joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1035307
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1099a38]
push esi
push edi
push 0xb
pop ecx
mov esi, 0x100b6c0
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movsb byte es:[edi], byte [esi]
and dword [eax], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
push eax
push 0
mov dword [ebp - 0x40], 1
call fcn.01042547
test eax, eax
je 0x10354d6
push ebx
mov eax, dword [ebp - 0x4c]
mov esi, dword [eax + 8]
mov ebx, dword [ebp - 0x50]
lea ecx, [esi + 0x78]
push ecx
lea edi, [eax + 0x78]
mov dword [ebp - 0x44], eax
push edi
lea eax, [ebx + 0x17c]
push eax
push 0x100b678
mov dword [ebp - 0x3c], ecx
call fcn.01071ac0
mov ecx, dword [ebp - 0x44]
mov eax, 0x200000
add esp, 0x10
test dword [ecx + 0xc], eax
jne 0x103538d
push edi
push 0x100b640
jmp 0x10353ae
cmp dword [ecx + 0x2c], 1
jne 0x103539b
push edi
push 0x100b60c
jmp 0x10353ae
test dword [esi + 0xc], eax
push dword [ebp - 0x3c]
je 0x1035386
cmp dword [esi + 0x2c], 3
je 0x10353ba
push 0x100b5c8
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x10354c3
xor esi, esi
mov dword [ebp - 0x38], esi
call fcn.01070f95
lea ecx, [ebp - 0x38]
push ecx
push dword [ebx + 0x14]
mov dword [ebp - 0x58], eax
push eax
push edi
push 0x100b580
call fcn.01071ac0
add esp, 0x14
lea eax, [ebp - 0x38]
push eax
push dword [ebx + 0x14]
push dword [ebp - 0x58]
push edi
call fcn.010351f6
mov edi, eax
cmp edi, esi
jl 0x103548c
push 0x100b554
call fcn.01071ac0
pop ecx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
push 2
xor ebx, ebx
inc ebx
push ebx
push esi
push esi
lea eax, [ebp - 0x34]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
cmp edi, esi
je 0x103543a
lea eax, [ebp - 0x34]
push eax
push 0x100b52c
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1035469
push 0xb
push 0x100b520
push ebx
push esi
push dword [ebp - 0x3c]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
cmp edi, esi
je 0x1035460
push 0x100b4d8
call fcn.01071ac0
pop ecx
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x103547b
mov eax, dword [ebp - 0x44]
or byte [eax + 0xd], 0x20
mov eax, dword [ebp - 0x54]
mov dword [eax], ebx
jmp 0x10354a3
push dword [ebp - 0x3c]
push 0x100b478
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x10354a0
call fcn.01087f42
push eax
push edi
push 0x100b430
call fcn.01071ac0
add esp, 0xc
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x38], esi
je 0x10354c3
push 0x100b400
call fcn.01071ac0
pop ecx
push dword [ebp - 0x38]
call fcn.01035296
push dword [ebp - 0x38]
call fcn.01087c9d
lea eax, [ebp - 0x50]
push eax
push eax
call fcn.01042547
test eax, eax
jne 0x103534d
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
pop edi
pop esi
call fcn.0106bc50
leave
ret 4
Function at 0x10354e7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [0x109a030], 0
mov eax, dword [0x1099a38]
push esi
push edi
push 0xb
pop ecx
mov esi, 0x100b6c0
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
movsb byte es:[edi], byte [esi]
jne 0x1035525
push 0x100b9c0
call fcn.01071ac0
xor eax, eax
pop ecx
inc eax
jmp 0x103562d
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [eax + 0x24], ebx
je 0x103553c
push 0x100b908
call fcn.01071ac0
pop ecx
inc ebx
mov eax, dword [0x10c5bb8]
jmp 0x103561f
mov eax, dword [ebp - 0x38]
mov esi, dword [eax + 0x60]
jmp 0x1035612
test byte [esi + 0xe], 0x20
je 0x1035610
mov eax, dword [esi + 0x2c]
sub eax, 0
je 0x10355c0
dec eax
je 0x10355b5
dec eax
je 0x10355aa
dec eax
je 0x103557a
lea eax, [esi + 0x78]
push eax
push 0x100b8b8
jmp 0x1035606
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.010426e9
test eax, eax
jne 0x1035593
lea eax, [esi + 0x78]
push eax
push 0x100b850
jmp 0x1035606
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 8]
test byte [eax + 0xd], 0x20
jne 0x1035610
lea eax, [esi + 0x78]
push eax
push 0x100b7f8
jmp 0x1035606
lea eax, [esi + 0x78]
push eax
push 0x100b7a8
jmp 0x1035606
lea eax, [esi + 0x78]
push eax
push 0x100b760
jmp 0x1035606
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x34]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1035610
lea eax, [ebp - 0x44]
push eax
push 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edi, [esi + 0x78]
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1035610
cmp dword [ebp - 0x44], eax
je 0x1035610
push edi
push 0x100b708
call fcn.01071ac0
pop ecx
xor ebx, ebx
pop ecx
inc ebx
mov esi, dword [esi]
test esi, esi
jne 0x1035551
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x38], eax
jne 0x1035546
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0106bc50
leave
ret 4
Function at 0x1035aab
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x1099a38]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
inc esi
test ebx, ebx
mov dword [ebp - 4], eax
push edi
je 0x1035c7d
push 0
push ebx
call fcn.01073f21
test eax, eax
je 0x1035c7f
push ebx
call fcn.01070f95
cmp byte [0x10c64c0], 0
je 0x1035c7d
mov edi, 0x104
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
push 0x10c64c0
call fcn.01070fc9
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.01073f21
cmp eax, esi
jne 0x1035c4b
lea eax, [ebp - 0x318]
push eax
push ebx
call fcn.0107c2b8
test eax, eax
je 0x1035b48
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0107c2b8
test eax, eax
jne 0x1035b5a
push 0x100bb24
xor esi, esi
call fcn.01071ac0
pop ecx
jmp 0x1035c7f
mov eax, dword [ebp - 0x314]
cmp eax, dword [ebp - 0x31c]
jb 0x1035c7f
ja 0x1035b80
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x320]
jb 0x1035c7f
push edi
lea eax, [ebp - 0x310]
push eax
push 0x100bb1c
push 0x10f54c0
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x100bb18
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1035bce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100bae4
jmp 0x1035c73
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1035c01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x100babc
jmp 0x1035c73
push 1
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
test esi, esi
je 0x1035c60
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
test esi, esi
jne 0x1035c7f
push 4
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1035c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
jmp 0x1035bf9
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
test esi, esi
jne 0x1035c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x100ba94
call fcn.01071ac0
add esp, 0xc
jmp 0x1035c7f
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 4
Function at 0x1035f79
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1099a38]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.SETUPAPI.dll_SetupInitDefaultQueueCallbackEx]
mov edi, eax
cmp edi, ebx
jne 0x1035fc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100bc70
jmp 0x1036015
push 0x103
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
mov dword [esi + 8], eax
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1035fe1
push esi
push 0x1035d55
push dword [ebp - 0x110]
sub eax, ecx
push ebx
mov dword [esi + 0xc], eax
mov dword [esi], edi
mov dword [esi + 0x18], ebx
call dword [sym.imp.SETUPAPI.dll_SetupCommitFileQueueA]
test eax, eax
jne 0x103601e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100bc3c
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1036028
mov dword [ebp - 0x10c], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 8
Function at 0x10371f0
Capabilities:
Query environment variable

Disassembly:
push 0x1c
push 0x100c898
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
sub eax, ebx
je 0x1037308
dec eax
je 0x103723c
dec eax
je 0x1037224
mov dword [ebp - 0x1c], 0xf111
mov edi, dword [ebp + 0xc]
jmp 0x1037324
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_getenv]
push eax
call dword [sym.imp.msvcrt.dll__strdup]
pop ecx
pop ecx
jmp 0x103731f
mov dword [ebp - 4], ebx
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ebx
cmp eax, ebx
je 0x103726c
lea ecx, [esi + 0x110]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1037288
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push edi
push 0x100c864
call fcn.01071aea
add esp, 0xc
call ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
je 0x10372a0
call dword [ebp - 0x20]
push eax
call dword [sym.imp.msvcrt.dll__strdup]
pop ecx
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
jmp 0x10372bf
call ebx
push eax
lea eax, [esi + 0x110]
push eax
push 0x100c82c
call fcn.01071aea
add esp, 0xc
call ebx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
jmp 0x1037324
lea eax, [esi + 0x214]
push eax
lea eax, [esi + 0x110]
push eax
lea eax, [esi + 0xc]
push eax
call fcn.01077b01
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10373c4
cmp dword [edi], eax
jne 0x103733a
mov dword [ebp - 0x1c], 0xf111
cmp dword [ebp - 0x1c], eax
jne 0x10373c4
cmp dword [esi + 8], eax
je 0x10373c4
push eax
push eax
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call esi
mov ebx, eax
test ebx, ebx
je 0x10373bd
push 1
push ebx
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x103737e
push 0x100c7b8
call fcn.01071aea
pop ecx
mov dword [ebp - 0x1c], 8
push ebx
push dword [ebp - 0x24]
push dword [edi]
call esi
test eax, eax
je 0x103739f
mov eax, dword [edi]
test eax, eax
je 0x1037398
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
jmp 0x10373c4
mov dword [ebp - 0x1c], 0xf113
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x100c768
call fcn.01071aea
add esp, 0xc
jmp 0x10373c4
mov dword [ebp - 0x1c], 0xf111
cmp dword [ebp - 0x1c], 0
jne 0x1037401
mov edi, dword [edi]
test edi, edi
je 0x1037401
push 0x5c
push edi
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x10373ee
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_strrchr]
pop ecx
pop ecx
jmp 0x10373f0
xor eax, eax
test eax, eax
je 0x1037401
cmp byte [eax + 1], 0
jne 0x1037401
cmp eax, esi
je 0x1037401
mov byte [eax], 0
mov eax, dword [ebp - 0x1c]
call fcn.0106bf9e
ret 8
Function at 0x1037ded
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x10]
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [ebp + 0xc]
jne 0x1037e2c
mov eax, edi
mov esi, 0x104
push esi
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.01070f95
push eax
push dword [ebp - 0x210]
call fcn.01070fc9
push dword [ebp - 0x214]
lea eax, [ebp - 0x108]
push eax
call fcn.0107c243
push edi
call fcn.0104765f
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x210], eax
push eax
jmp 0x1037edd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push ebx
call fcn.010312a2
push dword [0x109ab70]
lea eax, [ebp - 0x108]
push ebx
push ebx
push 1
push dword [ebp - 0x214]
push eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call fcn.010711ff
cmp eax, ebx
je 0x1037f26
cmp eax, 2
je 0x1037f26
push ebx
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x210]
call edi
test eax, eax
je 0x1037e7a
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x210]
call fcn.01034d42
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_free]
mov dword [esp], 0x100cca0
push 9
call fcn.01081c80
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0x18
Function at 0x1037fe7
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x1099a38]
and dword [ebp - 0x110], 0
mov dword [ebp - 0x118], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
mov dword [ebp - 0x120], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x10c], eax
jne 0x1038034
add eax, 2
mov dword [ebp - 0x10c], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x10c6920
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x108]
push eax
mov edi, 0x1009220
push edi
push dword [ebp - 0x10c]
push 0x100cce8
call esi
test eax, eax
mov dword [ebp - 0x114], eax
je 0x1038075
cmp byte [ebp - 0x108], 0
jne 0x103809c
push 0x10c6920
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
push dword [ebp - 0x10c]
call fcn.01070f95
push eax
push 0x100ccd0
call esi
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x10381a6
cmp byte [ebp - 0x108], 0
je 0x10381a6
mov esi, dword [sym.imp.msvcrt.dll_strchr]
push 0x2c
pop ebx
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x10c], eax
je 0x103812f
mov byte [eax], 0
inc eax
push ebx
push eax
mov dword [ebp - 0x10c], eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1038116
mov byte [eax], 0
inc eax
push ebx
push eax
call esi
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x103811c
mov byte [edi], 0
inc edi
push ebx
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x103810a
mov byte [eax], 0
push edi
call fcn.010723a0
mov dword [ebp - 0x110], eax
mov edi, dword [ebp - 0x110]
push dword [ebp - 0x10c]
call fcn.010723a0
mov dword [ebp - 0x10c], eax
jmp 0x1038135
mov edi, dword [ebp - 0x110]
lea eax, [ebp - 0x108]
push eax
call fcn.010723a0
mov edx, dword [ebp - 0x118]
test edx, edx
je 0x1038157
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x103814d
mov edx, dword [ebp - 0x120]
test edx, edx
je 0x1038178
test edi, edi
je 0x1038175
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1038169
jmp 0x1038178
mov byte [edx], 0
mov esi, dword [ebp - 0x11c]
test esi, esi
je 0x10381ad
cmp dword [ebp - 0x10c], 0
je 0x10381a0
push 0x10
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.msvcrt.dll_strtoul]
add esp, 0xc
jmp 0x10381a2
xor eax, eax
mov dword [esi], eax
jmp 0x10381ad
push 2
call fcn.01037f35
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x114]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0x14
Function at 0x1038358
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x538
mov eax, dword [0x1099a38]
and dword [ebp - 0x534], 0
and dword [ebp - 0x52c], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x530], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x538], eax
mov eax, dword [ebx + 0x51c]
lea esi, [ebx + 0x20c]
mov ecx, 0xc4
lea edi, [ebp - 0x51c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x524], eax
mov eax, dword [ebx + 0x520]
mov dword [ebp - 0x520], eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.010371f0
mov esi, eax
test esi, esi
mov edi, 0x4c7
je 0x10383ec
push esi
push 0x100ceb4
push 0x100ce80
call fcn.01071aea
jmp 0x1038447
cmp dword [ebx + 0x520], 0
je 0x103841a
push dword [ebp - 0x52c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x103841a
push dword [ebp - 0x52c]
push 0x100ce28
call fcn.01071aea
pop ecx
pop ecx
jmp 0x1038453
push dword [ebp - 0x52c]
push dword [ebx]
push dword [ebp - 0x530]
call dword [sym.imp.UPDSPAPI.dll_UpdSpSetDirectoryIdA]
test eax, eax
jne 0x1038485
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebx]
push 0x100cdf4
call fcn.01071ac0
add esp, 0xc
cmp esi, 8
je 0x103845a
cmp esi, edi
je 0x103845a
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x52c], 0
pop edi
pop esi
pop ebx
je 0x1038473
push dword [ebp - 0x52c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x534]
call fcn.0106bc50
leave
ret 0xc
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
push 0x41
pop ecx
push dword [ebp - 0x52c]
lea edx, [ebx + 0x108]
push 0x100bc20
xor eax, eax
mov edi, edx
push 0x103
push edx
rep stosd dword es:[edi], eax
call esi
add esp, 0x10
test eax, eax
jge 0x10384bf
push dword [ebp - 0x52c]
jmp 0x103853f
push 0
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x100cde0
push dword [ebp - 0x538]
push dword [ebp - 0x530]
push 0
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextA]
test eax, eax
je 0x1038553
push 0
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x530]
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetTargetPathA]
test eax, eax
je 0x1038553
push 0x41
pop ecx
lea edx, [ebx + 0x108]
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
push 0x100bc20
push 0x103
push edx
call esi
add esp, 0x10
test eax, eax
jge 0x1038553
lea eax, [ebp - 0x108]
push eax
push dword [ebx]
push 0x100cda8
call fcn.01071ac0
add esp, 0xc
jmp 0x103845a
mov dword [ebp - 0x534], 1
jmp 0x103845a
Function at 0x1039c7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10bd1e4], 5
jae 0x1039c9e
push 0x100db60
call fcn.01071aad
xor eax, eax
jmp 0x1039d40
push ebx
xor ebx, ebx
cmp dword [0x10bd1e8], ebx
mov eax, str.softwaremicrosoft_active_setupinstalled_componentsa00bf2eb_56ee_4fde_b5ea_6a8fa425b2a5
je 0x1039cb3
mov eax, str.softwaremicrosoft_active_setupinstalled_components2eac6a2d_57a8_44d4_96f7_e32bab40ca5f
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
push ecx
push 0x20019
push ebx
push eax
push SysStringLen
mov dword [esi], ebx
mov dword [esi + 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1039d30
lea eax, [ebp - 4]
push eax
mov edi, 0x1106960
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x100d9dc
push dword [ebp + 8]
mov dword [ebp - 4], 0xfffa
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jne 0x1039d30
cmp dword [ebp - 0xc], 1
jne 0x1039d30
push esi
push edi
call fcn.010335a0
push dword [esi + 4]
push dword [esi]
push 0x100db38
call fcn.01071ac0
xor eax, eax
add esp, 0xc
inc eax
jmp 0x1039d3d
push 0x100db1c
call fcn.01071ac0
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1039fa8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0x100de24
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x210], eax
je 0x103a0e1
push ebx
push 0x100de10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x103a0bf
push 4
lea eax, [ebp - 0x218]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x103a0d2
mov eax, dword [0x10bd1e4]
sub eax, 4
push esi
mov esi, 0x104
je 0x103a05a
dec eax
jne 0x103a06e
mov eax, dword [0x10bd1e8]
sub eax, edi
push esi
je 0x103a04c
dec eax
lea eax, [ebp - 0x108]
push eax
je 0x103a045
push 0xf0b4
jmp 0x103a067
push 0xf0a7
jmp 0x103a067
lea eax, [ebp - 0x108]
push eax
push 0xf08a
jmp 0x103a067
push esi
lea eax, [ebp - 0x108]
push eax
push 0xf089
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x100dde8
push dword [0x10bd830]
lea eax, [ebp - 0x20c]
push 0x100dde0
push esi
push eax
call fcn.01037486
add esp, 0x14
push 1
lea eax, [ebp - 0x20c]
push eax
push 0x1009220
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x108]
push eax
push 0x100ddd4
push 0x100ddc8
call ebx
pop esi
jmp 0x103a0d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100dd88
call fcn.01071ac0
pop ecx
pop ecx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
jmp 0x103a0f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100dd50
call fcn.01071ac0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
call fcn.0106bc50
leave
ret 4