joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101fd3d
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x106570f
push ebx
push esi
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp dword [ebp - 4], edi
ja 0x101fdd1
cmp eax, 0xffffffff
je 0x101fdd1
mov esi, dword [ebp + 0xc]
push esi
push eax
call fcn.0101b551
cmp eax, edi
mov dword [ebp + 8], eax
jl 0x101fdbe
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebx]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10656f8
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebx]
jne 0x10656e2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp + 8]
pop edi
leave
ret 0xc
mov dword [ebp + 8], 0x800703ee
jmp 0x101fdbe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], edi
mov dword [ebp + 8], 0x80004005
jmp 0x101fdbe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], edi
call fcn.0101d802
mov dword [ebp + 8], eax
jmp 0x101fdbe
call fcn.0101d802
mov dword [ebp + 8], eax
jmp 0x101fdc9
Function at 0x10227e9
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc84
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x10228bc
call sub.SHELL32.dll_SHGetFolderPathEx
test eax, eax
jne 0x10228a5
push edi
push 0x20
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x10228a4
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.010065a0
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0xa2c]
push eax
call fcn.010065a0
lea ecx, [ebp - 0x20c]
mov eax, edi
sub eax, ecx
sar eax, 1
push 0x10228b4
mov ecx, esi
sub ecx, eax
push ecx
push edi
call fcn.010065a0
lea eax, [ebp - 0xc7c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc84], eax
cmp eax, 0xffffffff
jne 0x10545d1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret
mov edi, 0x410
push ebx
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.010065a0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0xc50]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0101237f
mov eax, dword [ebp - 0xc7c]
and eax, edi
xor ebx, ebx
cmp eax, edi
jne 0x1054681
lea eax, [ebp - 0xc80]
push eax
push 0x1023c88
lea eax, [ebp - 0x414]
push eax
push 0x1054724
call fcn.0107c695
test eax, eax
jl 0x1054681
mov eax, dword [ebp - 0xc80]
mov ecx, dword [eax]
push ebx
push ebx
push esi
lea edx, [ebp - 0x824]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1054675
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x1054675
inc ebx
mov eax, dword [ebp - 0xc80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test byte [ebp - 0xc7c], 0x10
je 0x10546a2
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10546d3
test ebx, ebx
jne 0x10546d3
push 0x1054700
push 5
lea eax, [ebp - 0x414]
push eax
push 0x10709af
push 0x14
push dword [0x10b00b4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_292]
cmp eax, 5
je 0x10546ee
lea eax, [ebp - 0xc7c]
push eax
push dword [ebp - 0xc84]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10545d7
push dword [ebp - 0xc84]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
jmp 0x10228a4
Function at 0x1023d7d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40000044
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHRestricted]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 2
push 0x1024058
push 0x100f4a0
push 0x80000001
mov dword [ebp - 0x94], 0x86
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1023de6
xor eax, eax
mov word [ebp - 0x8c], ax
mov ebx, 0x1f4
mov esi, 0x1023e4c
test byte [esi], 8
je 0x1023dfe
cmp dword [ebp - 0x90], 0
jne 0x1023e2b
movzx eax, word [esi - 4]
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrIW]
test eax, eax
jne 0x1023e2b
movzx eax, word [esi - 4]
push eax
mov eax, dword [esi]
or eax, 0x4000
push eax
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_RegisterHotKey]
add esi, 8
inc ebx
cmp esi, 0x102405c
jl 0x1023df0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret

Function at 0x1024558
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, ecx
push esi
push 0x1024587
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x10519ae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret
mov dword [esi + 0x1c], edi
pop edi
mov ecx, esi
pop esi
jmp fcn.0102459f
Function at 0x1025505
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push 0x40000047
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x20c], esi
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1025633
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1025633
push ebx
lea eax, [ebp - 0x208]
push eax
xor ebx, ebx
inc ebx
push ebx
push esi
push 0x10256d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025632
push edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10256c4
push esi
push dword [ebp - 0x208]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x214], 0x1fe
call esi
mov edi, 0x1023c38
test eax, eax
jne 0x10255ef
cmp dword [ebp - 0x210], ebx
jne 0x10255ef
mov ebx, 0x1025650
push ebx
push edi
call fcn.0102573f
push dword [ebp - 0x218]
lea eax, [ebp - 0x204]
push 7
push eax
call fcn.010263d4
test eax, eax
jne 0x105a5e9
push ebx
push 0x1023c48
call fcn.0102573f
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1025648
push 0
push dword [ebp - 0x208]
mov dword [ebp - 0x214], 0x1fe
call esi
test eax, eax
je 0x105a5f8
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20c]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret 4
mov dword [ebp - 0x20c], 1
jmp 0x10255e1
cmp dword [ebp - 0x210], ebx
jne 0x1025625
mov esi, 0x105a640
push esi
push edi
call fcn.0102573f
push dword [ebp - 0x218]
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.010263d4
test eax, eax
je 0x105a62d
mov dword [ebp - 0x20c], ebx
push esi
push 0x1023c48
call fcn.0102573f
jmp 0x1025625

Function at 0x102593c
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
cmp dword [esi + 0x18], eax
jne 0x105193d
xor edi, edi
inc edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp dword [esi + 0x1c], eax
je 0x1025951
mov ebx, dword [ebp + 8]
cmp dword [esi + 0x20], eax
jne 0x1051969
lea eax, [esi + 0x24]
push eax
push ebx
call fcn.01069ce3
mov edi, eax
test edi, edi
jl 0x1025954
mov dword [esi + 0x20], 1
push ebx
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x1051983
call fcn.0101d802
mov edi, eax
jmp 0x1025954
push 0
lea eax, [esi + 0x30]
push eax
push ebx
mov ecx, esi
call fcn.01069d48
mov edi, eax
test edi, edi
jge 0x1025954
push 1
lea eax, [esi + 0x24]
push eax
push ebx
mov ecx, esi
call fcn.01069d48
jmp 0x1025954
Function at 0x1025b2d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push edi
push 4
pop edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
push 0x10
push 0x1025c7c
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x1025b73
mov eax, dword [ebp - 8]
cmp eax, 0x418937
jae 0x1025b73
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0x1025c54
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x1025ba5
mov eax, dword [ebp - 8]
cmp eax, 0x20
je 0x1025b9f
cmp eax, 0x4000
jne 0x1025c07
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x30], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0x1025c34
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x1025bd0
mov eax, dword [ebp - 8]
cmp eax, 2
ja 0x1025bd0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x34], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0x1025c10
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x1025c03
mov eax, dword [ebp - 8]
cmp eax, 8
jae 0x1025c03
cmp eax, 5
ja 0x1025c03
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x38], eax
leave
ret 4
cmp eax, 0x40
jne 0x1025ba5
jmp 0x1025b9f
Function at 0x10263d4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x21c], 0
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1026461
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x1026461
push ebx
push edi
mov edi, 0x1026490
xor ecx, ecx
cmp word [esi], cx
mov ebx, esi
mov dword [ebp - 0x210], ebx
jne 0x1026476
cmp word [ebx], cx
jne 0x1026485
mov dword [ebp - 0x214], 1
cmp word [esi], cx
jne 0x105a539
cmp dword [ebp - 0x214], 0
lea esi, [ebx + 2]
je 0x102642c
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret 0xc
movzx eax, word [ebx]
cmp ax, 0x20
jne 0x105a525
jmp 0x102643b
xor eax, eax
mov word [ebx], ax
jmp 0x102644a
cmp ax, 0x2c
je 0x102643b
inc ebx
inc ebx
cmp word [ebx], cx
jmp 0x1026433
push esi
push 0x1023c58
call fcn.0102573f
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push ecx
push eax
push esi
call fcn.01024708
test eax, eax
jge 0x105a5ab
push 0x105a5dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push 0
push edi
mov ebx, eax
call fcn.01026285
test ebx, ebx
je 0x105a5a0
push esi
push 0x1030
push 0x20c
push 0x203
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x18
mov ebx, dword [ebp - 0x210]
jmp 0x1026453
push esi
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push edi
call fcn.01026285
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x21c], 1
jmp 0x1026453
Function at 0x1029305
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 1
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
push 1
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
push 1
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret

Function at 0x1029360
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
push 0x102942c
push 0x10293c0
push 0x80000002
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x10519e9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret
cmp word [ebp - 0x20c], si
je 0x10293ae
push 0x40
lea eax, [ebp - 0x260]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
inc eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x264]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
mov dword [ebp - 0x264], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10293ae
push dword [ebp - 0x220]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
jmp 0x10293ae
Function at 0x102a3b2
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
cmp dword [ebp + 8], 1
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x1029050
mov esi, 0x80000001
je 0x10563e4
push dword [ebp + 8]
push 0x1029164
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov dword [ebp - 4], eax
test eax, eax
je 0x102a43e
push eax
call dword [sym.imp.SHLWAPI.dll_IStream_Reset]
test eax, eax
jl 0x102a43e
cmp dword [ebp + 8], 0
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
jne 0x1056423
call fcn.0102a44f
test eax, eax
jl 0x1056417
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 8], 0
jne 0x1056448
cmp dword [ebx + 0x30], 0
jne 0x105647f
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 8], 0
je 0x105643c
jmp 0x102a42d
push 8
lea eax, [ebx + 0x20]
push eax
push 0xb
push 0x48
push 0x102917c
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
push 8
lea eax, [ebx + 0x28]
push eax
push 0xb
push 0x48
push 0x10290fc
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
jmp 0x102a3d6
mov dword [ebx + 0x30], 1
jmp 0x102a41a
call fcn.01072390
test eax, eax
jge 0x102a41a
mov dword [ebp - 8], 1
jmp 0x102a41a
mov dword [ebx + 0x30], 1
jmp 0x102a423
lea eax, [ebp + 8]
push eax
push 0x20006
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102a42d
push 0x1029164
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102a42d
cmp dword [ebp + 0x14], 0
je 0x105648f
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.010720a9
and dword [ebx + 0x30], 0
jmp 0x102a437

Function at 0x102c8b9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push ebx
push 0x1029144
push 0x1029050
push 0x80000001
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x102c948
push edi
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_IStream_Read]
test eax, eax
jl 0x102c941
cmp dword [ebp - 0x18], 0x14
jne 0x102c941
mov edi, dword [ebp - 4]
push dword [ebp - 0x14]
mov ecx, edi
call fcn.01029b32
test eax, eax
je 0x102c941
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x102c941
cmp dword [ebp - 0xc], ebx
jbe 0x102c941
mov eax, dword [ebp - 8]
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push eax
push esi
call dword [ecx + 0x14]
test eax, eax
jne 0x102c941
push esi
call dword [fcn.0102c95c]
mov dword [edi + 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ecx + 0x10], ebx
pop esi
setne al
pop ebx
leave
ret 4
Function at 0x102ca81
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10b00dc], 0
jne 0x102cad5
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102cae4
push dword [0x10b116c]
mov dword [0x10b00dc], 1
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102cad5
cmp dword [ebp - 8], 4
jne 0x102cad5
cmp dword [ebp - 0xc], eax
je 0x1051a61
xor eax, eax
cmp dword [0x10b00dc], 1
sete al
leave
ret
mov dword [0x10b00dc], 2
jmp 0x102cad5

Function at 0x102cc1a
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x102cc64
push 0x102cc80
push 0x80000001
mov dword [ebp - 8], 2
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1051a7e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp word [ebp - 4], ax
jne 0x1051a7e
leave
ret
push esi
push 0x1065ac8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1051aa9
push 0x1051ab0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1051aa2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
jmp 0x102cc5f

Function at 0x102ce8d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov edx, eax
test edx, edx
je 0x102cebe
cmp word [edx], 0
jne 0x1051ea4
call fcn.010295c5
test eax, eax
je 0x1051ee7
call fcn.01029441
test eax, eax
jne 0x102cef0
call fcn.0102cefc
test eax, eax
jne 0x102cef0
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret
push 5
jmp 0x1051ee9
push 2
pop ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push edx
call fcn.0106a2af
test eax, eax
je 0x102cee0
push esi
push 4
pop ecx
mov edi, 0x100ef44
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop esi
je 0x1051ed9
push 4
pop ebx
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x102cee0
push 2
pop ebx
jmp 0x102cee0
Function at 0x102cfa5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x102cff0
mov edi, 0x100f4a0
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, 2
je 0x1051f8f
cmp eax, 3
je 0x1051f8f
pop edi
pop esi
pop ebx
leave
ret
call fcn.01013129
test eax, eax
je 0x105200d
push 0x220
push 0
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
push 0x225
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
push 0x227
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
push 0x22c
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
and dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.0102efc5
test eax, eax
jne 0x1052011
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc ecx
test eax, eax
je 0x1051fff
cmp eax, ecx
je 0x1051fff
cmp eax, 0x10
je 0x1051fff
cmp eax, 0x11
jne 0x1052011
mov dword [ebp - 4], ecx
jmp 0x1052011
mov dword [ebp - 4], 1
jmp 0x1052011
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102cff0
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 4], 0
je 0x102cfe9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1043b20
push edi
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 2
pop ecx
cmp eax, ecx
je 0x1052058
cmp eax, 3
jne 0x102cfe9
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1043b20
push edi
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x102cfe9
Function at 0x102d011
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
push ebx
push 0x102d1d4
push 0x102d180
mov esi, 0x80000001
push esi
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], 0x14
call edi
test eax, eax
jne 0x102d073
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov dword [ebp - 0x234], eax
push 0xc
pop eax
push ebx
lea ecx, [ebp - 0x230]
push ecx
push eax
push 0x42
mov dword [ebp - 0x230], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x102d105
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x102d1e0
mov ebx, 0x102d118
push ebx
push esi
mov dword [ebp - 0x224], 0x208
call edi
test eax, eax
je 0x1052083
test byte [ebp - 0x22c], 1
mov dword [ebp - 0x224], 0x208
jne 0x1052095
xor eax, eax
mov word [ebp - 0x220], ax
cmp word [ebp - 0x220], 0
jne 0x1052133
mov eax, dword [ebp - 0x22c]
mov ecx, eax
xor ecx, dword [ebp - 0x234]
test cl, 1
jne 0x105216b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret
cmp word [ebp - 0x220], ax
je 0x102d0c0
jmp 0x1052133
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x1052224
push 0x102cc80
push esi
call edi
test eax, eax
jne 0x102d0d7
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpICW]
push 0x1052200
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d0d7
push 0x10521dc
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d0d7
push 0x10521b8
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d0d7
push 0x1052194
lea eax, [ebp - 0x220]
push eax
call edi
test eax, eax
je 0x102d0d7
push 0x10521b8
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.010065a0
jmp 0x102d0e0
or dword [ebp - 0x22c], 1
lea eax, [ebp - 0x220]
push 3
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push eax
push 0xc
push 0x43
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x102d1e0
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x102d105
xor eax, 1
or eax, 0x1000
push 2
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x230]
push eax
push 0xc
push 0x43
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x102d105