joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f124
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x102c22c]
push ebx
push esi
xor ebx, ebx
cmp dword [0x102dc4c], ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], ebx
jne 0x101f15e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102dc4c], eax
cmp dword [ebp + 8], ebx
mov esi, 0x80
je 0x101f177
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x101f181
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push esi
push 4
push ebx
mov ebx, 0xc0000000
jmp 0x101f1d7
inc dword [ebp - 0x214]
cmp dword [ebp - 0x214], 9
ja 0x101f354
push dword [ebp - 0x214]
lea eax, [ebp - 0x108]
push dword [ebp - 0x210]
push 0x1008468
push eax
call sub.ntdll.dll_sprintf
add esp, 0x10
push 0
push esi
push 4
push 0
push 1
lea eax, [ebp - 0x108]
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [0x102dc48], eax
je 0x101f19d
xor esi, esi
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x108]
mov byte [ecx + 0x106f780], dl
inc ecx
test dl, dl
jne 0x101f1f1
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x101f259
lea eax, [ebp - 0x108]
push eax
call fcn.010150e8
cmp eax, esi
je 0x101f259
push eax
lea eax, [ebp - 0x20c]
push 0x10070bc
push eax
call sub.ntdll.dll_sprintf
add esp, 0xc
push esi
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push dword [0x102dc48]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x14
pop ecx
mov eax, 0x3d3d3d3d
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
push esi
mov byte [ebp - 0xb8], 0
call fcn.01015c21
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x21a]
push eax
movzx eax, word [ebp - 0x21c]
push eax
movzx eax, word [ebp - 0x21e]
push eax
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push eax
push 0x100843c
push esi
call fcn.01015c06
add esp, 0x24
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x101f34d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
call fcn.0101d5df
movzx eax, word [ebp - 0x218]
mov edx, dword [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x214]
mov ecx, eax
shrd edx, ecx, 0x10
shr ecx, 0x10
movzx ecx, dx
push ecx
movzx ecx, ax
shr eax, 0x10
push ecx
movzx eax, ax
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1008420
push esi
mov dword [ebp - 0x210], edx
call fcn.01015c06
add esp, 0x1c
mov eax, dword [0x102dc48]
jmp 0x101f35d
and dword [0x102dc48], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 8
Function at 0x101f39d
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0x102d940
cmp eax, esi
push edi
je 0x101f3c1
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x101f3b7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101f3c6
sub eax, edx
lea edi, [eax + 0x102d940]
mov byte [edi], 0x5c
inc edi
and dword [ebp + 8], 0
mov ebx, 0x102cec8
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 8], eax
mov word [edi], 0x2a
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x101f472
test byte [0x102cec8], 0x10
jne 0x101f44f
mov eax, 0x102cef4
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x101f40f
push 0x1008474
push edi
call sub.ntdll.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x101f43f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x101f44f
push dword [ebp + 0xc]
push esi
call fcn.0101d565
test eax, eax
je 0x101f44f
inc dword [ebp + 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x101f3fd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 8]
cmp dword [ebp + 8], eax
jne 0x101f3e2
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101f5cb
Capabilities:
Delete directory
Get common file path
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x102c22c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x104
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x10019ec
push eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x318], esi
call fcn.01015121
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0101f39d
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x108]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x108]
push eax
call edi
test eax, eax
jne 0x101f64f
push 4
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push dword [ebp - 0x318]
push dword [ebp - 0x314]
call fcn.0101f39d
push ebx
push dword [ebp - 0x314]
call esi
push dword [ebp - 0x314]
call edi
test eax, eax
jne 0x101f684
push 4
push eax
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp dword [ebp + 0x10], 0
jne 0x101f6c8
mov esi, 0x104
push esi
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x101f6c8
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1006f28
lea eax, [ebp - 0x310]
push eax
call fcn.01015121
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.01017837
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0xc
Function at 0x101f6dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x102c22c]
and dword [ebp - 0x218], 0
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov esi, 0x209
je 0x101f778
cmp byte [edi], 0
je 0x101f778
push edi
mov dword [ebp - 0x218], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x101f751
test al, 0x10
je 0x101f751
push esi
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
mov byte [ebp - 0x210], 0
call fcn.01015121
jmp 0x101f75f
push edi
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100b4e5
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0101f124
test eax, eax
mov dword [ebp - 0x214], eax
jne 0x101f7c2
push esi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x21c]
mov byte [ebp - 0x210], 0
call fcn.01015121
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0101f124
test eax, eax
mov dword [ebp - 0x214], eax
je 0x101f7d7
cmp dword [ebp - 0x218], 0
je 0x101f7c2
push edi
push 0x10084a0
call fcn.01015c5a
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x1c]
push dword [ebp - 0x220]
call fcn.0100d9cc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0x18
Function at 0x101fa55
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102c22c]
push ebx
push esi
push 2
xor esi, esi
pop ebx
cmp dword [0x103e110], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], esi
jne 0x101fb94
push edi
lea eax, [ebp - 0x40c]
push eax
xor edi, edi
inc edi
push edi
push esi
push 0x1008590
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101fb93
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push 0x1008574
push dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101fb87
cmp dword [ebp - 0x418], edi
jne 0x101fb87
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1008560
lea eax, [ebp - 0x404]
push eax
call esi
test eax, eax
jne 0x101fb0b
mov dword [ebp - 0x408], ebx
jmp 0x101fb87
push 0x100854c
lea eax, [ebp - 0x404]
push eax
call esi
test eax, eax
jne 0x101fb87
push 0x1008538
mov dword [ebp - 0x408], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x101fb87
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1008524
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x101fb80
push 0x1008510
push edi
call esi
mov esi, eax
test esi, esi
je 0x101fb80
lea eax, [ebp - 0x414]
push eax
push 0x65
push 0
call ebx
test eax, eax
jne 0x101fb80
mov eax, dword [ebp - 0x414]
test byte [eax + 0x10], 0x10
je 0x101fb7d
mov dword [ebp - 0x408], 3
push eax
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x408]
pop esi
pop ebx
call fcn.0101439a
leave
ret

Function at 0x101fca9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102c22c]
push esi
mov esi, dword [ebp + 8]
or dword [esi], 0xffffffff
push edi
mov dword [ebp - 4], eax
call fcn.0101fa55
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [esi + 4], eax
push 0x106d180
lea eax, [ebp - 0x214]
push eax
call edi
lea eax, [ebp - 0x214]
push eax
lea eax, [esi + 0x10]
push eax
call edi
push 0x10020dc
lea eax, [esi + 0x218]
push eax
call edi
cmp word [ebp - 0x214], 0
mov dword [esi + 8], 0x10
mov dword [esi + 0xc], 8
je 0x101fd53
cmp word [ebp - 0x212], 0x3a
jne 0x101fd53
cmp word [ebp - 0x210], 0x5c
jne 0x101fd53
push 4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x101fd53
mov eax, dword [esi + 8]
or dword [esi + 0xc], 0x19
mov dword [esi + 8], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101439a
leave
ret 4
Function at 0x101fd66
Capabilities:
Check os version
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac0
mov eax, dword [0x102c22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [0x106d398], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x103e100
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xabc], 1
mov dword [0x106d394], eax
mov dword [0x103e100], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x100863c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [0x102de60], eax
je 0x101fdf1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100862c
push eax
call esi
push 0x1008620
push dword [0x102de60]
mov dword [0x106d390], eax
call esi
mov dword [0x106d38c], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1008604
mov dword [0x106d388], 0x10085f0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x101fec7
push edi
lea eax, [ebp - 0xac0]
push eax
mov edi, 0x106d180
push edi
push esi
push ebx
push dword [0x106d388]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp eax, esi
ja 0x101fec6
cmp eax, ebx
je 0x101fec6
mov eax, dword [0x106d390]
cmp eax, ebx
je 0x101fe67
push ebx
lea ecx, [ebp - 0xabc]
push ecx
push 4
push edi
push 0x102c2b0
call eax
jmp 0x101fe69
xor eax, eax
cmp eax, ebx
mov dword [ebp - 0xab8], eax
je 0x101fec6
mov ecx, dword [0x103e104]
cmp ecx, 5
jb 0x101feb2
jne 0x101fe90
cmp dword [0x103e108], ebx
jne 0x101fe90
mov eax, dword [eax + 0xc4c]
jmp 0x101fe96
mov eax, dword [eax + 0xc5c]
cmp eax, ebx
je 0x101feb2
push ebx
push 0x101fbed
push 0x8a8
lea ecx, [ebp - 0xab4]
push ecx
push eax
call fcn.01016525
cmp dword [ebp - 0xab8], ebx
je 0x101fec6
lea eax, [ebp - 0xab8]
push eax
call fcn.0101fc8f
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor eax, eax
pop ebx
call fcn.0101439a
leave
ret 8
Function at 0x10200c1
Capabilities:
Enumerate services

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push 5
push esi
push esi
mov dword [ebp - 4], esi
mov dword [eax], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x102015a
push ebx
push edi
xor ebx, ebx
mov edi, 0x1000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push ebx
call sub.msvcrt.dll_free
add edi, dword [ebp - 0xc]
push edi
call sub.msvcrt.dll_malloc
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x1020145
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push 1
push 0x30
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
test eax, eax
jne 0x1020166
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1020162
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jb 0x10200f4
push ebx
call sub.msvcrt.dll_free
pop ecx
mov dword [ebp - 4], esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
cmp eax, esi
jne 0x1020145
cmp dword [ebp - 4], esi
je 0x1020145
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x102014f
Function at 0x1021443
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x102c22c]
and dword [ebp - 0x130], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x134], eax
je 0x10215ea
push edi
push 0x4a
pop ecx
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
push eax
push ebx
push esi
mov dword [ebp - 0x12c], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
jne 0x10214c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x134]
push 0x1008cf8
call fcn.01015c5a
add esp, 0xc
jmp 0x10215e9
cmp dword [0x102c918], 0
jne 0x10214d1
or byte [ebp - 0x126], 2
lea eax, [ebp - 0x12c]
push eax
push ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
test eax, eax
jne 0x10214fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100770c
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x10215e9
xor eax, eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x138], 0
push 0x10
lea eax, [ebp - 0x144]
push eax
xor edi, edi
push ebx
inc edi
push esi
mov dword [ebp - 0x144], 8
mov dword [ebp - 0x140], 5
mov dword [ebp - 0x13c], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsA]
test eax, eax
jne 0x1021554
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008cc0
call fcn.01015c5a
pop ecx
pop ecx
push 0x20006
push 2
push 0
push edi
push ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
je 0x102158c
push 0x1007678
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x1007668
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push esi
push 5
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
jne 0x10215c8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x1008c8c
call fcn.01015c5a
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiRemoveDevice]
test eax, eax
jne 0x10215c8
call edi
push eax
push 0x1008c60
jmp 0x10214f0
mov eax, dword [0x106e508]
test eax, eax
je 0x10215df
push 0
push dword [ebp - 0x134]
push eax
call fcn.01016588
mov dword [ebp - 0x130], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x130]
pop esi
pop ebx
call fcn.0101439a
leave
ret 0xc
Function at 0x102219b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102c22c]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push edi
push 0x104
lea edx, [ebp - 0x20c]
push edx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
push edi
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
test eax, eax
lea eax, [ebp - 0x20c]
je 0x102220a
push edi
push edi
push eax
call sub.msvcrt.dll_wcstoul
push eax
push 0x1008ef8
push esi
push 0x1008ee4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x24
jmp 0x1022226
push dword [ebp + 0x18]
push 0x1008ef8
push esi
push 0x1008ee4
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0x14

Function at 0x1022260
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call sub.ntdll.dll__chkstk
mov eax, dword [0x102c22c]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x100c], eax
xor eax, eax
mov ecx, 0x200
lea edi, [ebp - 0x804]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1010]
push eax
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x1004]
push eax
push ebx
push dword [ebp - 0x1008]
xor edi, edi
push edx
push edi
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
cmp eax, edi
mov dword [ebp - 0x1008], eax
jne 0x102230d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10222f4
push dword [ebp - 0x1010]
push ebx
push 0x1008f30
call fcn.01015c5a
add esp, 0xc
jmp 0x1022377
push 0x400
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0x14]
push edi
call fcn.0100ce22
test eax, eax
je 0x1022377
lea eax, [ebp - 0x1004]
push eax
push 0x1008ef8
push ebx
push 0x1008f1c
lea eax, [ebp - 0x804]
push esi
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push edi
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x100c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x102236d
push ebx
push 0x1008efc
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1022377
mov dword [ebp - 0x1008], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1008]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0x14
Function at 0x10223f6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1022454
cmp dword [ebp + 0xc], 0x104
jb 0x1022454
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x1008f64
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1022454
push edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push esi
push esi
push 0x1008f5c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1022454
inc esi
mov eax, esi
pop esi
leave
ret 8

Function at 0x1022460
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102c22c]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
je 0x10224f8
mov eax, 0x104
cmp dword [ebp + 0xc], eax
jb 0x10224f8
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x10224a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008fd8
jmp 0x10224ec
lea eax, [ebp - 0x20c]
push eax
push 0x1008fc8
lea eax, [ebp - 0x414]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x10
push esi
push edi
push 0x1008fc0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10224f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008f9c
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x10224f8
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0101439a
leave
ret 8

Function at 0x102250d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102c22c]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
je 0x10225a5
mov eax, 0x104
cmp dword [ebp + 0xc], eax
jb 0x10225a5
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1022555
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008fd8
jmp 0x1022599
lea eax, [ebp - 0x108]
push eax
push 0x1009000
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.ntdll.dll__snprintf
add esp, 0x10
push esi
push edi
push 0x1008ffc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x10225a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008f9c
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x10225a5
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0101439a
leave
ret 8
Function at 0x10225ba
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102c22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
xor eax, eax
cmp esi, 0x400
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x418], eax
jb 0x1022702
cmp edi, eax
je 0x1022702
mov dword [edi], eax
cmp byte [0x106f780], al
je 0x1022702
push ebx
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0xffffffffffffffff
mov ebx, 0x106f780
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x102264a
and dword [ebp - 0x418], eax
push ebx
push 0x1009028
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1022701
cmp dword [0x102c8d0], 0
jne 0x10226c2
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01022460
test eax, eax
je 0x1022701
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
jne 0x10226a3
lea eax, [ebp - 0x414]
push eax
push 0x1009008
call fcn.01015c5a
add esp, 0xc
jmp 0x1022701
lea ebx, [esi - 1]
mov esi, 0x1007188
push esi
push ebx
push dword [ebp - 0x420]
call sub.ntdll.dll__snwprintf
mov dword [edi], eax
lea eax, [ebp - 0x20c]
jmp 0x10226e6
lea eax, [ebp - 0x414]
push eax
lea ebx, [esi - 1]
mov esi, 0x1007188
push esi
push ebx
push dword [ebp - 0x420]
call sub.ntdll.dll__snwprintf
mov dword [edi], eax
lea eax, [ebp - 0x414]
push eax
push esi
push ebx
push dword [ebp - 0x41c]
call sub.ntdll.dll__snwprintf
add esp, 0x20
mov dword [ebp - 0x418], 1
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
call fcn.0101439a
leave
ret 0x10