joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1026364
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x21c], 0
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10263f1
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x10263f1
push ebx
push edi
mov edi, 0x1026420
xor ecx, ecx
cmp word [esi], cx
mov ebx, esi
mov dword [ebp - 0x210], ebx
jne 0x1026406
cmp word [ebx], cx
jne 0x1026415
mov dword [ebp - 0x214], 1
cmp word [esi], cx
jne 0x105a627
cmp dword [ebp - 0x214], 0
lea esi, [ebx + 2]
je 0x10263bc
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret 0xc
movzx eax, word [ebx]
cmp ax, 0x20
jne 0x105a613
jmp 0x10263cb
xor eax, eax
mov word [ebx], ax
jmp 0x10263da
cmp ax, 0x2c
je 0x10263cb
inc ebx
inc ebx
cmp word [ebx], cx
jmp 0x10263c3
push esi
push 0x1023be8
call fcn.010256cf
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push ecx
push eax
push esi
call fcn.01024698
test eax, eax
jge 0x105a699
push 0x105a6c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push 0
push edi
mov ebx, eax
call fcn.01026215
test ebx, ebx
je 0x105a68e
push esi
push 0x1030
push 0x20c
push 0x203
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x18
mov ebx, dword [ebp - 0x210]
jmp 0x10263e3
push esi
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push edi
call fcn.01026215
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x21c], 1
jmp 0x10263e3
Function at 0x10292a5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 1
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
push 1
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
push 1
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret

Function at 0x1029300
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
push 0x10293cc
push 0x1029360
push 0x80000002
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x10518f9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret
cmp word [ebp - 0x20c], si
je 0x102934e
push 0x40
lea eax, [ebp - 0x260]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
inc eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x264]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
mov dword [ebp - 0x264], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102934e
push dword [ebp - 0x220]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
jmp 0x102934e
Function at 0x102a39e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
cmp dword [ebp + 8], 1
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x1028ff0
mov esi, 0x80000001
je 0x10563a0
push dword [ebp + 8]
push 0x1029104
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov dword [ebp - 4], eax
test eax, eax
je 0x102a42a
push eax
call dword [sym.imp.SHLWAPI.dll_IStream_Reset]
test eax, eax
jl 0x102a42a
cmp dword [ebp + 8], 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
jne 0x10563df
call fcn.0102a43b
test eax, eax
jl 0x10563d3
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 8], 0
jne 0x1056404
cmp dword [ebx + 0x30], 0
jne 0x105643b
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 8], 0
je 0x10563f8
jmp 0x102a419
push 8
lea eax, [ebx + 0x20]
push eax
push 0xb
push 0x48
push 0x102911c
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
push 8
lea eax, [ebx + 0x28]
push eax
push 0xb
push 0x48
push 0x102909c
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
jmp 0x102a3c2
mov dword [ebx + 0x30], 1
jmp 0x102a406
call fcn.01072802
test eax, eax
jge 0x102a406
mov dword [ebp - 8], 1
jmp 0x102a406
mov dword [ebx + 0x30], 1
jmp 0x102a40f
lea eax, [ebp + 8]
push eax
push 0x20006
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102a419
push 0x1029104
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102a419
cmp dword [ebp + 0x14], 0
je 0x105644b
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.010725a9
and dword [ebx + 0x30], 0
jmp 0x102a423
Function at 0x102a8cb
Capabilities:
Terminate process

Disassembly:
call fcn.01029f63
push 0x5c
push 0x102aa00
call fcn.0102eab4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10b1fec
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1059b5a
xor esi, esi
inc esi
mov eax, dword [0x10b1174]
cmp eax, esi
je 0x1059b79
mov eax, dword [0x10b1174]
test eax, eax
jne 0x102aa55
mov dword [0x10b1174], esi
push 0x102a9fc
push 0x102a9f0
call fcn.0102a8a2
pop ecx
pop ecx
test eax, eax
jne 0x1059c33
mov eax, dword [0x10b1174]
cmp eax, esi
jne 0x102a97e
push 0x102a9ec
push 0x102a9c0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10b1174], 2
cmp dword [ebp - 0x20], ebx
jne 0x102a98b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10b36f8], ebx
jne 0x1059b86
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1059c33
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x102aa28
cmp cx, 0x22
je 0x1059bd0
inc eax
inc eax
jmp 0x102a9a6
cmp cx, bx
jne 0x102aa60
movzx ecx, word [eax]
cmp cx, bx
jne 0x1059ba8
test byte [ebp - 0x40], 1
je 0x102aa6a
movzx ecx, word [ebp - 0x3c]
push ecx
push eax
push ebx
push 0x1000000
call fcn.01022c8d
jmp 0x1059bbc
mov dword [0x10b3a60], esi
jmp 0x102a95a
cmp dword [ebp - 0x1c], ebx
je 0x102aa2d
jmp 0x102a9b2
push 0xa
pop ecx
jmp 0x102aa43
cmp eax, esi
jne 0x1059b69
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x102a921
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x102a90d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x102a95a
push 0x10b36f8
call fcn.0107a1a9
pop ecx
test eax, eax
je 0x102a997
push ebx
push 2
push ebx
call dword [0x10b36f8]
jmp 0x102a997
cmp cx, 0x20
ja 0x102aa39
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x102aa2d
mov dword [0x10b3a5c], eax
cmp dword [0x10b111c], ebx
jne 0x1059c10
push eax
call dword [sym.imp.msvcrt.dll_exit]
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x102a9bc
cmp dword [0x10b3a60], ebx
jne 0x1059c1e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10b3a5c]
jmp 0x1059c3f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0102ce0c
ret
Function at 0x102c851
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push ebx
push 0x10290e4
push 0x1028ff0
push 0x80000001
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x102c8e0
push edi
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_IStream_Read]
test eax, eax
jl 0x102c8d9
cmp dword [ebp - 0x18], 0x14
jne 0x102c8d9
mov edi, dword [ebp - 4]
push dword [ebp - 0x14]
mov ecx, edi
call fcn.01029ad2
test eax, eax
je 0x102c8d9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x102c8d9
cmp dword [ebp - 0xc], ebx
jbe 0x102c8d9
mov eax, dword [ebp - 8]
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push eax
push esi
call dword [ecx + 0x14]
test eax, eax
jne 0x102c8d9
push esi
call dword [fcn.0102c8f4]
mov dword [edi + 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ecx + 0x10], ebx
pop esi
setne al
pop ebx
leave
ret 4

Function at 0x102ca19
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10b10dc], 0
jne 0x102ca6d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102ca7c
push dword [0x10b216c]
mov dword [0x10b10dc], 1
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102ca6d
cmp dword [ebp - 8], 4
jne 0x102ca6d
cmp dword [ebp - 0xc], eax
je 0x1051971
xor eax, eax
cmp dword [0x10b10dc], 1
sete al
leave
ret
mov dword [0x10b10dc], 2
jmp 0x102ca6d

Function at 0x102cbb2
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x102cbfc
push 0x102cc18
push 0x80000001
mov dword [ebp - 8], 2
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x105198e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp word [ebp - 4], ax
jne 0x105198e
leave
ret
push esi
push 0x1065bb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10519b9
push 0x10519c0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10519b2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
jmp 0x102cbf7
Function at 0x102ce25
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov edx, eax
test edx, edx
je 0x102ce56
cmp word [edx], 0
jne 0x1051db4
call fcn.01029565
test eax, eax
je 0x1051df7
call fcn.010293e1
test eax, eax
jne 0x102ce88
call fcn.0102ce94
test eax, eax
jne 0x102ce88
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret
push 5
jmp 0x1051df9
push 2
pop ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push edx
call fcn.0106a39b
test eax, eax
je 0x102ce78
push esi
push 4
pop ecx
mov edi, 0x100ef44
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop esi
je 0x1051de9
push 4
pop ebx
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x102ce78
push 2
pop ebx
jmp 0x102ce78

Function at 0x102cf3d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x102cf88
mov edi, 0x100f4a0
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, 2
je 0x1051e9f
cmp eax, 3
je 0x1051e9f
pop edi
pop esi
pop ebx
leave
ret
call fcn.01013129
test eax, eax
je 0x1051f1d
push 0x220
push 0
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1051f14
push 0x225
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1051f14
push 0x227
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1051f14
push 0x22c
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1051f14
and dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.0102ef5d
test eax, eax
jne 0x1051f21
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc ecx
test eax, eax
je 0x1051f0f
cmp eax, ecx
je 0x1051f0f
cmp eax, 0x10
je 0x1051f0f
cmp eax, 0x11
jne 0x1051f21
mov dword [ebp - 4], ecx
jmp 0x1051f21
mov dword [ebp - 4], 1
jmp 0x1051f21
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102cf88
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 4], 0
je 0x102cf81
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1043a28
push edi
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 2
pop ecx
cmp eax, ecx
je 0x1051f68
cmp eax, 3
jne 0x102cf81
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1043a28
push edi
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x102cf81
Function at 0x102cfa9
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
push ebx
push 0x102d16c
push 0x102d118
mov esi, 0x80000001
push esi
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], 0x14
call edi
test eax, eax
jne 0x102d00b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov dword [ebp - 0x234], eax
push 0xc
pop eax
push ebx
lea ecx, [ebp - 0x230]
push ecx
push eax
push 0x42
mov dword [ebp - 0x230], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x102d09d
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x102d178
mov ebx, 0x102d0b0
push ebx
push esi
mov dword [ebp - 0x224], 0x208
call edi
test eax, eax
je 0x1051f97
test byte [ebp - 0x22c], 1
mov dword [ebp - 0x224], 0x208
jne 0x1051fa9
xor eax, eax
mov word [ebp - 0x220], ax
cmp word [ebp - 0x220], 0
jne 0x1052047
mov eax, dword [ebp - 0x22c]
mov ecx, eax
xor ecx, dword [ebp - 0x234]
test cl, 1
jne 0x105207f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret
cmp word [ebp - 0x220], ax
je 0x102d058
jmp 0x1052047
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x1052138
push 0x102cc18
push esi
call edi
test eax, eax
jne 0x102d06f
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpICW]
push 0x1052114
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d06f
push 0x10520f0
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d06f
push 0x10520cc
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d06f
push 0x10520a8
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d06f
push 0x10520cc
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.010065a0
jmp 0x102d078
or dword [ebp - 0x22c], 1
lea eax, [ebp - 0x220]
push 3
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push eax
push 0xc
push 0x43
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x102d178
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x102d09d
xor eax, 1
or eax, 0x1000
push 2
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x230]
push eax
push 0xc
push 0x43
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x102d09d
Function at 0x102d1a5
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0102d1d8
test eax, eax
jne 0x1052148
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100204d
leave
ret
call fcn.0102423f
test eax, eax
jne 0x102d1c7
push ebx
push esi
push edi
push 0x44
push eax
lea eax, [ebp - 0x260]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [0x10b21ec], 0
stosd dword es:[edi], eax
mov edi, 0x4010000
mov esi, 0x80000000
je 0x10521da
mov al, byte [0x10b21f0]
cmp al, 4
jae 0x1052196
test al, al
jne 0x10521da
mov eax, dword [0x10b21d8]
mov ecx, dword [0x10b21dc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10521da
mov eax, dword [0x10b21e0]
mov ebx, dword [0x10b21e4]
mov ecx, eax
mov edx, ebx
and ecx, edi
and edx, esi
cmp ecx, eax
jne 0x10521da
cmp edx, ebx
jne 0x10521da
push 0x1052308
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x105225f
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x105229f
push 0x1052340
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x105229f
push 0x1052328
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0101237f
mov ebx, eax
test ebx, ebx
jl 0x105229f
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x105226f
jmp 0x1052276
lea eax, [ebp - 0x21c]
push eax
call fcn.01095375
test eax, eax
je 0x105227a
call fcn.0101d802
mov ebx, eax
test ebx, ebx
jl 0x105229f
push 0xffffffffffffffff
push dword [ebp - 0x21c]
push 0
call fcn.0106ac0b
push dword [ebp - 0x218]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x21c]
call ebx
cmp dword [0x10b21ec], 0
je 0x10522f9
mov al, byte [0x10b21f0]
cmp al, 4
jae 0x10522b5
test al, al
jne 0x10522f9
mov eax, dword [0x10b21d8]
mov ecx, dword [0x10b21dc]
and eax, edi
and ecx, esi
or eax, ecx
je 0x10522f9
mov eax, dword [0x10b21e0]
mov ecx, eax
and ecx, edi
mov edi, dword [0x10b21e4]
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x10522f9
cmp edx, edi
jne 0x10522f9
push 0x1052318
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
pop edi
pop esi
pop ebx
jmp 0x102d1c7
Function at 0x102d1d8
Capabilities:
Persist via run registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
mov dword [ebp - 4], esi
call fcn.0102ef5d
test eax, eax
jl 0x102d271
cmp dword [ebp - 8], esi
jl 0x102d271
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp - 8], ebx
jg 0x102d270
push edi
push 0x40000048
call dword [sym.imp.SHELL32.dll_SHRestricted]
push ebx
push 0x102d278
mov esi, 0x80000002
push esi
mov edi, eax
call fcn.0102d2e5
test eax, eax
jne 0x105a7dd
test edi, edi
jne 0x102d26f
lea eax, [ebp - 0xc]
push eax
push 0x20019
push edi
push 0x1023ad8
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102d26f
xor esi, esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.SHLWAPI.dll_SHQueryInfoKeyW]
test eax, eax
jne 0x102d266
cmp dword [ebp - 0x10], esi
ja 0x105a7e5
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret
mov dword [ebp - 4], ebx
jmp 0x102d26f
mov dword [ebp - 4], ebx
jmp 0x102d266

Function at 0x102d31f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
and dword [ebp - 0x41c], 0
push esi
push edi
push 4
pop edi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push 0x102d38c
mov ebx, 0x100f4a0
push ebx
mov esi, 0x80000001
push esi
mov dword [ebp - 0x428], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x41c], edi
jb 0x1052897
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret
cmp dword [ebp - 0x41c], 0
jne 0x105291a
push 0x1052a1c
push 0x1017800
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x424], 0x104
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x1052a08
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x105291a
cmp word [ebp - 0x20c], ax
je 0x105291a
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 0x10529e8
push ebx
push esi
mov dword [ebp - 0x418], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
call fcn.010859a5
call fcn.01080d1f
call fcn.0108827f
call fcn.010836ad
call fcn.01083648
push 0x102909c
push 0x1028ff0
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0x18
push 0x10529c8
push 0x10529ac
push 0x80000002
mov dword [ebp - 0x42c], edi
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x105298a
cmp dword [ebp - 0x420], eax
jne 0x102d37a
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 0x102d38c
push ebx
push esi
mov dword [ebp - 0x418], edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x102d37a
Function at 0x102d62e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x102d878
push 0x80000002
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x102d7a4
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102d854
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x102d696
cmp dword [ebp - 8], esi
jne 0x102d696
cmp dword [ebp - 4], esi
jne 0x102d696
mov eax, dword [ebp - 0xc]
cmp eax, 0x3e8
jb 0x102d696
mov dword [ebx + 0x18], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102d830
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x102d6ca
cmp dword [ebp - 8], esi
jne 0x102d6ca
cmp dword [ebp - 4], esi
jne 0x102d6ca
mov eax, dword [ebp - 0xc]
cmp eax, 0x64
jb 0x102d6ca
mov dword [ebx + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102d818
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x102d6fe
cmp dword [ebp - 8], esi
jne 0x102d6fe
cmp dword [ebp - 4], esi
jne 0x102d6fe
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebx + 0xc]
jbe 0x102d6fe
mov dword [ebx + 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102d7ec
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x102d732
cmp dword [ebp - 8], esi
jne 0x102d732
cmp dword [ebp - 4], esi
jne 0x102d732
mov eax, dword [ebp - 0xc]
cmp eax, 0x32
jae 0x102d732
mov dword [ebx + 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102d7c4
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x102d765
cmp dword [ebp - 8], esi
jne 0x102d765
cmp dword [ebp - 4], esi
jne 0x102d765
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x102d765
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102d7a8
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x102d799
cmp dword [ebp - 8], esi
jne 0x102d799
cmp dword [ebp - 4], esi
jne 0x102d799
mov eax, dword [ebp - 0xc]
cmp eax, 0x32
jbe 0x102d799
mov dword [ebx + 0x30], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret