joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f976
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 0x18], esi
test ecx, ecx
je 0x1005f9a7
mov eax, dword [ecx + 0x2a8]
test eax, eax
jne 0x1005f9ac
mov eax, SysReAllocStringLen
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push ecx
lea ecx, [ebp - 0x18]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10007698
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1005f9ee
push 0x10
lea eax, [ebp - 0x14]
push eax
push 3
push esi
push 0x100076e4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1005f9ee
xor esi, esi
inc esi
cmp dword [ebp - 0x18], 0
je 0x1005f9fd
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10087900
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100601d5
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x84c]
push 0x640
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x850], esi
lea eax, [ebp + 0x14]
mov ebx, 0x320
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x84c]
push ebx
push eax
push dword [ebp + 0xc]
push dword [0x1008b1e4]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x854]
push eax
push ebx
lea eax, [ebp - 0x850]
push eax
push esi
push esi
lea eax, [ebp - 0x84c]
push eax
push 0x500
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x10060312
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, 0x104
test edi, edi
je 0x1006028a
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10060293
sub ecx, edx
sar ecx, 1
jne 0x100602ee
test edi, edi
je 0x100602be
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x100602c7
sub ecx, edx
sar ecx, 1
jne 0x100602ee
push ebx
lea eax, [ebp - 0x20c]
push eax
push 3
push dword [0x1008b1e4]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x850]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x850]
mov esi, eax
call fcn.10037062
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10060325
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x320
mov word [ebp - 0x20c], ax
mov word [ebp - 0x84c], ax
lea eax, [ebp - 0x84c]
push eax
push edx
push dword [0x1008b1e4]
call dword [sym.imp.USER32.dll_LoadStringW]
xor ebx, ebx
mov edi, 0x104
test esi, esi
je 0x100603b2
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1006038b
sub ecx, edx
sar ecx, 1
jne 0x100603b2
push esi
call dword [sym.imp.USER32.dll_GetParent]
push edi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100603bb
sub ecx, edx
sar ecx, 1
jne 0x100603e2
push edi
lea eax, [ebp - 0x20c]
push eax
push 3
push dword [0x1008b1e4]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x84c]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 4
Function at 0x10060a70
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, edx
mov dword [ebp - 4], esi
push edi
test ecx, ecx
je 0x10060a90
mov edi, dword [ecx + 0x2a8]
test edi, edi
jne 0x10060a95
mov edi, SysReAllocStringLen
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x10060b3d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push 0x10007698
push edi
jmp 0x10060b1f
cmp dword [ebp - 8], 1
je 0x10060b2e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x4c
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push 0x100076f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10060b2b
mov eax, SysReAllocStringLen
cmp edi, eax
je 0x10060b2e
mov edi, eax
cmp dword [ebp - 4], esi
je 0x10060b04
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push 0x10007698
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10060abf
jmp 0x10060b2e
xor esi, esi
inc esi
cmp dword [ebp - 4], 0
je 0x10060b3d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10061c77
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
or dword [esp + 0xc], 0xffffffff
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x20], edx
push esi
push esi
push 0x1032
push dword [ebp + 8]
mov dword [esp + 0x3c], ecx
mov ebx, esi
mov dword [esp + 0x34], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x28], eax
mov edi, esi
mov dword [esp + 0x14], edi
test eax, eax
jg 0x10061cc2
mov eax, 0x80004005
jmp 0x10061e27
mov dword [esp + 0x1c], esi
test ebx, ebx
js 0x10061e18
push 2
push dword [esp + 0x1c]
mov dword [esp + 0x14], esi
push 0x100c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 8]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x20], eax
call fcn.10060dc1
mov ebx, eax
test ebx, ebx
js 0x10061dc7
cmp dword [esp + 0xc], 0
je 0x10061dc7
test edi, edi
je 0x10061d32
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10061d1c
sub ecx, edx
sar ecx, 1
lea esi, [ecx*2 + 4]
mov ecx, dword [esp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x24]
jne 0x10061d39
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 6
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10061db9
shr esi, 1
test edi, edi
je 0x10061d85
push edi
mov edx, esi
mov ecx, eax
call fcn.1000b82d
mov ecx, dword [esp + 0x10]
mov edx, esi
push 0x10006cb0
call fcn.10022e38
mov eax, dword [esp + 0x10]
push dword [esp + 0xc]
mov edx, esi
mov ecx, eax
call fcn.10022e38
mov edx, esi
mov esi, dword [esp + 0x10]
push 0x10006cb0
mov ecx, esi
call fcn.10022e38
test edi, edi
je 0x10061db1
lea ecx, [esp + 0x14]
call fcn.10037062
mov edi, esi
mov dword [esp + 0x14], edi
jmp 0x10061dbe
mov ebx, 0x8007000e
lea ecx, [esp + 0xc]
call fcn.10031469
mov eax, dword [esp + 0x1c]
inc eax
push 0
mov dword [esp + 0x20], eax
pop esi
cmp eax, dword [esp + 0x28]
jl 0x10061cc6
test ebx, ebx
js 0x10061e18
test edi, edi
je 0x10061e25
mov ecx, edi
call fcn.100250dd
push dword [esp + 0x2c]
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10061e25
test edi, edi
je 0x10061e25
lea ecx, [esp + 0x14]
call fcn.10037062
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062190
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x20c]
mov esi, 0x208
mov dword [ebp - 0x418], ebx
push esi
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x41c], ebx
call fcn.10031469
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x418]
push eax
push 0x20019
push ebx
push 0x10007748
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100622ab
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x10007790
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x420], 2
mov esi, eax
jne 0x1006227a
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x20c]
call fcn.1000b82d
test esi, esi
jne 0x100622ab
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x10062287
sub esi, ecx
sar esi, 1
je 0x100622ab
lea eax, [ebp - 0x20c]
mov edx, 0x104
push eax
mov ecx, edi
call fcn.1000b82d
cmp dword [ebp - 0x418], 0
pop edi
pop esi
pop ebx
je 0x100622c3
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10063130
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x1c
push 0x40
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1006319e
mov eax, dword [ebp - 4]
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
lea eax, [ebp - 8]
push eax
push ecx
push esi
push 0x10063090
push ecx
push ecx
mov dword [ebp - 8], ecx
mov dword [esi], ebx
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1006319e
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100631b7
push 0x30
mov edx, 0x10c3
mov ecx, ebx
call fcn.10060325
test esi, esi
je 0x100631b7
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1006425f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [0x1008b1e4]
push edi
mov edi, edx
push dword [edi + 4]
movzx eax, word [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10064302
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10064301
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x100642fa
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov dword [ebp - 8], eax
test eax, eax
je 0x100642fa
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x100642ed
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [esi], 0x10001fd0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x100642ef
xor esi, esi
lea ecx, [ebp - 8]
mov dword [edi + 0x18], esi
call fcn.1000b34b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov eax, dword [edi + 0x18]
neg eax
pop edi
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10068e65
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, edx
mov dword [ebp - 8], ecx
push 0x4c
pop ecx
xor edx, edx
mov dword [ebp - 0x10], edi
mov eax, edi
div ecx
add eax, 2
lea eax, [edi + eax*2]
imul eax, eax, 6
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x10068f9d
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
push esi
mov esi, ebx
test edi, edi
je 0x10068f5f
mov eax, dword [ebp - 8]
add eax, 2
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [edi - 1]
push 3
pop ecx
div ecx
mov edi, dword [ebp - 0xc]
inc eax
imul ecx, eax, 3
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], ecx
xor edx, edx
mov eax, ebx
push 0x12
pop ecx
div ecx
inc ebx
test edx, edx
jne 0x10068eef
mov word [esi], 0xa0d
mov dword [esi + 2], 0x20202020
add esi, 6
movzx eax, byte [edi - 2]
shr eax, 2
mov al, byte [eax + 0x10007f50]
mov byte [esi], al
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
mov al, byte [ecx + 0x10007f50]
mov byte [esi + 1], al
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
mov al, byte [ecx + 0x10007f50]
mov byte [esi + 2], al
movzx eax, byte [edi]
add edi, 3
and eax, 0x3f
mov al, byte [eax + 0x10007f50]
mov byte [esi + 3], al
add esi, 4
sub dword [ebp - 8], 1
jne 0x10068ed2
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
lea eax, [edi + 1]
cmp ecx, eax
jne 0x10068f6c
mov byte [esi - 1], 0x3d
jmp 0x10068f79
lea eax, [edi + 2]
cmp ecx, eax
jne 0x10068f79
mov word [esi - 2], 0x3d3d
lea eax, [edx - 1]
xor edx, edx
push 0x12
pop ecx
div ecx
xor eax, eax
test edx, edx
setne al
inc eax
mov word [esi], 0xa0d
lea esi, [esi + 2]
sub eax, 1
jne 0x10068f8b
mov byte [esi], al
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006bdee
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0xc], edx
xor esi, esi
mov dword [ebp - 4], eax
mov ebx, esi
push edi
mov edi, esi
test eax, eax
jne 0x1006be13
test edx, edx
je 0x1006beec
test edx, edx
je 0x1006be64
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006be1f
sub ecx, dword [ebp - 8]
je 0x1006be61
mov ecx, edx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006be30
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x40
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1006beec
push dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.1001e7f8
jmp 0x1006bed9
mov eax, dword [ebp - 4]
test eax, eax
je 0x1006bed9
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1006be6d
sub ecx, edx
sar ecx, 1
je 0x1006bed9
push esi
push 0x8000000
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1006bee1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esi
test eax, eax
je 0x1006bee1
cmp eax, 0xffffffff
je 0x1006bee1
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1006bee1
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006bee1
mov eax, dword [ebp + 8]
xor esi, esi
inc esi
mov dword [eax], ebx
test edi, edi
je 0x1006beec
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1006d268
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 2
xor eax, eax
mov word [ebp - 4], ax
pop ebx
mov dword [ebp - 8], ebx
test ecx, ecx
je 0x1006d2c8
mov edx, ecx
xor esi, esi
push edi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, ebx
cmp ax, si
jne 0x1006d28a
sub edx, edi
sar edx, 1
pop edi
je 0x1006d2c8
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push esi
push ebx
push eax
push 0x10008050
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x1006d2c8
cmp eax, 0xea
jne 0x1006d2cb
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006dc5f
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x414]
mov ebx, 0x208
mov esi, edx
push ebx
push 0
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
push ebx
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
test esi, esi
je 0x1006dcea
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1006dcbb
sub ecx, edx
sar ecx, 1
je 0x1006dcea
push esi
mov edx, 0x104
lea ecx, [ebp - 0x414]
call fcn.1000b82d
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1006dd06
mov eax, 0x80004005
jmp 0x1006dda8
lea eax, [ebp - 0x61c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1006dd26
call fcn.1000df00
jmp 0x1006dda8
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x10008030
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1006dd1c
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1006dcfc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1006dcfc
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [edi]
add eax, eax
push eax
push ebx
push dword [edi + 4]
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [edi], ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.100115f7
test eax, eax
js 0x1006dda8
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 4
Function at 0x1007207b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
xor esi, esi
mov dword [ebp - 0x2c], ecx
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0x100000
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x100720ca
call fcn.1000df00
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100720d2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov ebx, 0x60000000
push eax
push ebx
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov esi, eax
test esi, esi
js 0x1007215e
mov ecx, dword [ebp - 8]
and ecx, ebx
cmp ecx, ebx
jne 0x10072159
push 7
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
lea edi, [ebp - 0x24]
pop ecx
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x38], 0x100082ec
mov dword [ebp - 0x28], 1
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x40], 0x100004
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1007215e
call fcn.1000df00
mov esi, eax
jmp 0x1007215e
mov esi, 0x8000ffff
cmp dword [ebp - 4], 0
je 0x1007216d
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100725ee
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push esi
push edi
push 0x10072550
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10072622
call fcn.1000df00
push edi
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10072643
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10075a57
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x238]
push 0x20a
push eax
call fcn.100102ed
mov eax, dword [edi]
xor esi, esi
add eax, eax
mov dword [ebp - 0x22c], esi
push eax
push esi
push dword [edi + 4]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x220], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [edi], esi
lea eax, [ebp - 0x224]
lea ecx, [ebp - 0x238]
push eax
lea eax, [ebp - 0x228]
push eax
push edi
call fcn.100712f1
mov esi, eax
test esi, esi
js 0x10075bca
mov eax, dword [ebp - 0x228]
add eax, eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x224]
push 0
push 0x10000002
push ebx
push 0x100083f4
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov esi, 0x80070002
cmp eax, esi
je 0x10075bca
test eax, eax
je 0x10075bad
cmp eax, 0xea
je 0x10075b45
test eax, eax
jg 0x10075b37
mov esi, eax
jmp 0x10075bca
movzx esi, ax
or esi, 0x80070000
jmp 0x10075bca
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x224]
shr eax, 1
inc eax
push ecx
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
call fcn.1007133e
mov esi, eax
test esi, esi
js 0x10075bca
mov eax, dword [ebp - 0x228]
add eax, eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x224]
push 0
push 0x10000002
push ebx
push 0x100083f4
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov esi, eax
test esi, esi
je 0x10075bad
jle 0x10075bca
movzx esi, si
jmp 0x10075b3a
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.1007120d
mov esi, eax
test esi, esi
js 0x10075bca
xor esi, esi
and dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x238]
call fcn.1000deab
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 0xc