joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e960
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7d4a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1011449c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10004570
mov ecx, eax
test ecx, ecx
je 0x1005eb24
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10004570
mov ecx, eax
test ecx, ecx
je 0x1005eb2e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10004570
mov ecx, eax
test ecx, ecx
je 0x1005eb38
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1005ea42
xor ecx, ecx
jmp 0x1005ea60
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005ea50
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.100046c0
push edi
mov ecx, ebx
call fcn.10009590
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1005ea7c
xor ecx, ecx
jmp 0x1005ea94
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005ea84
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.100046c0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1005f2b0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10009590
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005ead5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1005eb0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005eb0e
cmp dword [esi + 0x10], 0
je 0x1005eb05
push dword [edi]
call fcn.100b5756
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10004100
push 0x80004005
call fcn.10004100
push 0x80004005
call fcn.10004100
int3
Function at 0x1005f0b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7e38
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005f284
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005f105
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1005f284
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005f123
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1005f284
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005f141
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1005f284
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005f15f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1005f284
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005f284
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1005f184
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1005f1b7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1005f1cf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1005f20d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.100110c0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100a6a60
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100ea7c4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1005fff0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005f23b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1005f274
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1005f274
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10008430
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10008e10
lea ecx, [ebp - 0x28]
call fcn.10008e10
lea ecx, [ebp - 0x34]
call fcn.10009120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret 4
Function at 0x1005fbb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7fd7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1005fbfa
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005fc06
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10011460
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x1005fc73
push 0x48
call fcn.100806a5
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1005fc67
push 0x48
push 0
push ebx
call fcn.100a6fe0
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.1005e960
jmp 0x1005fc69
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005fca0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10011460
push 3
push 0x100ea7c4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.100112e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005fcef
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1005fd3e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1005fd3e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10011460
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10008e10
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1005fd74
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005fd6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005fdb1
push edx
push ecx
call fcn.10080302
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x1005fd93
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret 0x14
call fcn.100aae05
int3
Function at 0x10066f20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8e78
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push 0x1a
push eax
call fcn.10067860
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x10066f87
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10067005
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov ecx, esi
push 1
push eax
call fcn.10067860
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x10066fcb
mov ecx, eax
call fcn.10008e10
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x10067005
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10066ffb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006710d
push edx
push ecx
call fcn.10080302
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x10067030
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x100de924
mov word [edi], ax
call fcn.10011460
jmp 0x100670e6
call fcn.10004570
mov ecx, eax
test ecx, ecx
je 0x10067112
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10003e80
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.1001ecc0
mov edx, dword [ebp - 0x48]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10067097
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100670b2
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.10011460
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100670e6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.10008e10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret 8
call fcn.100aae05
push 0x80004005
call fcn.10004100
int3
Function at 0x10069ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d72a2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x1006a000
test eax, eax
je 0x1006a000
test ebx, ebx
je 0x1006a000
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10069fef
cmp dword [ebp - 0x818], eax
je 0x1006a000
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.100a6fe0
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10069fef
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10069fd1
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10011460
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x1006a000
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1006bcc0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9650
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1011449c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x1006be09
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1006be09
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1006be09
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1006be09
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push 0x80000000
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x1006bdf5
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1006bdee
cmp dword [ebp - 0x1c], ebx
jne 0x1006bdee
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x1006bd8d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x1006bd87
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x1006bd99
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.10006770
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.1005ae69
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x1006bdee
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006cb40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d96bb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100a6fe0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi]
push 0x104
push eax
push dword [edi]
mov eax, dword [ebp - 0x21c]
push dword [ebx]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.10004570
mov ecx, eax
test ecx, ecx
je 0x1006cc3e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x220]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.10004280
test al, al
jne 0x1006cc20
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006cc02
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.100046c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10004100
int3
Function at 0x1006d5f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d987a
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0
cmp dword [esi + 0x200b4], 0
mov dword [ebp - 4], 2
jne 0x1006d65c
push 0
push 0
push esi
push 0x1006fae0
push 0
push 0
call fcn.100aab67
add esp, 0x18
mov dword [esi + 0x200b4], eax
push 0x14
call fcn.100806a5
mov edi, eax
add esp, 4
mov dword [ebp - 0x3c], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x1006d691
push dword [ebp - 0x40]
lea eax, [ebp + 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10008180
push edi
mov ecx, esi
call fcn.1006d9a0
mov dword [ebp - 0x40], eax
jmp 0x1006d698
mov dword [ebp - 0x40], 0
push 0xc
mov byte [ebp - 4], 2
call fcn.100806a5
add esp, 4
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1006d6bc
mov ecx, eax
call fcn.1006edb0
mov edi, eax
jmp 0x1006d6be
xor edi, edi
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100749e0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x88], 0x1006d2f0
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp + 0x38]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x1006d707
mov eax, dword [ecx]
lea edx, [ebp - 0x78]
push edx
call dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 7
push eax
call fcn.1006ddf0
mov ecx, dword [ebp - 0x54]
add esp, 4
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x1006d74d
mov edx, dword [ecx]
lea eax, [ebp - 0x78]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x54], 0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 8
push eax
lea ecx, [esi + 0x2008c]
call fcn.10074e10
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1006d778
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x1006d797
mov edx, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp + 0x38], 0
mov edx, dword [ebp + 0x50]
cmp edx, 0x10
jb 0x1006d7c7
mov ecx, dword [ebp + 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1006d7bd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006d7e7
push edx
push ecx
call fcn.10080302
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret 0x50
call fcn.100aae05
int3
Function at 0x1006f560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x2c], 0x4f0053
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov dword [ebp - 0x20], 0x450052
mov dword [ebp - 0x1c], 0x43005c
mov dword [ebp - 0x18], 0x6d006f
mov dword [ebp - 0x14], 0x61004d
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x720065
call fcn.100a6fe0
lea eax, [ebp - 0x234]
push eax
push str.c_identity
lea eax, [ebp - 0x2c]
push eax
push 0x80000002
call fcn.10086090
add esp, 0x1c
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0x234]
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006f610
sub ecx, edx
lea eax, [ebp - 0x234]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10011460
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10080681
mov esp, ebp
pop ebp
ret 4
Function at 0x10070030
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9e12
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1011449c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x424], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x428], 0x104
call fcn.100a6fe0
add esp, 0xc
mov dword [ebp - 0x42c], 1
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x42c]
push eax
push str.local_m2
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1007010e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100700f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10011460
cmp dword [esi + 0x10], 0
jne 0x1007018a
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100a6fe0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.1008ac20
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10070144
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10011460
cmp dword [esi + 0x14], 8
mov eax, esi
mov ecx, dword [esi + 0x10]
jb 0x1007016f
mov eax, dword [esi]
add ecx, ecx
push ecx
push eax
push 1
push str.local_m2
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080681
mov esp, ebp
pop ebp
ret