joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101fb0f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push 4
pop ebx
push ebx
push esi
push esi
push esi
push 0x1001490
push 0x80000001
call edi
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x101fbb0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001478
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x101fba7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
mov edi, 0x1001460
push edi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 4], 0x100000
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.0101f845
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10200ce
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push 0x214
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x628]
push edi
push eax
mov dword [ebp - 0x62c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101fa78
test eax, eax
je 0x1020200
lea eax, [ebp - 0x20c]
push eax
push esi
cmp dword [ebp + 0x14], edi
je 0x10201c2
lea eax, [ebp - 0x620]
push eax
call fcn.0101fdd2
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x10201a7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10201a7
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
or eax, 4
mov dword [ebp - 0x418], eax
push edi
lea eax, [ebp - 0x62c]
push eax
push edi
call sub.ADVPACK.dll_ExecuteCabW
jmp 0x1020200
test byte [ebp + 0x18], 4
jne 0x1020200
lea eax, [ebp - 0x20c]
push eax
push 0x40
push 0xc
push 0xb
push edi
call fcn.0101ffea
jmp 0x1020200
lea eax, [ebp - 0x414]
push eax
call fcn.0101fdd2
push ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1020200
push edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push edi
push edi
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x414]
push eax
push edi
call sub.ADVPACK.dll_RunSetupCommandW
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 0x14
Function at 0x1020216
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x630]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, 0x1001738
push ebx
push 0x80000002
call edi
test eax, eax
jne 0x10203ca
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
push 0x1001720
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x10203be
mov eax, 0x104
push ebx
push eax
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], esi
call fcn.0101fdd2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10203b2
mov ebx, 0x100171c
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x102031f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x10016fc
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x1020376
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x80000001
call edi
test eax, eax
jne 0x1020376
push dword [ebp - 0x620]
push esi
push esi
call sub.ADVPACK.dll_RegRestoreAllW
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x62c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x62c]
mov dword [ebp - 0x628], 0x104
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10202d2
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret
Function at 0x1020756
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
cmp esi, edi
je 0x10207c5
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x10019a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10207c5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x100198c
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10207bc
test byte [ebp - 4], bl
je 0x10207bc
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01024ca9
test eax, eax
jne 0x10207ea
mov eax, 0x1001968
cmp esi, edi
jne 0x10207dc
mov eax, 0x100194c
push dword [ebp + 0x14]
push esi
push esi
push eax
push dword [ebp + 0xc]
call fcn.010200ce
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.010200ce
cmp esi, edi
je 0x102080f
push 0xd
push ebx
push esi
push 0x100192c
push dword [ebp + 0xc]
call fcn.010200ce
push dword [ebp - 8]
push esi
call fcn.01020468
cmp esi, edi
pop edi
pop esi
pop ebx
jne 0x1020824
call fcn.01020216
leave
ret 0x10

Function at 0x102082d
Capabilities:
Check os version
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
cmp dword [ebp + 8], ebx
je 0x1020871
call fcn.0101fbc2
call fcn.0101f9f6
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x102086b
call sub.iertutil.dll_Ordinal_37
call sub.iertutil.dll_Ordinal_33
call dword [sym.imp.SHELL32.dll_SHFlushSFCache]
mov eax, 0x1001af4
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x1020929
call fcn.0101f956
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push 2
push 8
lea eax, [ebp - 0x120]
push eax
push 0xb
push 0x1001adc
push 0x1001a88
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0x114
lea eax, [ebp - 0x118]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x102091d
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x1020918
jne 0x10208f7
cmp dword [ebp - 0x110], 1
jae 0x1020918
cmp eax, 6
jb 0x1020903
mov edi, 0x1001a5c
jmp 0x102091d
cmp eax, 5
jne 0x102091d
cmp dword [ebp - 0x110], 2
jne 0x102091d
mov edi, 0x1001a34
jmp 0x102091d
mov edi, 0x1001a04
push ebx
push edi
push 0x10019ec
push dword [ebp + 8]
jmp 0x1020931
push ebx
push eax
push 0x10019ec
push ebx
call fcn.01020756
cmp dword [ebp + 8], ebx
pop edi
pop ebx
je 0x1020942
call fcn.0101fb0f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01023ead
leave
ret 4
Function at 0x1020c9d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
or eax, 3
cmp dword [ebp + 0xc], esi
je 0x1020cde
lea ebx, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x210]
push ebx
push esi
push eax
push esi
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x1020cef
lea ebx, [ebp - 0x210]
push ebx
push eax
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1020d6f
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call fcn.01020b90
cmp dword [ebp + 0xc], esi
je 0x1020d33
cmp dword [ebp + 0x10], esi
jne 0x1020d26
cmp eax, esi
je 0x1020d63
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
jmp 0x1020d54
cmp dword [ebp + 0x10], esi
jne 0x1020d4e
cmp eax, esi
jne 0x1020d63
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1020d63
push esi
push 0x1001420
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 0xc

Function at 0x1020da7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x90]
push ecx
push 1
xor esi, esi
push esi
push eax
push 0x80000002
mov dword [ebp - 0x88], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1020e76
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x90]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x90]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1020e76
push esi
lea eax, [ebp - 0x88]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x88]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1020e6a
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 8
Function at 0x1020ecc
Capabilities:
Delete registry value
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x1020ee1
push esi
call fcn.01022a27
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x1020f0c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x1020eff
and eax, 0xfffffff9
jmp 0x1020f02
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1020f47
cmp dword [ebp + 0x10], 0
je 0x1020f27
push dword [ebp + 8]
push 0x1002070
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1020f47
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x1002070
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop ebp
ret 0xc

Function at 0x1020fa3
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call fcn.01022a27
mov edi, eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x29
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x1021018
push 0
push esi
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret 8
Function at 0x1021124
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x104
test eax, eax
je 0x10211b5
push 0x10021a0
lea eax, [ebp - 0x20c]
push eax
call fcn.01021089
mov eax, dword [0x102837c]
test eax, eax
jne 0x102117f
call fcn.0101f864
push ebx
lea ecx, [ebp - 0x414]
push ecx
push 0x10
push eax
call edi
test eax, eax
je 0x10211b5
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x10021a0
lea eax, [ebp - 0x20c]
push eax
call fcn.01021089
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1002168
push 0x10020f0
push 0x80000002
mov dword [ebp - 0x418], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x102120c
mov eax, dword [0x102837c]
test eax, eax
jne 0x10211fb
call fcn.0101f864
push ebx
lea ecx, [ebp - 0x414]
push ecx
push 0x11
push eax
call edi
test eax, eax
je 0x1021244
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
test eax, eax
je 0x1021244
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x10021a0
lea eax, [ebp - 0x20c]
push eax
call fcn.01021089
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret

Function at 0x1021258
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 2
push esi
push esi
push esi
push 0x1002248
push 0x80000001
mov edi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10212b1
push 0x40
push 0x1002208
push 1
push esi
push 0x10021f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10212a8
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1021e08
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
push esi
push edi
push eax
push 0x1001e48
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0101ff8b
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
mov edi, 0x1001fe8
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x80000001
push esi
mov dword [ebp - 0x214], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x210]
and eax, dword [ebp + 0xc]
push 4
or eax, dword [ebp + 0x10]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push 4
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret 0xc

Function at 0x1021eb7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x1021f0a
push 0
push dword [esi + edi*4]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1021f04
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push 0
push dword [ebp + 8]
push eax
call fcn.01021c71
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x1021ed8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret 0x10

Function at 0x1021f1f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x61c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1022034
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x1001c20
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
push edi
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.01021c71
mov eax, dword [0x102837c]
cmp eax, edi
jne 0x1021f8c
call fcn.0101f864
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x2db
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.01021c71
mov eax, dword [0x102837c]
test eax, eax
jne 0x1021fec
call fcn.0101f864
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x2dd
push eax
call edi
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.01021c71
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01023ead
leave
ret 4
Function at 0x10220c4
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jl 0x1022154
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1022154
mov eax, dword [0x102837c]
test eax, eax
jne 0x1022105
call fcn.0101f864
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x2da
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp + 8]
push eax
call fcn.01021c71
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01023ead
leave
ret 8

Function at 0x1022167
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x10]
jl 0x10221ae
push esi
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10221ae
push 1
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.01021c71
cmp dword [ebp + 0xc], 0
jl 0x10221d6
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x10221cd
test esi, esi
je 0x10221cd
call fcn.01021332
test al, al
je 0x10221d6
push esi
push dword [ebp + 0xc]
call fcn.010220c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret 0xc

Function at 0x10221ea
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1022293
push 0x1002544
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010214df
test eax, eax
jl 0x1022293
push 0x44
pop edi
push edi
lea eax, [ebp - 0x260]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x260], edi
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1022293
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x218]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret
Function at 0x10222a6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 2
pop ebx
push ebx
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x10223a3
push esi
call fcn.01020d84
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0102205c
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1022307
push 1
push esi
push 3
lea eax, [ebp - 0x20c]
push eax
call fcn.01021c71
push esi
push 1
push 0
call fcn.01022167
test esi, esi
jne 0x1022378
push esi
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], 0x10
mov dword [ebp - 0x210], 0x19
call fcn.01021eb7
push 0x17
pop esi
push 1
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], 6
call fcn.01021eb7
push 1
push 1
lea eax, [ebp - 0x210]
push eax
push 4
mov dword [ebp - 0x210], esi
call fcn.01021eb7
call fcn.01022048
push 0x1002568
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call fcn.010213a0
pop esi
test al, al
jne 0x102239d
call fcn.010221ea
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 4
Function at 0x1023205
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push 2
push edi
push edi
push edi
push 0x1002698
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x102328c
push dword [ebp + 0xc]
push 0x1002670
push edi
push dword [ebp - 4]
call fcn.01024e70
mov esi, eax
cmp esi, edi
jl 0x1023281
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push edi
push 0x1002688
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
jne 0x1023273
xor esi, esi
jmp 0x1023281
jle 0x102327f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102329a
jle 0x1023298
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 8