joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012256
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x10122ce
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10054e0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10122ce
push esi
push edi
push 0x10054cc
push dword [ebp - 4]
call fcn.01017b2a
mov esi, eax
cmp esi, ebx
je 0x10122c4
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x10124aa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102a0ec]
and dword [ebp - 0x210], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
mov edi, 0x20019
push edi
push 0
xor ebx, ebx
push 0x10056a0
inc ebx
push 0x80000001
mov dword [ebp - 0x214], ebx
call esi
test eax, eax
je 0x10125f3
lea eax, [ebp - 0x210]
push eax
push edi
push 0
push 0x1005618
mov ebx, 0x80000002
push ebx
call esi
test eax, eax
jne 0x101258d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101256c
cmp dword [ebp - 0x214], 1
jne 0x101256c
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x101256c
mov dword [ebp - 0x21c], 1
jmp 0x1012573
and dword [ebp - 0x21c], 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x21c], 0
je 0x101258d
xor eax, eax
inc eax
jmp 0x1012605
lea eax, [ebp - 0x210]
push eax
push edi
push 0
push 0x1005598
push ebx
call esi
test eax, eax
jne 0x1012603
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10125f1
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x214], ebx
jne 0x10125f1
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
jne 0x10125f3
xor ebx, ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1012605
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret
Function at 0x101290d
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x102a0ec]
push esi
xor esi, esi
push 0x104
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0xa44], esi
mov dword [ebp - 0xa40], esi
mov dword [ebp - 0xa4c], esi
call fcn.010190e9
test eax, eax
jne 0x1012955
mov eax, 0x80004005
jmp 0x1012af7
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1005880
push 0x105
lea eax, [ebp - 0xa38]
push eax
call fcn.0100c535
test eax, eax
jl 0x1012af1
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xa40]
push eax
mov ebx, 0x20019
push ebx
push esi
lea eax, [ebp - 0xa38]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x1012aef
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0xa3c]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x100585c
push dword [ebp - 0xa40]
mov dword [ebp - 0xa3c], 1
mov dword [ebp - 0xa48], 0x208
call esi
test eax, eax
jne 0x1012ae3
cmp dword [ebp - 0xa3c], 1
jne 0x1012ae3
lea eax, [ebp - 0xa4c]
push eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x82c]
push eax
push dword [ebp - 0xa40]
call edi
test eax, eax
jne 0x1012ae3
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xa3c]
push eax
push ebx
push 0x1005848
push dword [ebp - 0xa4c]
mov dword [ebp - 0xa48], 0x20a
call esi
test eax, eax
jne 0x1012ad7
cmp dword [ebp - 0xa3c], 1
jne 0x1012ad7
push 0x1005830
mov edi, 0x105
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x1012ad7
push ebx
push ebx
push 0x1005488
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ab13
mov esi, 0xd2af9
cmp eax, esi
jne 0x1012aa1
mov dword [ebp - 0xa44], esi
push edi
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1012ad7
push ebx
push ebx
push 0x1005550
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ab13
cmp eax, esi
jne 0x1012ad7
mov dword [ebp - 0xa44], esi
push dword [ebp - 0xa4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xa40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [ebp - 0xa44]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101672d
leave
ret
Function at 0x1012bef
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set current directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1678
call fcn.01016a60
mov eax, dword [0x102a0ec]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1678], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x1674], eax
lea eax, [ebp - 0x414]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1012dc8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1012dbb
lea eax, [ebp - 0x1664]
push eax
push 0x1005924
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1670], eax
je 0x1012dbb
push ebx
lea eax, [ebp - 0x1668]
push eax
push 0x100c454
push 1
xor ebx, ebx
push ebx
push 0x100c464
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1012dae
mov eax, dword [ebp - 0x1668]
mov ecx, dword [eax]
lea edx, [ebp - 0x166c]
push edx
push 0x100c444
push eax
call dword [ecx]
test eax, eax
jl 0x1012da2
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov eax, dword [ebp - 0x166c]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x1638]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x1012d7b
mov eax, dword [ebp - 0x1668]
mov ecx, dword [eax]
push ebx
push ebx
push edi
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1012d7b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1678]
call esi
test eax, eax
pop ecx
pop ecx
je 0x1012d16
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1674]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1012d7b
mov eax, dword [ebp - 0x1668]
mov ecx, dword [eax]
push 0x800
lea edx, [ebp - 0x1414]
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
jl 0x1012d7b
lea eax, [ebp - 0x1414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
cmp word [ebp - 0x1414], bx
je 0x1012d5c
lea eax, [ebp - 0x1414]
push 0x100590c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1012d7b
push 0x80
lea eax, [ebp - 0x1638]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x1638]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1664]
push eax
push dword [ebp - 0x1670]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1012cb2
mov eax, dword [ebp - 0x166c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1668]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x1670]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101672d
leave
ret 0xc
Function at 0x1012ddb
Capabilities:
Create directory
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102a0ec]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
xor eax, eax
cmp esi, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], eax
je 0x1012eb9
push ebx
lea ecx, [ebp - 0x210]
push ecx
xor ebx, ebx
inc ebx
push ebx
push eax
push 0x1002928
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1012eb2
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1005930
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1012ea6
cmp dword [ebp - 0x214], ebx
je 0x1012e7e
cmp dword [ebp - 0x214], 2
jne 0x1012ea6
mov eax, dword [edi]
shr eax, 1
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.01016cfc
mov dword [ebp - 0x218], ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101672d
leave
ret 8

Function at 0x1012ecc
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x1005958
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1012f3f
push esi
push dword [ebp + 8]
push 0x1005944
push dword [ebp - 4]
call fcn.01017b2a
mov esi, eax
cmp esi, edi
je 0x1012f35
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
leave
ret 4

Function at 0x1012f49
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push 0x1003488
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1012fbc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10059bc
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1012faf
cmp dword [ebp - 8], 4
jne 0x1012faf
cmp dword [ebp - 0xc], 1
sete bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1012fbe
xor eax, eax
pop ebx
leave
ret
Function at 0x1012fc6
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x102a0ec]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x2d8], eax
call fcn.01018429
test eax, eax
je 0x10130a7
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
push 0x63
lea eax, [ebp - 0xcc]
push eax
push 0x16
push dword [0x102aec0]
call esi
test eax, eax
mov ebx, 0x10059e0
mov edi, 0x103
je 0x1013049
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2d8]
lea eax, [ebp - 0x2d4]
push ebx
push edi
push eax
call fcn.0100d4d1
add esp, 0x14
test eax, eax
jl 0x1013049
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x63
lea eax, [ebp - 0xcc]
push eax
push 0x17
push dword [0x102aec0]
call esi
test eax, eax
je 0x101308f
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2d8]
lea eax, [ebp - 0x2d4]
push ebx
push edi
push eax
call fcn.0100d4d1
add esp, 0x14
test eax, eax
jl 0x101308f
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x2d8]
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0101672d
leave
ret 4

Function at 0x1013667
Capabilities:
Delete file
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x102a0ec]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2d8]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x1005958
push 0x80000001
mov dword [ebp - 0x2d8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10137b1
push esi
push ebx
mov esi, 0x1005a7c
push esi
lea eax, [ebp - 0xcc]
push 0x63
push eax
mov dword [ebp - 0x2dc], 0x208
mov dword [ebp - 0x2e4], 1
call fcn.0100d4d1
add esp, 0x10
mov dword [ebp - 0x2e0], 1
jmp 0x101376f
cmp dword [ebp - 0x2e4], 1
jne 0x10137a4
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp - 0x2d4]
push eax
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2d4]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
cmp eax, ebx
pop ecx
pop ecx
je 0x1013747
mov word [eax], bx
lea eax, [ebp - 0x2d4]
push eax
call fcn.010131b3
push dword [ebp - 0x2e0]
lea eax, [ebp - 0xcc]
push esi
push 0x63
push eax
mov dword [ebp - 0x2dc], 0x208
call fcn.0100d4d1
add esp, 0x10
inc dword [ebp - 0x2e0]
test eax, eax
jl 0x10137a4
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10136e4
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0101672d
leave
ret
Function at 0x10137c1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102a0ec]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1005958
push 0x80000001
mov dword [ebp - 0x208], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1013895
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x208]
xor edi, edi
inc edi
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x20c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101386b
cmp dword [ebp - 0x20c], edi
jne 0x101386b
cmp dword [ebp - 0x210], edi
jbe 0x101386b
lea eax, [ebp - 0x204]
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101386b
call fcn.01013667
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push edi
push esi
push esi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0101672d
leave
ret 4

Function at 0x10138a8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102a0ec]
push edi
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x1005958
push 0x80000001
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1013997
push ebx
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
mov esi, 0x1005a94
push esi
push dword [ebp - 0x210]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101395d
cmp dword [ebp - 0x218], ebx
jne 0x101395d
cmp dword [ebp - 0x21c], ebx
jbe 0x1013962
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1013962
call fcn.01013667
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x214]
push ebx
push edi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.0101672d
leave
ret 4
Function at 0x10139a9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102a0ec]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], esi
jne 0x10139d4
xor eax, eax
jmp 0x1013a88
push edi
lea eax, [ebp - 0x208]
push eax
xor edi, edi
inc edi
push edi
push esi
push 0x1003488
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1013a4b
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1004a48
push dword [ebp - 0x208]
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x20c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1013a3b
cmp dword [ebp - 0x20c], edi
jne 0x1013a3b
mov esi, edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1013a6f
push 0x100
lea eax, [ebp - 0x204]
push eax
push 4
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
je 0x1013a85
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0100d4af
push ebx
call fcn.010137c1
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0101672d
leave
ret 8
Function at 0x1013d0f
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102a0ec]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
je 0x1013ecd
test eax, eax
je 0x1013ecd
push edi
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
test ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
je 0x1013d71
push 0
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
test ebx, ebx
jne 0x1013dee
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.msvcrt.dll_wcsrchr]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1013ecc
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1013dd8
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1013ecc
and word [eax], 0
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x1013dc3
jmp 0x1013ecc
push 0x5c
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x1013e98
push 0x1005a70
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x1013e98
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100d4ff
test eax, eax
jl 0x1013eaf
push 0
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
add ebx, 2
jmp 0x1013e78
call fcn.0100d4ff
push 0
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
mov eax, dword [ebp - 0x210]
lea ebx, [eax + 2]
push 0x5c
push ebx
call esi
pop ecx
pop ecx
push ebx
mov dword [ebp - 0x210], eax
test eax, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
jne 0x1013e53
jmp 0x1013eaa
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
push 0x10039d0
push 0x1005ac8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0101672d
leave
ret 0xc
Function at 0x1013fac
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [0x102a0ec]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x304], eax
xor edi, edi
push 0x78
lea eax, [ebp - 0xf4]
push eax
push dword [edi + 0x102a048]
push dword [0x102aec0]
call esi
push 0x104
lea eax, [ebp - 0x2fc]
push eax
push dword [edi + 0x102a04c]
push dword [0x102aec0]
call esi
lea eax, [ebp - 0xf4]
push eax
call ebx
cmp eax, 1
pop ecx
jb 0x101406b
lea eax, [ebp - 0x2fc]
push eax
call ebx
cmp eax, 1
pop ecx
jb 0x101406b
push 0x1005aec
push 0x78
lea eax, [ebp - 0xf4]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x101406b
cmp dword [ebp + 0x10], 0
je 0x1014057
lea eax, [ebp - 0x2fc]
push eax
jmp 0x1014059
push 0
lea eax, [ebp - 0xf4]
push eax
push dword [ebp - 0x300]
call fcn.01013d0f
add edi, 8
cmp edi, 0xa0
jb 0x1013fe2
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x10140a0
push dword [ebp - 0x300]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [ebp - 0x304], esi
je 0x10140a0
push dword [ebp - 0x304]
call fcn.01013ee0
push esi
push dword [ebp - 0x300]
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret 0xc
Function at 0x1014af7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x102a0ec]
push esi
xor esi, esi
push esi
mov dword [ebp - 4], eax
push 0x17
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1014c14
push ebx
push 2
push esi
push 0x1005bd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
je 0x1014c13
push edi
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.0100c535
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x414]
push eax
push edi
lea eax, [ebp - 0x61c]
push eax
call fcn.0100c535
push edi
lea eax, [ebp - 0x414]
push eax
push 0x33
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1014c0b
lea eax, [ebp - 0x20c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1014bef
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x1005bb4
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010131b3
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101672d
leave
ret