174
cmp dword [ebp - 0x14], ebx
je 0x104a1d3
cmp dword [ebp - 0x18], ebx
jne 0x104a1d8
mov ebx, 0x643
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.01015174
mov eax, ebx
call fcn.01021fa5
ret 0x18
Function at 0x104af7b
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0x2c
mov eax, 0x105931e
call fcn.01021eb9
mov eax, dword [ebp + 0x18]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [eax], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call fcn.010151da
mov dword [ebp - 4], ebx
push dword [0x1064698]
lea ecx, [ebp - 0x1c]
call fcn.010161a7
mov byte [ebp - 4], 1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.010360f6
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.01015174
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push ebx
push dword [ebp - 0x18]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x104b01e
push dword [esi]
cmp eax, 2
je 0x104b00d
push eax
push 0x1011110
push 3
call fcn.0103ac75
add esp, 0x10
mov dword [ebp - 0x14], ebx
jmp 0x104b059
push 0x10113c8
push 1
call fcn.0103ac75
add esp, 0xc
jmp 0x104b059
cmp dword [ebp + 0x10], ebx
jne 0x104b02c
mov dword [ebp - 0x20], 1
jmp 0x104b059
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 7
push ebx
push dword [0x106469c]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x104b052
push dword [esi]
push eax
push 0x1011308
jmp 0x104affe
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x10], ebx
je 0x104b067
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20], ebx
je 0x104b076
push dword [ebp - 0x18]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x38]
call fcn.01014c71
mov byte [ebp - 4], 2
cmp dword [ebp + 0x10], ebx
je 0x104b092
push dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
call fcn.0103c474
push dword [ebp + 0x18]
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push esi
call fcn.010151f2
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.0104a9a9
cmp eax, ebx
jne 0x104b0cb
push 0x1011f78
push 3
call fcn.0103ac75
pop ecx
pop ecx
xor eax, eax
jmp 0x104b0ce
xor eax, eax
inc eax
cmp dword [ebp - 0x14], ebx
je 0x104b0db
cmp eax, ebx
je 0x104b0db
xor esi, esi
jmp 0x104b0e0
mov esi, 0x643
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x38]
call fcn.01014fbc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.01015174
mov eax, esi
call fcn.01021fa5
ret 0x14
Function at 0x104b54a
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push 0x20019
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
xor ebx, ebx
mov dword [ebp - 0xc], edi
call fcn.0104b38e
test eax, eax
jne 0x104b586
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x104b63e
mov ecx, esi
call fcn.0103eb4c
lea eax, [ebp - 4]
push eax
push 0x20006
push edi
push 0x10121f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104b603
lea eax, [ebp - 8]
push eax
add esi, 8
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
jne 0x104b603
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], edi
je 0x104b5ee
lea eax, [ebp - 0xc]
push eax
call fcn.01035d59
mov ebx, eax
cmp ebx, edi
je 0x104b603
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push ebx
push 7
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jmp 0x104b601
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x104b612
cmp eax, 2
je 0x104b612
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x104b615
xor esi, esi
inc esi
cmp dword [ebp - 4], edi
je 0x104b623
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x104b62e
push ebx
call fcn.01021189
pop ecx
cmp dword [ebp - 8], edi
je 0x104b63c
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x104b9f8
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push 0x14
mov eax, 0x10593f6
call fcn.01021eb9
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.010151da
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.010151da
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0xc], ebx
jne 0x104ba58
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.01015174
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.01015174
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01015174
mov eax, esi
call fcn.01021fa5
ret 0xc
push 0x1012368
lea ecx, [ebp - 0x1c]
call fcn.010161a7
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.010360f6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.01015174
push dword [0x10646a4]
lea ecx, [ebp - 0x20]
call fcn.010161a7
mov byte [ebp - 4], 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.010360f6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.01015174
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x18]
call fcn.01015002
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x104badf
xor esi, esi
jmp 0x104bafe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 7
push ebx
push dword [0x10646a8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x10], ebx
je 0x104ba2b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x104ba2b
Function at 0x104bb1a
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x1059436
call fcn.01021eb9
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call fcn.010151da
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x10]
call fcn.010151da
mov byte [ebp - 4], 1
push 0x1012368
lea ecx, [ebp - 0x1c]
call fcn.010161a7
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.010360f6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.01015174
push dword [0x10646a4]
lea ecx, [ebp - 0x20]
call fcn.010161a7
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.010360f6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.01015174
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push ebx
push dword [ebp - 0x10]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
je 0x104bbd4
cmp edi, 2
je 0x104bc28
mov eax, dword [ebp + 8]
push dword [eax]
push edi
push 0x1011110
push 3
jmp 0x104bc1e
push ebx
push ebx
push ebx
push ebx
push dword [0x10646a8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x104bbf3
mov dword [ebp - 0x24], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], ebx
je 0x104bc28
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp edi, ebx
je 0x104bc28
mov eax, dword [ebp + 8]
push dword [eax]
push edi
push 0x1011000
push 1
call fcn.0103ac75
add esp, 0x10
jmp 0x104bc2a
xor edi, edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.01015174
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.01015174
mov eax, edi
call fcn.01021fa5
ret 4
Function at 0x104bc50
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x20019
push esi
mov ebx, ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.0104b38e
test eax, eax
jne 0x104bc8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x104bd51
mov ecx, ebx
call fcn.0103eb4c
lea eax, [ebp - 8]
push eax
push esi
push edi
push 0x10121f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104bd0a
lea eax, [ebp - 0xc]
push eax
add ebx, 8
push ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
jne 0x104bd0a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x104bce1
cmp eax, 2
je 0x104bd22
jmp 0x104bd0a
add dword [ebp - 4], 4
push dword [ebp - 4]
call fcn.01054617
mov ebx, eax
pop ecx
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x104bd0a
lea eax, [ebp - 4]
push eax
push ebx
push edi
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x104bd19
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x104bd25
mov ecx, dword [ebp + 8]
push ebx
call fcn.0103c474
xor esi, esi
inc esi
cmp dword [ebp - 8], edi
je 0x104bd33
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], edi
je 0x104bd41
push dword [ebp - 0x10]
call fcn.01021189
pop ecx
cmp dword [ebp - 0xc], edi
je 0x104bd4f
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x104f820
Capabilities:
Check mutex on windows
Create directory
Get file attributes

Disassembly:
push 0x34
push 0x1060868
call fcn.01022e04
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x44]
call fcn.0104f503
cmp eax, ebx
jne 0x104f95c
push 0x1013580
push ebx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x104f872
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea esi, [ebp - 0x44]
call fcn.0104f3d0
mov eax, edi
jmp 0x104f95c
lea esi, [ebp - 0x44]
call fcn.0104f3d0
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x104f8a1
cmp eax, 0x80
je 0x104f8a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x104f944
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
cmp dword [0x10659f0], ebx
je 0x104f8b7
mov dword [ebp - 0x1c], ebx
jmp 0x104f944
push 0x104
mov esi, 0x10657e8
push esi
call fcn.0104f75d
test eax, eax
je 0x104f8d4
mov dword [ebp - 0x1c], 0x6e
jmp 0x104f944
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x104f8ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x104f944
mov dword [ebp - 0x1c], ebx
mov dword [0x10659f0], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x800
jne 0x104f944
push ebx
push 0x2000000
push 3
push ebx
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x104f944
mov dword [ebp - 0x28], edi
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x28]
push eax
push 0x9c040
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
call fcn.0104f964
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
call fcn.01022e49
ret
Function at 0x104fee7
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x1059c50
call fcn.01021eb9
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.010161a7
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
call fcn.010371a4
mov bl, al
neg bl
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.01015174
test bl, bl
je 0x104ff2c
push 0x52
pop eax
jmp 0x104ffb0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x104ff7e
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.010161a7
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
push eax
call fcn.01036c8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01015174
jmp 0x104ff24
cmp dword [ebp - 0x1c], 1
jne 0x104ffa5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x18]
push eax
push 3
push esi
push 0x1013660
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
call fcn.01021fa5
ret 8
Function at 0x10502ca
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x10137cc
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x10502fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1013798
push 3
mov ebx, eax
call fcn.0103ac75
pop ecx
pop ecx
jmp 0x105036f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1013780
push eax
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x1050367
push 0x1013768
push dword [esi + 0xc]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x1050367
push 0x1013750
push dword [esi + 0xc]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x1050367
push 0x1013740
push dword [esi + 0xc]
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1050367
push 0x1013728
push dword [esi + 0xc]
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x1050367
push 0x1013720
push dword [esi + 0xc]
call edi
mov dword [esi + 0x24], eax
test eax, eax
jne 0x1050381
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x1050381
push 0x1013698
push 3
call fcn.0103ac75
pop ecx
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x1050573
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0
mov eax, 0x1056866
call fcn.01021eb9
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0103eb4c
push 0x20006
mov ecx, esi
call fcn.0104b38e
test eax, eax
jne 0x10505b3
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01015174
mov eax, esi
call fcn.01021fa5
ret 8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], ebx
jne 0x10505cb
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
jmp 0x10505fd
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], ebx
call fcn.01035d59
mov edi, eax
test edi, edi
je 0x10505fd
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push 7
push 0
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov ebx, eax
call fcn.01021189
pop ecx
mov ecx, esi
call fcn.0103eb4c
xor eax, eax
test ebx, ebx
sete al
mov esi, eax
jmp 0x105059d
Function at 0x1050edc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x10568ee
call fcn.01021eb9
mov edi, ecx
mov dword [ebp - 0x18], edi
xor esi, esi
mov dword [ebp - 4], esi
push 0x20019
call fcn.0104b38e
test eax, eax
jne 0x1050f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01015174
xor eax, eax
call fcn.01021fa5
ret 8
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push dword [edi + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, esi
je 0x1050f64
cmp eax, 2
je 0x1050f5f
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01015174
mov eax, esi
jmp 0x1050f1b
xor esi, esi
inc esi
jmp 0x1050f4f
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov dword [ebp - 0x14], eax
call fcn.01054617
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x1050f44
push dword [ebp - 0x14]
push esi
push ebx
call fcn.010219e0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push ebx
push esi
push esi
push dword [ebp + 8]
push dword [eax + 0x18]
call edi
push ebx
test eax, eax
je 0x1050fa6
call fcn.01021189
pop ecx
jmp 0x1050f44
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.0103c474
push ebx
call fcn.01021189
pop ecx
cmp dword [edi + 8], esi
jne 0x1050f5f
jmp 0x1050f44

Function at 0x10523bb
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x10523fc
xor eax, eax
inc eax
jmp 0x105248c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x105245d
push 0x1001678
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01014bdb
test eax, eax
jl 0x105245d
push 0x1013bd8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01014bdb
test eax, eax
jl 0x105245d
lea eax, [ebp - 0x210]
push eax
push SysReAllocString
lea eax, [ebp - 0x20c]
push eax
call fcn.01014c35
test eax, eax
jge 0x1052462
xor eax, eax
inc eax
jmp 0x105248b
mov eax, dword [ebp - 0x210]
inc eax
test edi, edi
je 0x105248b
cmp dword [ebp + 0xc], eax
jb 0x105248b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01014ba1
xor ecx, ecx
test eax, eax
setl cl
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01021557
leave
ret 8
Function at 0x10524a0
Capabilities:
Check mutex on windows
Create directory

Disassembly:
push 0x38
push 0x1060e00
call fcn.01022e04
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], ebx
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [0x1065c40], ebx
je 0x10524db
mov dword [ebp - 0x1c], ebx
jmp 0x10525c8
lea ecx, [ebp - 0x48]
call fcn.0104f503
cmp eax, ebx
jne 0x10525cb
push 0x1013b98
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1052519
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea esi, [ebp - 0x48]
call fcn.0104f3d0
mov eax, edi
jmp 0x10525cb
lea esi, [ebp - 0x48]
call fcn.0104f3d0
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x1052545
cmp eax, 0x80
je 0x1052545
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x10525b3
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
cmp dword [0x1065c40], ebx
je 0x1052558
mov dword [ebp - 0x1c], ebx
jmp 0x10525b3
push 0x104
mov esi, 0x1065a38
push esi
call fcn.010523bb
test eax, eax
je 0x1052575
mov dword [ebp - 0x1c], 0x6e
jmp 0x10525b3
lea eax, [ebp - 0x30]
push eax
call fcn.01052313
cmp eax, ebx
jne 0x1052540
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x10525a1
cmp eax, 0xb7
jne 0x10525aa
mov dword [ebp - 0x1c], ebx
mov dword [0x1065c40], edi
lea eax, [ebp - 0x30]
push eax
call fcn.010522e7
mov dword [ebp - 4], 0xfffffffe
call fcn.010525d3
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
call fcn.01022e49
ret

Function at 0x1052692
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 0xc]
push edi
push 2
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, edi
je 0x10526e5
push dword [ebp + 0xc]
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, edi
je 0x10526d1
xor eax, eax
jmp 0x10526ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
jmp 0x10526ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10