joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10319f2
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10446c8
call fcn.01031e84
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1049488
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10317a0
cmp eax, esi
jne 0x1031793
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10317a3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x103177a
xor esi, esi
inc esi
mov eax, dword [0x1049484]
cmp eax, esi
jne 0x10317b6
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10317e5
mov eax, dword [0x1049484]
test eax, eax
jne 0x10317df
mov dword [0x1049484], esi
push 0x100134c
push 0x1001340
call fcn.010316df
pop ecx
pop ecx
test eax, eax
je 0x10317e5
jmp 0x103190d
mov dword [0x1048780], esi
mov eax, dword [0x1049484]
cmp eax, esi
jne 0x1031809
push 0x100133c
push 0x10012e8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1049484], 2
test ebx, ebx
jne 0x1031815
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1049490], 0
je 0x1031839
push 0x1049490
call fcn.01031dfb
pop ecx
test eax, eax
je 0x1031839
push 0
push 2
push 0
call dword [0x1049490]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1031895
test al, al
je 0x1031853
cmp dword [ebp - 0x1c], 0
jne 0x1031895
mov al, byte [esi]
test al, al
je 0x1031863
cmp al, 0x20
ja 0x1031863
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1031853
test byte [ebp - 0x3c], 1
je 0x103186f
movzx eax, word [ebp - 0x38]
jmp 0x1031872
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x104877c], eax
cmp dword [0x1048770], 0
jne 0x10318e9
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10318a4
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10318b7
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1031840
cmp dword [0x1048780], 0
jne 0x10318f8
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x104877c]
jmp 0x1031919
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01031ec9
ret
call fcn.01032074
jmp 0x1031740

Function at 0x1031d70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1031d83
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1031d7f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x1031db0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1031def
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1031de5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1031df1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1031dd5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10326f3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1032715
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1032715
test al, 0x10
jne 0x1032715
xor eax, eax
inc eax
jmp 0x1032717
xor eax, eax
pop ebp
ret 4

Function at 0x1032720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x1032759
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1032759
push dword [ebp + 8]
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1032749
push 2
pop eax
jmp 0x103275e
test ax, 0x800
je 0x1032755
mov dword [esi], 1
xor eax, eax
jmp 0x103275e
mov eax, 0xa0
pop esi
pop ebp
ret 8
Function at 0x1032768
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x198]
xor ebx, ebx
push eax
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x1a4], 0x80
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x198], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10327bc
xor edx, edx
jmp 0x10328e1
push esi
mov esi, dword [ebp - 0x194]
xor eax, eax
shld eax, esi, 0x10
mov eax, dword [ebp - 0x190]
shl esi, 0x10
or esi, eax
cmp dword [ebp - 0x188], 2
lea eax, [ebp - 0x19c]
push eax
push 1
mov dword [ebp - 0x1ac], ebx
push ebx
jne 0x1032866
push 0x1006868
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10328d8
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push 0x100683c
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10328cc
cmp dword [ebp - 0x1a0], 1
jne 0x10328cc
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov ecx, 0x10000
mov dword [ebp - 0x1a4], eax
mul ecx
add dword [ebp - 0x1ac], eax
adc esi, edx
jmp 0x10328cc
push 0x10067e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10328d8
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push 0x10067c8
push dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10328cc
cmp dword [ebp - 0x1a0], 1
jne 0x10328cc
lea eax, [ebp - 0x84]
push eax
call fcn.01032567
mov dword [ebp - 0x1ac], eax
mov esi, edx
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1ac]
mov edx, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret

Function at 0x10329da
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push 0x10068e0
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1032a23
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push 0x10068c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x1032fa9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x10069f8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1033000
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x10069c8
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1033010
push esi
push 0x1006980
push 2
call fcn.01036b8b
add esp, 0xc
pop esi
leave
ret
Function at 0x1033666
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1033759
push esi
lea eax, [ebp - 0x210]
push eax
push 0x2001f
xor esi, esi
push esi
push ebx
push edi
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1033758
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
mov ebx, 0x103
jmp 0x1033736
cmp eax, esi
jne 0x103373a
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.01033666
test eax, eax
jne 0x103373a
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
cmp eax, ebx
jne 0x10336f7
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 8

Function at 0x103376e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
jne 0x1033784
push 6
pop eax
jmp 0x10337ca
cmp dword [ebp + 8], esi
jne 0x10337b2
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10337b2
cmp dword [ebp + 0x10], esi
jne 0x10337ab
cmp dword [ebp - 4], 2
jbe 0x10337b2
mov eax, 0xb7
jmp 0x10337ca
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
leave
ret 0x1c
Function at 0x103386a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1006af8
mov edi, 0x80000002
push edi
mov dword [ebp - 0x214], esi
call ebx
test eax, eax
jne 0x10339f0
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x1006a90
push edi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10339e4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
jmp 0x10339be
inc dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], esi
call ebx
test eax, eax
jne 0x10339a6
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push 0x1002f14
push dword [ebp - 0x21c]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103399a
cmp dword [ebp - 0x228], 4
jne 0x103399a
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x214]
mov dword [ebp - 0x220], 0x105
call edi
test eax, eax
je 0x1033901
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret

Function at 0x1033e65
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
test eax, eax
je 0x1033ec3
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.01033b39
test eax, eax
jl 0x1033ec3
push 0x5c
lea eax, [ebp - 0x108]
push eax
call fcn.010324f5
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1033ec1
test al, 0x10
je 0x1033ec1
inc esi
jmp 0x1033ec3
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 4
Function at 0x1033ed9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
test eax, eax
je 0x1033f37
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
test eax, eax
jl 0x1033f37
push 0x5c
lea eax, [ebp - 0x20c]
push eax
call fcn.0103252b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1033f35
test al, 0x10
je 0x1033f35
inc esi
jmp 0x1033f37
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 4

Function at 0x1033f4d
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1033f5b
sub eax, edx
push esi
push edi
sar eax, 1
lea edi, [eax + 0x14]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0xc], edi
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
test esi, esi
pop ecx
je 0x1034055
push ebx
push dword [ebp + 8]
push edi
push esi
call fcn.01028a67
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x1006cbc
push esi
call edi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x103404d
add ebx, 4
and dword [ebp - 4], 0
push 0x100623c
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x1034044
and word [eax], 0
push esi
lea ebx, [eax + 2]
call fcn.01033ed9
test eax, eax
jne 0x103401a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1033ff4
push 0x57
pop eax
test eax, eax
jle 0x1034000
and eax, 0xffff
or eax, 0x80070000
push esi
mov dword [ebp - 8], eax
call fcn.01033ed9
test eax, eax
je 0x1034031
push 0
push esi
push 5
push 8
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp + 8]
push dword [ebp - 0xc]
push esi
call fcn.01028a67
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x1033fbe
jmp 0x1034044
push dword [ebp - 8]
push esi
push 0x1006c80
push 2
call fcn.01036b8b
add esp, 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop ebx
push dword [ebp + 8]
call fcn.01033ed9
pop edi
pop esi
leave
ret 4
Function at 0x1034068
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x320]
push eax
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10341df
cmp dword [ebp - 0x310], 2
jne 0x10341dd
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp + 8]
je 0x10340c8
jbe 0x10341dd
xor esi, esi
inc esi
jmp 0x10341dd
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp + 0xc]
jne 0x10340ba
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
inc esi
cmp edi, ebx
jbe 0x10341dc
lea eax, [ebp - 0x32c]
push eax
push esi
push ebx
push 0x1006868
push 0x80000002
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034179
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x324]
push eax
push ebx
push 0x100683c
push dword [ebp - 0x32c]
mov dword [ebp - 0x324], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034161
cmp dword [ebp - 0x324], esi
jne 0x1034161
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
cmp eax, edi
sbb esi, esi
pop ecx
mov dword [ebp - 0x328], eax
inc esi
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x328], edi
ja 0x10341dc
cmp esi, ebx
je 0x10341dc
cmp dword [ebp + 0x14], ebx
je 0x10341dc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10341dc
push 0x1006cc4
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jl 0x10341dc
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x324], ebx
call fcn.01032aa3
test eax, eax
jl 0x10341dc
movzx eax, word [ebp - 0x324]
cmp eax, dword [ebp + 0x14]
sbb esi, esi
inc esi
pop edi
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 0x10
Function at 0x1034b27
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x1034b43
mov eax, 0x80004003
jmp 0x1034d09
push 0x14
pop eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 8], eax
jne 0x1034b6c
mov eax, 0x8007000e
jmp 0x1034d09
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x1006f80
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034bf0
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x1034be7
mov edi, 0x104
push edi
push ebx
call fcn.01033bb5
test eax, eax
je 0x1034be0
push 0x1006f68
push edi
push ebx
call fcn.01028adc
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034bbb
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x1006f48
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 4]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1002ad8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1034cad
push dword [0x1048ab8]
mov ebx, 0x1006c78
push ebx
push 0x14
push dword [ebp - 8]
call fcn.01028b64
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1034c56
cmp dword [0x1048ab8], 0x3e8
jge 0x1034c69
inc dword [0x1048ab8]
push dword [0x1048ab8]
push ebx
push 0x14
push dword [ebp - 8]
call fcn.01028b64
add esp, 0x10
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call edi
test eax, eax
je 0x1034c33
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034c6f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 2
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
jne 0x1034ca0
inc dword [0x1048ab8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x1034cd0
jle 0x1034cbb
and edi, 0xffff
or edi, 0x80070000
push edi
push dword [ebp + 8]
push 0x1006f08
push 2
call fcn.01036b8b
add esp, 0x10
jmp 0x1034cfc
push dword [ebp + 8]
push 0x1006ecc
push 4
call fcn.01036b8b
add esp, 0xc
cmp dword [ebp + 0x10], esi
je 0x1034cf7
push esi
push dword [ebp + 8]
mov ecx, 0x1048ac0
push 8
call fcn.01034266
mov edi, 0xd2af9
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1034d13
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x1034e04
cmp dword [ebp + 0xc], ebx
je 0x1034e04
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov edi, 0x1006f80
push edi
push 0x80000002
call esi
cmp eax, ebx
je 0x1034d66
lea eax, [ebp - 4]
push eax
push 3
push ebx
push edi
push 0x80000001
call esi
mov esi, eax
cmp esi, ebx
jne 0x1034dc3
push dword [ebp + 0xc]
push 0x100704c
push dword [ebp - 4]
call fcn.01033408
mov edi, eax
cmp edi, ebx
je 0x1034db1
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1034d82
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x1034db6
mov esi, 0x80004005
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x1034de6
jle 0x1034dd1
and esi, 0xffff
or esi, 0x80070000
push esi
push dword [ebp + 8]
push 0x1007008
push 2
call fcn.01036b8b
add esp, 0x10
jmp 0x1034dfe
push 0x1006fe4
push 4
call fcn.01036b51
or dword [0x1048bc8], 1
mov esi, 0xd2af9
pop edi
mov eax, esi
pop esi
jmp 0x1034e09
mov eax, 0x80004003
pop ebx
leave
ret 8
Function at 0x1035165
Capabilities:
Create directory
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
push eax
xor ebx, ebx
push 0x20007
push ebx
push 0x10031c0
push 0x80000002
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
inc esi
test eax, eax
mov edi, 0x104
jne 0x103523c
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push 0x1007268
push dword [ebp - 0x110]
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x118], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1035230
cmp dword [ebp - 0x118], 2
je 0x1035208
cmp dword [ebp - 0x118], esi
jne 0x1035230
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1035214
sub eax, edx
jne 0x1035230
push 0x1003198
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
push eax
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x103529c
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x103526d
mov dword [ebp - 0x11c], esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x1035294
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
je 0x1035294
push dword [ebp - 0x114]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x11c], ebx
jne 0x10352c0
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x103530b
push 0x100724c
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.01033b73
lea esi, [ebp - 0x108]
mov eax, esi
push eax
call fcn.01033e65
test eax, eax
jne 0x103530b
cmp byte [ebp - 0x108], bl
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x1035301
cmp byte [esi], 0x5c
jne 0x10352f4
push ebx
lea eax, [ebp - 0x108]
push eax
mov byte [esi], bl
call edi
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], bl
jne 0x10352e0
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
je 0x103531b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret