joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100350a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push eax
push ebx
push ecx
push edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov ecx, eax
shr eax, 3
add edi, eax
mov dword [ebp + 0x10], edi
and ecx, 7
mov ebx, pe_nt_image_headers32
shr ebx, cl
xor edx, edx
xor ecx, ecx
mov dx, word [esi]
cmp edx, dword [ebp + 8]
jge 0x100350fd
inc esi
inc esi
mov cx, word [esi]
inc esi
inc esi
sub ecx, edx
mov eax, dword [ebp + 0x18]
mul edx
mov edi, dword [ebp + 0x10]
add edi, eax
cmp ecx, 0
jle 0x100350fb
xor byte [edi], bl
add edi, dword [ebp + 0x18]
loop 0x100350f4
jmp 0x100350cc
pop edx
pop ecx
pop ebx
pop eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10035107
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push eax
push ebx
push ecx
push edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov ecx, eax
shr eax, 3
add edi, eax
mov dword [ebp + 0x10], edi
and ecx, 7
mov ebx, pe_nt_image_headers32
shr ebx, cl
xor edx, edx
xor ecx, ecx
mov dx, word [esi]
cmp edx, dword [ebp + 8]
jge 0x10035162
inc esi
inc esi
mov cx, word [esi]
inc esi
inc esi
sub ecx, edx
mov eax, dword [ebp + 0x18]
mul edx
mov edi, dword [ebp + 0x10]
sub edi, eax
cmp ecx, 0
jle 0x10035160
xor byte [edi], bl
sub edi, dword [ebp + 0x18]
loop 0x10035159
jmp 0x10035131
pop edx
pop ecx
pop ebx
pop eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10036710
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
test eax, eax
push esi
je 0x10036731
cmp eax, 1
je 0x10036769
mov eax, 0xffffffff
pop esi
add esp, 0x88
ret
mov esi, dword [esp + 0x90]
push esi
push 0x64
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push 1
push 0x1004d064
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 4]
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
pop esi
add esp, 0x88
ret
lea eax, [esp + 4]
push 0
mov esi, dword [esp + 0x94]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
pop esi
add esp, 0x88
ret
Function at 0x1003b480
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14c
mov eax, dword [0x1004f4f8]
mov ecx, 1
push esi
cmp eax, ecx
je 0x1003b609
mov word [0x1004a414], cx
xor eax, eax
mov word [0x1004a416], ax
mov dword [0x1004a410], eax
mov dword [0x1004a442], 3
mov word [0x1004a41a], cx
push str.Version_5.0
mov word [0x1004a43e], cx
push 0x1004a41c
mov word [0x1004a440], ax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov word [0x1004a418], 0xd
call esi
push str.Accusoft
push 0x1004a446
call esi
push str.Dynamic_Link_Library
push 0x1004a468
call esi
push str.Windows_TWAIN_32_bit_Application
push 0x1004a48a
call esi
lea ecx, [esp + 0xb0]
push 0xa0
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push str.TWAIN_32.DLL
push ecx
call esi
lea ecx, [esp + 0xb0]
push 0x1004f540
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
lea ecx, [esp + 4]
lea eax, [esp + 0xb0]
push ecx
push eax
call esi
lea ecx, [esp + 0x28]
push 0x4000
lea edx, [esp + 0xb4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x1003b577
mov eax, 0xffffffef
pop esi
add esp, 0x14c
ret
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1004f500], eax
test eax, eax
jne 0x1003b598
mov eax, 0xffffffef
pop esi
add esp, 0x14c
ret
push str.DSM_Entry
mov dword [0x1004f500], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004a368], eax
test eax, eax
jne 0x1003b5bf
mov eax, 0xffffffef
pop esi
add esp, 0x14c
ret
push 0x1004a0f4
mov dword [0x1004a368], eax
push 0x301
push 4
push 1
push 0
push 0x1004a410
call eax
and eax, 0xffff
test eax, eax
je 0x1003b5fb
mov eax, 0xfffffff0
pop esi
mov dword [0x1004f4f8], 0
add esp, 0x14c
ret
cmp dword [0x1004a410], 0
je 0x1003b616
mov eax, 1
pop esi
mov dword [0x1004f4f8], eax
add esp, 0x14c
ret
mov eax, 0xfffffff0
pop esi
mov dword [0x1004f4f8], 0
add esp, 0x14c
ret

Function at 0x1003d552
Capabilities:
Delete file

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x1003d56b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1003d57f
push eax
call fcn.1003dce0
add esp, 4
mov eax, 0xffffffff
jmp 0x1003d581
xor eax, eax
ret

Function at 0x1003ecf1
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.1003ed7c
mov dword [0x1005bda0], 1
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0x1005bd9c], bl
jne 0x1003ed52
cmp dword [0x1004b7f4], 0
je 0x1003ed40
mov esi, dword [0x1004b7f0]
sub esi, 4
cmp esi, dword [0x1004b7f4]
jb 0x1003ed40
mov eax, dword [esi]
test eax, eax
je 0x1003ed35
call eax
sub esi, 4
cmp esi, dword [0x1004b7f4]
jae 0x1003ed2d
push 0x1005db30
push 0x1005db28
call fcn.1003ed92
add esp, 8
push 0x1005db38
push 0x1005db34
call fcn.1003ed92
add esp, 8
test ebx, ebx
je 0x1003ed6f
call fcn.1003ed87
jmp 0x1003ed79
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x1003edb2
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.10040b6a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1005bda4], eax
cmp eax, 0xffffffff
je 0x1003ee0f
push 0x70
push 1
call fcn.10040c62
add esp, 8
mov esi, eax
test esi, esi
je 0x1003ee0f
push esi
mov eax, dword [0x1005bda4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1003ee0f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], 0x1005d4f0
mov dword [esi + 0x14], 1
jmp 0x1003ee11
xor eax, eax
pop esi
ret

Function at 0x1003ee34
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x1005bda4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1003ee93
push 0x70
push 1
call fcn.10040c62
add esp, 8
mov esi, eax
test esi, esi
je 0x1003ee89
push esi
mov eax, dword [0x1005bda4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1003ee89
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x1005d4f0
jmp 0x1003ee93
push 0x10
call fcn.1003d80a
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x1003f718
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 4
xor ecx, ecx
mov eax, 0x1005c7e0
push edi
cmp dword [eax], edx
je 0x1003f736
add eax, 8
inc ecx
cmp eax, 0x1005c858
jb 0x1003f727
cmp dword [ecx*8 + 0x1005c7e0], edx
lea eax, [ecx*8]
jne 0x1003f76f
mov edx, dword [eax + 0x1005c7e4]
push 0
lea eax, [esp + 8]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [0x1005c0f8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
add esp, 4
ret
Function at 0x10040777
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], esi
jne 0x10040794
xor eax, eax
jmp 0x100408e4
mov eax, dword [ebp + 8]
test byte [eax + 0x1005bff0], 0x20
je 0x100407ad
push 2
push 0
push eax
call fcn.10040943
add esp, 0xc
mov eax, dword [ebp + 8]
test byte [eax + 0x1005bff0], 0x80
je 0x10040837
mov dword [ebp - 0xc], 0
mov edi, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x1004086f
lea ebx, [ebp - 0x410]
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x10040801
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x100407ed
inc esi
mov byte [ebx], 0xd
inc ebx
lea ecx, [ebp - 0x410]
mov byte [ebx], al
inc ebx
mov eax, ebx
sub eax, ecx
cmp eax, 0x400
jl 0x100407d7
lea eax, [ebp - 0x410]
push 0
sub ebx, eax
lea ecx, [ebp - 0x410]
lea eax, [ebp - 4]
push eax
push ebx
push ecx
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x1005c0f0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10040866
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
cmp ebx, eax
jle 0x100407c3
jmp 0x1004086f
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax*4 + 0x1005c0f0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10040866
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x1004086f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jne 0x100408df
cmp dword [ebp - 0xc], 0
je 0x100408aa
cmp dword [ebp - 0xc], 5
jne 0x10040898
call fcn.1003dd53
mov dword [eax], 9
call fcn.1003dd5c
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x100408a3
push dword [ebp - 0xc]
call fcn.1003dce0
add esp, 4
mov eax, 0xffffffff
jmp 0x100408e4
mov eax, dword [ebp + 8]
test byte [eax + 0x1005bff0], 0x40
je 0x100408c2
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x100408c2
xor eax, eax
jmp 0x100408e4
call fcn.1003dd53
mov dword [eax], 0x1c
call fcn.1003dd5c
mov dword [eax], 0
mov eax, 0xffffffff
jmp 0x100408e4
mov eax, dword [ebp - 8]
sub eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402fc0
Capabilities:
Check os version
Get hostname
Query environment variable

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42506c]
xor eax, esp
mov dword [esp + 0x118], eax
push edi
push 0x3f
lea eax, [esp + 0xe1]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x10], 0x40
mov byte [esp + 0xe8], 0
call fcn.004036a0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0xdc]
mov edx, edi
mov ecx, eax
sub edx, ecx
jmp 0x403020
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x403020
push esi
push 0x40
call fcn.0040386c
add esp, 4
push 0x40
mov esi, eax
push esi
push str.NUMBER_OF_PROCESSORS
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [edi + 0x40]
mov eax, esi
sub edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x403050
push esi
call fcn.0040371a
add esp, 4
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop esi
je 0x403176
cmp dword [esp + 0xc], 6
jne 0x4030a8
mov eax, dword [str.Vista]
mov cx, word [0x42065c]
mov dword [esp + 0x9c], eax
mov word [esp + 0xa0], cx
jmp 0x403155
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4030e5
mov edx, dword [str.Windows_2000]
mov eax, dword [0x42064c]
mov ecx, dword [0x420650]
mov dword [esp + 0x9c], edx
mov dl, byte [0x420654]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
mov byte [esp + 0xa8], dl
jmp 0x403155
cmp eax, 1
jne 0x403120
mov eax, dword [str.Windows_XP]
mov ecx, dword [0x420640]
mov dx, word [0x420644]
mov dword [esp + 0x9c], eax
mov al, byte [0x420646]
mov dword [esp + 0xa0], ecx
mov word [esp + 0xa4], dx
mov byte [esp + 0xa6], al
jmp 0x403155
mov ecx, dword [str.Unknown_OS]
mov edx, dword [0x420634]
mov ax, word [0x420638]
mov dword [esp + 0x9c], ecx
mov cl, byte [0x42063a]
mov dword [esp + 0xa0], edx
mov word [esp + 0xa4], ax
mov byte [esp + 0xa6], cl
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0xa0]
push eax
push str._s___s
add edi, 0x80
push edi
call fcn.0040392f
add esp, 0x10
mov ecx, dword [esp + 0x11c]
pop edi
xor ecx, esp
mov al, 1
call fcn.00403b8b
add esp, 0x11c
ret

Function at 0x403b8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42506c]
jne 0x403b95
repz ret
jmp fcn.00407821
Function at 0x40abc3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00408b43
xor ebx, ebx
cmp dword [0x426ac8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40ac98
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40ac03
xor eax, eax
jmp 0x40ad5c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420ec8
push edi
call esi
cmp eax, ebx
je 0x40abfc
push eax
call fcn.00408ae0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426ac8], eax
call esi
push eax
call fcn.00408ae0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426acc], eax
call esi
push eax
call fcn.00408ae0
mov dword [0x426ad0], eax
lea eax, [ebp - 8]
push eax
call fcn.00405b3f
test eax, eax
pop ecx
pop ecx
je 0x40ac66
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00406d8d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40ac98
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00408ae0
cmp eax, ebx
pop ecx
mov dword [0x426ad8], eax
je 0x40ac98
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00408ae0
pop ecx
mov dword [0x426ad4], eax
mov eax, dword [0x426ad4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40ad11
cmp dword [0x426ad8], esi
je 0x40ad11
push eax
call fcn.00408b4c
pop ecx
call eax
cmp eax, ebx
je 0x40acde
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x426ad8]
call fcn.00408b4c
pop ecx
call eax
test eax, eax
je 0x40acde
test byte [ebp - 0x18], 1
jne 0x40ad11
lea eax, [ebp - 0xc]
push eax
call fcn.00405bee
test eax, eax
pop ecx
je 0x40acf9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00406d8d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40ad08
or dword [ebp + 0x10], 0x200000
jmp 0x40ad42
or dword [ebp + 0x10], 0x40000
jmp 0x40ad42
mov eax, dword [0x426acc]
cmp eax, esi
je 0x40ad42
push eax
call fcn.00408b4c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40ad42
mov eax, dword [0x426ad0]
cmp eax, esi
je 0x40ad42
push dword [ebp - 4]
push eax
call fcn.00408b4c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x426ac8]
call fcn.00408b4c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100b7c2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, 0x101fd90
push esi
xor edi, edi
push edi
push edi
push 0x8026
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
cmp ebx, edi
jl 0x100b82c
push 0x1005370
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x1005358
push 0x10052f0
push 0x5d
push edi
push 0x10052e8
push edi
push esi
push 0x10052c4
push 0x4000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
jmp 0x100b86f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x1005358
push 0x10052f0
push 0x61
push edi
push 0x10052e8
push edi
push ebx
push 0x1005288
push 0x2000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
xor eax, eax
mov word [0x101fd90], ax
pop edi
pop esi
pop ebx
ret 4
Function at 0x100b944
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push 0x10055c8
mov dword [0x101ff98], eax
mov dword [ebp - 4], esi
call fcn.0100b8be
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, esi
je 0x100bb1e
cmp dword [ebp - 0xc], 2
jl 0x100bb1e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xc3
push esi
push 0x10052e8
push esi
push dword [ebx + 4]
mov ebx, 0x4000000
push 0x1005594
push ebx
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xc4
push esi
push 0x10052e8
push esi
push 0x1005538
push ebx
call fcn.0100b725
pop ecx
pop ecx
push eax
call fcn.0100f2dd
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xc5
push esi
push 0x10052e8
push esi
push 0x10054c8
push ebx
call fcn.0100b725
pop ecx
pop ecx
push eax
call fcn.0100f2dd
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xc6
push esi
push 0x10052e8
push esi
push 0x1005488
push ebx
call fcn.0100b725
pop ecx
pop ecx
push eax
call fcn.0100f2dd
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xc7
push esi
push 0x10052e8
push esi
push 0x100544c
push ebx
call fcn.0100b725
pop ecx
pop ecx
push eax
call fcn.0100f2dd
mov dword [ebp + 8], esi
mov eax, dword [ebp + 8]
push dword [eax*8 + 0x1005280]
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x100bac9
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jb 0x100baa4
jmp 0x100bad6
mov eax, dword [ebp + 8]
call dword [eax*8 + 0x1005284]
mov dword [ebp - 4], eax
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xd7
push esi
push 0x10052e8
push esi
push dword [ebp - 4]
mov esi, dword [ebp - 8]
push dword [esi + 4]
push 0x1005418
push ebx
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
jmp 0x100bb5e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x10055b8
push 0x10052f0
push 0xbd
push esi
push 0x10052e8
push esi
push dword [ebp + 0x10]
push 0x10053c0
push 0x2000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
call fcn.0100b935
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x100bf0a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x210]
push ecx
push dword [eax + 0x14]
xor esi, esi
xor edi, edi
call fcn.0100d1ee
cmp eax, esi
jne 0x100bfeb
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x100bf83
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
jne 0x100bf8c
cmp eax, 0x103
jne 0x100bf3f
jmp 0x100bfdf
jle 0x100bf98
and eax, 0xffff
or eax, 0x80070000
push esi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x100590c
push 0x10052f0
push 0x314
push esi
push 0x10052e8
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x10058c0
push 0x2000000
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100e138
leave
ret 4
Function at 0x100d025
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
push ebx
xor edi, edi
push edi
push dword [ebp + 0x10]
mov dword [ebx], edi
push edi
push dword [ebp + 0xc]
mov dword [esi], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x100d0db
mov eax, dword [ebx]
add eax, 4
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [esi], eax
cmp eax, edi
je 0x100d12d
push dword [ebx]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push dword [esi]
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100d12d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x1005fa4
push 0x1005f40
push 0xac
push edi
push 0x10052e8
push edi
push dword [ebp - 4]
push 0x1005f04
push 0x2000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
push dword [esi]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [esi], edi
jmp 0x100d12d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x1005fa4
push 0x1005f40
xor ecx, ecx
cmp dword [ebp - 4], 2
push 0xb7
push edi
setne cl
push 0x10052e8
push edi
push dword [ebp - 4]
mov eax, 0x2000000
push dword [ebp + 0xc]
dec ecx
and ecx, eax
add ecx, eax
push 0x1005ec8
push ecx
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc

Function at 0x100d1ee
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c026
lea eax, [ebp - 0x210]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d13a
xor esi, esi
test eax, eax
jl 0x100d2a8
push ebx
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
je 0x100d2e9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x1006104
push 0x1005f40
cmp ebx, 2
jne 0x100d294
push 0x83
push esi
push 0x10052e8
push esi
push edi
push 0x10060dc
push 0x4000000
jmp 0x100d2db
push 0x87
push esi
push 0x10052e8
push esi
push edi
push 0x10060b0
jmp 0x100d2d6
push 3
pop ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e909
push eax
push 0x1006104
push 0x1005f40
push 0x8e
push esi
push 0x10052e8
push esi
push edi
push 0x1006084
push 0x2000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100e138
leave
ret 8