joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a570
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp dword [ebp + 0x90], 0
push esi
push edi
je 0x1005a58d
mov ecx, dword [ebp + 0x90]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov esi, dword [esp + 0x14]
mov eax, dword [0x100bc66c]
add esi, 0xfffff7db
mov dword [esp + 0x10], eax
cmp esi, 2
jae 0x1005a669
mov ecx, dword [ebp + 0x84]
sub ecx, dword [ebp + 0x80]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp esi, ecx
jae 0x1005a669
mov ecx, dword [ebp + 0x84]
sub ecx, dword [ebp + 0x80]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x1005a5f2
call fcn.100848cc
mov edx, dword [ebp + 0x80]
lea ecx, [esi + esi*2]
lea eax, [edx + ecx*4 + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x1005a615
mov esi, eax
lea eax, [esi - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
jmp 0x1005a62d
mov ecx, dword [0x100bc66c]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
call fcn.100035a0
mov esi, dword [esp + 0x14]
cmp dword [esi - 8], 0
je 0x1005a645
push esi
push 0x100aded4
lea ecx, [esp + 0x18]
call fcn.10001df0
add esp, 8
lea edx, [esi - 0xc]
cmp edx, 0x100bc65c
je 0x1005a681
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1005a681
push esi
call fcn.1008441c
add esp, 4
jmp 0x1005a681
mov eax, dword [ebp + 0x8c]
push eax
push 0x100adef4
lea ecx, [esp + 0x18]
call fcn.10001df0
add esp, 8
lea ecx, [esp + 0x14]
push ebx
push ecx
mov ecx, 0x100ae45c
call fcn.1005f540
add esp, 4
push 0x100ae484
mov eax, 0x104
lea edi, [esp + 0x1c]
call fcn.10001790
push eax
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
mov ebx, edi
call fcn.10001e00
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [edi - 8], 0x104
mov word [edi + 0x208], dx
push eax
mov edx, edi
xor ecx, ecx
call fcn.1001e400
mov eax, 1
add esp, 4
test byte [0x100c7cd0], al
jne 0x1005a704
or dword [0x100c7cd0], eax
mov esi, 0x100c7c48
call fcn.100469f0
push 0x100a35e0
call fcn.1008416d
add esp, 4
push 0x100adebc
mov ebx, 0x100adf0c
mov eax, 0x100ade1c
mov ecx, 0x100c7c48
call fcn.10047bb0
mov ecx, dword [ebp + 0x30]
push ecx
call dword [sym.imp.USER32.DLL_IsWindow]
pop ebx
test eax, eax
je 0x1005a738
mov edx, dword [ebp + 0x30]
push 0
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
lea eax, [edi - 0xc]
cmp eax, 0x100bc65c
je 0x1005a759
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1005a759
push edi
call fcn.1008441c
add esp, 4
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x1005a77f
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1005a77f
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x1005bf80
Capabilities:
Create thread

Disassembly:
xor edx, edx
push edi
mov edi, 0x1005b2b0
lea eax, [esi + 8]
test edi, edi
mov dword [esi], 0x100adfec
mov dword [esi + 0x18], 0x1005b2b0
mov dword [esi + 0x1c], ecx
mov dword [esi + 4], edx
mov dword [eax], 0xffffffff
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
pop edi
je 0x1005bfc7
push eax
push edx
push ecx
push 0x1005b2b0
push edx
push edx
call fcn.100869f0
add esp, 0x18
mov dword [esi + 4], eax
mov eax, esi
ret

Function at 0x1005c0d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
push esi
push edi
xor edi, edi
cmp dword [0x100c7a84], edi
jne 0x1005c184
lea eax, [esp + 0xc]
push eax
mov ecx, 0x100a7d94
mov dword [0x100c7a84], 1
call fcn.1005f540
mov esi, dword [esp + 0x10]
add esp, 4
call fcn.1000ee80
test eax, eax
je 0x1005c122
mov eax, esi
call fcn.1000a880
test eax, eax
jne 0x1005c154
push esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x1005c191
lea edx, [esi - 0xc]
mov dword [0x100c4f64], edi
cmp edx, 0x100bc65c
je 0x1005c14a
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1005c14a
push esi
call fcn.1008441c
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 8
ret 4
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0xc]
mov eax, esi
call fcn.1000b4e0
lea esi, [esp + 0xc]
test eax, eax
jne 0x1005c17f
mov dword [0x100c4f64], edi
call fcn.100072c0
xor eax, eax
pop edi
pop esi
add esp, 8
ret 4
call fcn.100072c0
mov eax, dword [0x100c4f64]
pop edi
pop esi
add esp, 8
ret 4
mov edi, 0x100bc9a0
call fcn.1000aa30
int3

Function at 0x1005e310
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push edi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
mov edi, ecx
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathW]
mov ebx, dword [sym.imp.SHLWAPI.DLL_PathAppendW]
push 0x100ae2f8
lea ecx, [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x1005e36a
push eax
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.DLL_SHCreateDirectoryExW]
push esi
lea ecx, [esp + 0xc]
push ecx
call ebx
lea ebx, [esp + 8]
call fcn.100036f0
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x20c
ret
Function at 0x1005f8d0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x1005fa80
test esi, esi
je 0x1005fa80
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x1005fa80
mov ebx, dword [esp + 0x20]
mov eax, ebx
call fcn.1005f850
cmp dword [ebp], eax
jl 0x1005fa80
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
xor ebp, ebp
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ecx
lea eax, [ebp + 0x13]
mov dword [esp + 0x14], ebp
js 0x1005f9f4
cmp ebp, ebx
jne 0x1005f963
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x1005f9dc
mov ebp, eax
lea esp, [esp]
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + 0x100ae4a0]
mov byte [esi], dl
shl ecx, 6
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + 0x100ae4a0]
shl ecx, 6
mov byte [esi + 1], dl
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + 0x100ae4a0]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], dl
mov cl, byte [ecx + 0x100ae4a0]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
sub ebp, 1
jne 0x1005f970
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
inc ebp
cmp ebp, ebx
lea edx, [edx + eax*4]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
jle 0x1005f94a
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 0x20]
sub ecx, eax
je 0x1005fa69
lea ebp, [ecx + 1]
test ebp, ebp
je 0x1005fa69
xor eax, eax
test ecx, ecx
jle 0x1005fa10
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x1005fa1e
movzx edx, byte [edi]
or eax, edx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x1005fa2b
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test ebp, ebp
jle 0x1005fa4a
mov ecx, ebp
mov edx, eax
shr edx, 0x1a
mov dl, byte [edx + 0x100ae4a0]
mov byte [esi], dl
inc esi
shl eax, 6
sub ecx, 1
jne 0x1005fa34
add dword [esp + 0x10], ebp
mov edi, 4
sub edi, ebp
test edi, edi
jle 0x1005fa65
push edi
push 0x3d
push esi
call fcn.10087b80
add esp, 0xc
add dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10060170
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x81c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [0x100c67dc]
push esi
push edi
test eax, eax
jne 0x1006026c
push 0x808
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10087b80
mov edx, dword [0x100c6764]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call esi
push 0x100a7b40
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleExW]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x10060259
lea eax, [esp + 0x10]
call fcn.1000a880
test eax, eax
jne 0x10060221
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x1006024b
jmp 0x1006022c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x10060259
pop edi
pop esi
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.10083dbb
add esp, 0x81c
ret
mov edi, 0x100bc9a0
lea esi, [esp + 0x10]
call fcn.1000aa30
push 0x100a8048
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
call eax
mov dword [0x100c67dc], eax
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
xor ecx, esp
call fcn.10083dbb
add esp, 0x81c
ret
Function at 0x10060ac0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x224
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x21c], eax
cmp dword [0x100c7a88], 0
push ebx
push ebp
push esi
push edi
jne 0x10060c6b
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
mov dword [0x100c7a88], 1
call fcn.1005f540
mov ebx, dword [esp + 0x1c]
lea eax, [ebx - 0xc]
add esp, 4
mov dword [esp + 0x1c], eax
xor ebp, ebp
jmp 0x10060b14
mov eax, dword [esp + 0x1c]
cmp dword [eax], 0
jl 0x10060b26
push eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
jmp 0x10060b6f
mov ecx, dword [0x100bc66c]
push ebx
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
lea edi, [esp + 0x14]
call fcn.10003770
test eax, eax
je 0x10060b6f
lea edi, [esi + esi]
push edi
push ebx
mov ebx, dword [esp + 0x1c]
lea edx, [edi + 2]
push edx
push ebx
call fcn.10084427
push eax
call fcn.10001f10
add esp, 0x14
mov dword [ebx - 8], esi
xor eax, eax
mov word [edi + ebx], ax
mov ebx, dword [esp + 0x18]
lea ecx, [ebp + 0x100bd2d8]
push ecx
push ebx
push 0x100a9dfc
lea ecx, [esp + 0x20]
call fcn.10001df0
mov edi, dword [esp + 0x20]
add esp, 0xc
cmp dword [edi - 8], 0
je 0x10060b9d
push edi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x10060ba7
mov dword [0x100c13d8], 1
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2a]
push eax
mov word [esp + 0x2c], dx
call fcn.10087b80
add esp, 0xc
push 0x104
push edi
lea ecx, [esp + 0x28]
call fcn.100288d0
add esp, 8
lea esi, [ebp + 0x100bd8f0]
lea ecx, [esp + 0x20]
call fcn.10028aa0
test eax, eax
jge 0x10060c1c
lea ecx, [edi - 0xc]
cmp ecx, 0x100bc65c
je 0x10060c08
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10060c08
push esi
call fcn.1008441c
add esp, 4
add ebp, 0x208
cmp ebp, 0x618
jb 0x10060b10
jmp 0x10060c48
lea edx, [edi - 0xc]
mov dword [0x100c13d8], 0
cmp edx, 0x100bc65c
je 0x10060c48
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10060c48
push edi
call fcn.1008441c
add esp, 4
add ebx, 0xfffffff4
cmp ebx, 0x100bc65c
je 0x10060c6b
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10060c6b
push esi
call fcn.1008441c
add esp, 4
mov ecx, dword [esp + 0x22c]
mov eax, dword [0x100c13d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x224
ret
Function at 0x10060cb0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x81c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x814], eax
push esi
push edi
push 0x808
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10087b80
mov edx, dword [0x100c6764]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call esi
push 0x100a7b40
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleExW]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x10060d8d
lea eax, [esp + 0x10]
call fcn.1000a880
test eax, eax
jne 0x10060d55
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x10060d7f
jmp 0x10060d60
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x10060d8d
pop edi
pop esi
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.10083dbb
add esp, 0x81c
ret
mov edi, 0x100bc9a0
lea esi, [esp + 0x10]
call fcn.1000aa30
push 0x100aeb04
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x10060da3
call ecx
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
xor ecx, esp
call fcn.10083dbb
add esp, 0x81c
ret

Function at 0x10060dc0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x414
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, 1
push esi
push edi
test byte [0x100c7d84], al
jne 0x10060e00
or dword [0x100c7d84], eax
mov eax, dword [0x100bc66c]
push 0x100a3690
mov dword [0x100c7d80], eax
call fcn.1008416d
add esp, 4
mov ecx, dword [0x100c7d80]
cmp dword [ecx - 8], 0
jne 0x10060ebc
lea edx, [esp + 0xc]
push edx
mov ecx, 0x100aeb14
call fcn.1005f540
mov esi, dword [esp + 0x10]
add esp, 4
mov eax, esi
call fcn.1000a880
push esi
test eax, eax
jne 0x10060e46
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x10060e9a
mov edi, 0x100bc9a0
call fcn.1000aa30
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
je 0x10060e9a
push 0x100aeb2c
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10060e9a
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.10087b80
add esp, 0xc
lea edx, [esp + 0x10]
push 0x200
push edx
call edi
add esp, 8
lea eax, [esp + 0x10]
push eax
mov eax, 0x100c7d80
call fcn.100035a0
lea ecx, [esi - 0xc]
cmp ecx, 0x100bc65c
je 0x10060ebc
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10060ebc
push esi
call fcn.1008441c
add esp, 4
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov eax, 0x100c7d80
call fcn.10083dbb
add esp, 0x414
ret
Function at 0x10060ff0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x74
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, 1
push esi
push edi
test byte [0x100c7d7c], al
jne 0x1006102a
or dword [0x100c7d7c], eax
mov eax, dword [0x100bc66c]
push 0x100a36f0
mov dword [0x100c7d78], eax
call fcn.1008416d
add esp, 4
mov ecx, dword [0x100c7d78]
cmp dword [ecx - 8], 0
jne 0x10061109
xor edx, edx
push 0x62
push edx
lea eax, [esp + 0x16]
push eax
mov word [esp + 0x18], dx
call fcn.10087b80
lea ecx, [esp + 0x14]
add esp, 0xc
push ecx
mov ecx, 0x100a7e5c
call fcn.1005f540
mov esi, dword [esp + 0xc]
add esp, 4
mov eax, esi
call fcn.1000a880
push esi
test eax, eax
jne 0x10061087
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x100610e7
mov edi, 0x100bc9a0
call fcn.1000aa30
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
je 0x100610e7
push 0x100a6b7c
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea edx, [esp + 8]
push edx
push 0x100aefc4
call eax
test eax, eax
jl 0x100610d7
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 0x32
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
lea ecx, [esp + 0xc]
push ecx
mov eax, 0x100c7d78
call fcn.100035a0
mov eax, dword [esp + 8]
test eax, eax
je 0x100610e7
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ecx, [esi - 0xc]
cmp ecx, 0x100bc65c
je 0x10061109
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10061109
push esi
call fcn.1008441c
add esp, 4
mov ecx, dword [esp + 0x78]
pop edi
pop esi
xor ecx, esp
mov eax, 0x100c7d78
call fcn.10083dbb
add esp, 0x74
ret

Function at 0x10061120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov ebx, 0x100a7638
lea edi, [esp + 0x14]
call fcn.100036f0
xor ecx, ecx
mov eax, 0x800
mov dword [esp + 0x10], eax
mov edx, 2
mul edx
seto cl
push 0x100c5a78
mov dword [esp + 0x1c], 1
neg ecx
or ecx, eax
push ecx
call fcn.1008589d
mov esi, eax
add esp, 8
test esi, esi
je 0x100611b2
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call fcn.10087b80
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x20]
push eax
push 0x100ad06c
push 0x100ac3b8
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
push esi
mov eax, edi
call fcn.100035a0
push esi
call fcn.1008441c
add esp, 4
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], 0
lea esi, [edi - 0xc]
jl 0x100611cb
push esi
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
jmp 0x100611dc
mov ecx, dword [0x100bc66c]
push edi
mov eax, ebp
mov dword [ebp], ecx
call fcn.100035a0
add edi, 0xfffffff4
cmp edi, 0x100bc65c
je 0x100611fb
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x100611fb
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100613c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x100aeb60
push 0x100aeb84
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x100ae0cc
call fcn.1005f540
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x100abef8
call fcn.1005f540
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x100abf70
call fcn.1005f540
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
add esp, 0xc
cmp dword [esp + 0x10], 1
je 0x1006149b
mov ecx, 0x100aebb8
mov edi, esi
call fcn.10061330
test eax, eax
je 0x1006149b
mov ecx, 0x100aebd0
mov edi, ebx
call fcn.10061330
test eax, eax
je 0x1006149b
mov edx, 0x100aebe8
mov ecx, ebp
call fcn.100612a0
test eax, eax
je 0x1006149b
lea esi, [esp + 0x14]
call fcn.100072c0
lea esi, [esp + 0x18]
call fcn.100072c0
lea esi, [esp + 0x1c]
call fcn.100072c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
lea eax, [esi - 0xc]
cmp eax, 0x100bc65c
je 0x100614be
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x100614be
push esi
call fcn.1008441c
add esp, 4
lea ecx, [ebx - 0xc]
cmp ecx, 0x100bc65c
je 0x100614dc
lea esi, [ebx - 0xc]
push esi
call edi
test eax, eax
jg 0x100614dc
push esi
call fcn.1008441c
add esp, 4
lea edx, [ebp - 0xc]
cmp edx, 0x100bc65c
je 0x100614fa
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x100614fa
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x10061510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov ebx, edx
mov word [esp + 0x1c], ax
call fcn.10087b80
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push ebx
push esi
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
mov ebx, 0x100a7638
test eax, eax
jne 0x1006157d
lea ebx, [esp + 0x10]
call fcn.100036f0
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x214
ret
Function at 0x100615a0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
mov ebx, eax
push ebp
mov ebp, dword [esp + 0x14]
test ebx, ebx
je 0x100615ff
test ebp, ebp
je 0x100615ff
push esi
push edi
lea edi, [esp + 0x10]
call fcn.100036f0
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 8]
mov edx, dword [esp + 0x18]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebp
push 0x100ab518
push edx
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
lea eax, [esi - 0xc]
cmp eax, 0x100bc65c
je 0x100615fd
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x100615fd
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100616b0
Capabilities:
Query or enumerate registry value

Disassembly:
xor eax, eax
sub esp, 0xc
cmp dword [0x100c13dc], eax
je 0x10061702
mov dword [0x100c13dc], eax
mov dword [esp], eax
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x100aec20
push 0x100a85d8
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
mov eax, dword [esp]
mov dword [0x100c7a8c], eax
add esp, 0xc
ret
mov eax, dword [0x100c7a8c]
add esp, 0xc
ret

Function at 0x10062680
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push esi
push 0x100c5a78
push 0x4000
call fcn.1008589d
mov esi, eax
add esp, 8
test esi, esi
je 0x10062739
push 0x4000
push 0
push esi
call fcn.10087b80
add esp, 0xc
lea eax, [esp + 8]
push eax
push edi
call sub.VERSION.DLL_GetFileVersionInfoSizeW
test eax, eax
je 0x10062730
cmp eax, 0x3fff
ja 0x10062730
push esi
push eax
push 0
push edi
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x10062730
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push 0x100abacc
push esi
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x10062730
mov eax, dword [esp + 4]
movzx ecx, word [eax + 0xa]
mov edx, dword [esp + 0x14]
mov word [edx], cx
movzx ecx, word [eax + 8]
mov edx, dword [esp + 0x18]
mov word [edx], cx
movzx ecx, word [eax + 0xe]
mov edx, dword [esp + 0x1c]
mov ax, word [eax + 0xc]
mov word [edx], cx
mov ecx, dword [esp + 0x20]
push esi
mov word [ecx], ax
call fcn.1008441c
add esp, 4
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.1008441c
add esp, 4
xor eax, eax
pop esi
add esp, 0xc
ret