joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10aa661
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test byte [eax + 0x14], 6
push esi
mov esi, ecx
je 0x10aa6a1
push 0
push dword [eax + 0x10]
push 0x419
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, esi
call fcn.010aa4b2
test al, al
je 0x10aa6a1
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.010a951c
xor eax, eax
inc eax
jmp 0x10aa6a3
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x10aa6ad
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov esi, ecx
push 0x418
push dword [esi + 0x40]
call edi
mov ebx, eax
mov eax, dword [esi + 0xbc]
cmp eax, 0xffffffff
jne 0x10aa6dd
or eax, eax
jmp 0x10aa6ea
push 0
push eax
push 0x419
push dword [esi + 0x40]
call edi
mov byte [ebp - 1], 0
cmp eax, 0xffffffff
jne 0x10aa702
cmp dword [ebp + 8], 1
jne 0x10aa6fd
xor eax, eax
jmp 0x10aa710
lea eax, [ebx - 1]
jmp 0x10aa710
lea ecx, [ebp - 1]
push ecx
push ebx
push eax
push dword [ebp + 8]
call fcn.010a94bf
lea ecx, [ebp - 2]
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
mov byte [ebp - 2], 0
call fcn.010aa530
dec ebx
push ebx
mov ecx, esi
mov edi, eax
call fcn.010aa4b2
test al, al
je 0x10aa74d
cmp byte [ebp - 1], 0
jne 0x10aa74a
cmp byte [ebp - 2], 0
jne 0x10aa74a
push edi
mov ecx, esi
call fcn.010aa4b2
test al, al
je 0x10aa74d
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10aba8f
Capabilities:
Capture webcam image

Disassembly:
push 0x18
mov eax, 0x11b28ee
call fcn.010b13ca
mov esi, ecx
xor eax, eax
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
push edi
push dword [ebx + 0xc]
mov dword [ebp - 4], edi
push 0x419
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, esi
call fcn.010aa4b2
test al, al
jne 0x10abb4b
mov eax, dword [ebx + 0xc]
sub eax, 0x272e
je 0x10abaeb
sub eax, 0x17
je 0x10abae6
sub eax, 0x1a
jne 0x10abaf7
lea eax, [esi + 0x54]
jmp 0x10abaee
lea eax, [esi + 0x5c]
jmp 0x10abaee
lea eax, [esi + 0x4c]
push eax
lea ecx, [ebp - 0x14]
call fcn.010683ac
lea eax, [ebp - 0x14]
push eax
call fcn.01073456
movzx eax, al
neg eax
sbb eax, eax
and eax, dword [fcn.0107a9df]
cmp eax, edi
je 0x10abb4b
mov dword [ebp - 0x24], edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0xc]
push 0x433
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0xc]
push 0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
mov ecx, esi
call fcn.010ab61c
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
push eax
call fcn.01076e36
call fcn.010b14b6
ret 4
Function at 0x10ad934
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10bc
call fcn.010b15f0
mov eax, dword [0x11f2910]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
cmp ecx, 0xfffffffe
je 0x10ad960
cmp ecx, 0xfffffffc
jne 0x10ad9b1
mov ecx, dword [eax]
cmp ecx, dword [esi + 0x124]
jne 0x10ad9b1
add eax, 0xc
push 0x10b8
push eax
lea eax, [ebp - 0x10bc]
push eax
call sub.msvcrt.dll_memcpy
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 0x10b8], ecx
jne 0x10ad9b1
lea eax, [esi + 0x1f4]
cmp dword [eax + 0x18], 8
jb 0x10ad99d
mov eax, dword [eax + 4]
jmp 0x10ad9a0
add eax, 4
push 5
push ecx
push ecx
push eax
push 0x10084a8
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.010b13b5
leave
ret 8
Function at 0x10b11ff
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x11d54b8
call fcn.010b1644
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x12005ac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10b0fba
cmp eax, esi
jne 0x10b0fad
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10b0fbd
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10b0f94
xor esi, esi
inc esi
mov eax, dword [0x12005a8]
cmp eax, esi
jne 0x10b0fd0
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10b0fff
mov eax, dword [0x12005a8]
test eax, eax
jne 0x10b0ff9
mov dword [0x12005a8], esi
push 0x1001d28
push 0x1001d1c
call fcn.010b0ef4
pop ecx
pop ecx
test eax, eax
je 0x10b0fff
jmp 0x10b1123
mov dword [0x11fd0f0], esi
mov eax, dword [0x12005a8]
cmp eax, esi
jne 0x10b1023
push 0x1001d18
push 0x1001a84
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x12005a8], 2
cmp dword [ebp - 0x20], ebx
jne 0x10b1030
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x12005b8], ebx
je 0x10b1051
push 0x12005b8
call fcn.010b1a79
pop ecx
test eax, eax
je 0x10b1051
push ebx
push 2
push ebx
call dword [0x12005b8]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10b1123
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10b10bb
cmp cx, bx
je 0x10b1076
cmp dword [ebp - 0x1c], ebx
jne 0x10b10bb
movzx ecx, word [eax]
cmp cx, bx
je 0x10b108b
cmp cx, 0x20
ja 0x10b108b
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10b1076
test byte [ebp - 0x40], 1
je 0x10b1097
movzx ecx, word [ebp - 0x3c]
jmp 0x10b109a
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x11fd0ec], eax
cmp dword [0x11fd0e0], ebx
jne 0x10b1100
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x10b10cc
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x10b1060
cmp dword [0x11fd0f0], ebx
jne 0x10b110e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x11fd0ec]
jmp 0x10b112f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010b1689
ret
call fcn.010b1bbe
jmp 0x10b0f57
Function at 0x10e6e2a
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0x11fc32c
mov dword [esi], 0x100e8a4
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, esi
pop esi
jmp fcn.010ea63d

Function at 0x10e6e2c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0x11fc32c
mov dword [esi], 0x100e8a4
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, esi
pop esi
jmp fcn.010ea63d

Function at 0x10ea63d
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x11b9545
call fcn.010b13ca
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f148
mov dword [ebp - 4], 3
mov eax, dword [0x11f200c]
mov edi, 0x11f200c
mov ebx, 0x100f130
cmp eax, edi
je 0x10ea683
test byte [eax + 0x5c], 8
je 0x10ea683
push esi
push ebx
push 0xa
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.01034bae
cmp dword [esi + 0x6c], 0
je 0x10ea6ce
cmp dword [esi + 0x70], 8
jb 0x10ea694
mov eax, dword [esi + 0x5c]
jmp 0x10ea697
lea eax, [esi + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10ea6ce
mov eax, dword [0x11f200c]
cmp eax, edi
je 0x10ea6ce
test byte [eax + 0x5c], 1
je 0x10ea6ce
cmp dword [esi + 0x70], 8
jb 0x10ea6bc
mov ecx, dword [esi + 0x5c]
jmp 0x10ea6bf
lea ecx, [esi + 0x5c]
push ecx
push ebx
push 0xb
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.0103ca73
push 0
push 1
lea ecx, [esi + 0x58]
call fcn.010362ea
lea eax, [esi + 0x50]
push eax
call fcn.01076e36
lea eax, [esi + 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.01076e36
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.01076e36
push 0
push 1
lea ecx, [esi + 0x24]
call fcn.010362ea
push 0
push 1
lea ecx, [esi + 8]
call fcn.010362ea
call fcn.010b14b6
ret
Function at 0x10ed2d7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x11f2910]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x444], edi
mov esi, 0x101ed8c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x430]
push eax
push 8
xor ebx, ebx
push ebx
movsd dword es:[edi], dword [esi]
push 0x100f678
push 0x80000002
mov dword [ebp - 0x42c], ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x10ed331
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x428], eax
jl 0x10ed4ba
mov dword [ebp - 0x434], ebx
mov ebx, 0x104
cmp dword [ebp - 0x42c], 5
je 0x10ed47f
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x434]
mov dword [ebp - 0x43c], ebx
push dword [ebp - 0x430]
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
jle 0x10ed38b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x428], eax
test eax, eax
jl 0x10ed46c
mov edi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push 4
pop esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x440]
push eax
push 0
push 0x10
push 0x100f668
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
mov dword [ebp - 0x438], esi
call edi
test eax, eax
jne 0x10ed46c
mov eax, dword [ebp - 0x440]
cmp dword [ebp + 8], eax
jne 0x10ed3e6
push 5
pop esi
jmp 0x10ed406
cmp word [ebp + 8], ax
je 0x10ed406
mov ecx, eax
xor ecx, dword [ebp + 8]
test ecx, 0x3ff
jne 0x10ed3fd
push 3
jmp 0x10ed3e3
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
cmp esi, dword [ebp - 0x42c]
jle 0x10ed46c
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 2
push 0x100f64c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
mov dword [ebp - 0x448], ebx
call edi
test eax, eax
jne 0x10ed46c
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jl 0x10ed46c
mov edi, dword [ebp - 0x444]
mov dword [ebp - 0x42c], esi
lea esi, [ebp - 0x424]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [ebp - 0x434]
cmp dword [ebp - 0x428], 0
jge 0x10ed34a
cmp dword [ebp - 0x428], 0x80070103
jne 0x10ed492
and dword [ebp - 0x428], 0
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x428], 0
jl 0x10ed4ba
cmp dword [ebp - 0x42c], 0
jne 0x10ed4ba
mov dword [ebp - 0x428], 0x8000ffff
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x428]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010b13b5
leave
ret 8
Function at 0x113aa72
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x3c
mov eax, 0x11c047b
call fcn.010b143d
mov edi, ecx
mov eax, dword [edi + 0x48]
cmp eax, dword [ebp + 8]
jne 0x113abd7
xor ebx, ebx
cmp dword [ebp + 0xc], 1
jne 0x113abc2
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.01123689
push 1
lea eax, [ebp - 0x38]
push eax
push dword [edi + 0x48]
push ebx
call fcn.01034bda
lea eax, [ebp - 0x38]
push eax
mov ecx, edi
xor esi, esi
call fcn.01124c2e
dec eax
cmp eax, 8
ja case.default.0x113aac9
jmp dword [eax*4 + 0x113abe2]
mov esi, 0x7f82
jmp case.default.0x113aac9
mov esi, 0x7f85
jmp case.default.0x113aac9
mov esi, 0x7f83
jmp case.default.0x113aac9
mov esi, 0x7f84
jmp case.default.0x113aac9
mov esi, 0x7f86
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
call fcn.010368a4
fldz
fst dword [ebp - 0x3c]
mov dword [ebp - 4], ebx
fst dword [ebp - 0x40]
fst dword [ebp - 0x44]
fstp dword [ebp - 0x48]
cmp esi, ebx
jne 0x113ab5d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x113abb7
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
mov ecx, edi
push dword [ebp - 0x38]
call fcn.0113a1a1
mov dword [ebp - 0x30], eax
dec eax
je 0x113ab58
dec eax
dec eax
je 0x113ab51
mov esi, 0x7f00
jmp 0x113ab5d
mov esi, 0x7f89
jmp 0x113ab5d
mov esi, 0x7f01
push esi
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [ebp - 0x18], ebx
je 0x113aba7
cmp dword [ebp - 0x30], 3
jne 0x113aba7
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x30], esp
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.01067b78
mov ecx, 0x11fcce8
call fcn.01068424
cmp eax, 1
je 0x113aba7
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.01129a42
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.010362ea
xor eax, eax
inc eax
jmp 0x113abd9
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.010362ea
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x113abb2
xor eax, eax
call fcn.010b14cf
ret 0xc
Function at 0x113b51d
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0x11
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [ebp + 8]
setl dl
cmp eax, 0x26
ja 0x113b5e8
je 0x113b62c
cmp eax, 8
je 0x113b5aa
cmp eax, 0x1b
je 0x113b57c
cmp eax, 0x20
jbe 0x113b576
cmp eax, 0x24
jbe 0x113b627
cmp eax, 0x25
jne 0x113b576
push dword [ebp + 0xc]
xor ecx, ecx
cmp eax, 0x25
setne cl
push ecx
mov ecx, edi
call fcn.01135f63
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, dword [0x11fcf08]
test ecx, ecx
je 0x113b5a1
mov eax, dword [0x11fcf0c]
test eax, eax
je 0x113b5a1
call eax
test al, al
je 0x113b5a1
mov ecx, 0x11fcba0
call fcn.01035376
jmp 0x113b576
mov ecx, edi
call fcn.0113ac0b
jmp 0x113b576
test dl, dl
je 0x113b5cb
movzx eax, word [0x11fc904]
mov ecx, dword [0x11fc8f4]
push eax
mov eax, dword [0x11fc8e8]
add ecx, eax
call dword [0x11fc8f0]
jmp 0x113b576
movzx eax, word [0x11fc8e4]
mov ecx, dword [0x11fc8d4]
push eax
mov eax, dword [0x11fc8c8]
add ecx, eax
call dword [0x11fc8d0]
jmp 0x113b576
mov ecx, eax
sub ecx, 0x27
je 0x113b563
dec ecx
je 0x113b627
sub ecx, 5
jne 0x113b576
test dl, dl
je 0x113b576
push ecx
push 0x272a
push 0x111
push dword [edi + 0x48]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x113b576
cmp eax, 0x26
jne 0x113b630
xor esi, esi
jmp 0x113b65a
cmp eax, 0x28
jne 0x113b63a
xor esi, esi
inc esi
jmp 0x113b65a
cmp eax, 0x21
jne 0x113b643
push 2
jmp 0x113b64a
cmp eax, 0x22
jne 0x113b64d
push 3
pop esi
jmp 0x113b65a
xor ecx, ecx
cmp eax, 0x24
setne cl
add ecx, 6
mov esi, ecx
test dl, dl
je 0x113b668
cmp esi, 2
je 0x113b678
cmp esi, 3
je 0x113b69c
push dword [ebp + 0xc]
mov ecx, edi
push esi
call fcn.01135f81
jmp 0x113b576
movzx eax, word [0x11fc924]
mov ecx, dword [0x11fc908]
push eax
mov eax, dword [0x11fc914]
add ecx, eax
call dword [0x11fc910]
cmp esi, 3
jne 0x113b576
movzx eax, word [0x11fc944]
mov ecx, dword [0x11fc934]
push eax
mov eax, dword [0x11fc928]
add ecx, eax
call dword [0x11fc930]
jmp 0x113b576
Function at 0x113e2b2
Capabilities:
Get common file path

Disassembly:
push 0x30
mov eax, 0x11c07f5
call fcn.010b143d
cmp byte [0x11fd835], 0
je 0x113e2cf
xor eax, eax
call fcn.010b14cf
ret
cmp byte [0x11fd834], 0
je 0x113e2df
mov eax, dword [0x11fd83c]
jmp 0x113e2c9
mov eax, dword [0x11f200c]
mov esi, 0x11f200c
mov ebx, 0x1012fe4
cmp eax, esi
je 0x113e309
test dword [eax + 0x5c], 0x10000
je 0x113e309
push ebx
push 0xf
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.01034b88
mov edi, 0x105
push edi
lea ecx, [ebp - 0x3c]
mov byte [0x11fd834], 1
call fcn.0103a945
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp - 0x38]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x113e35b
mov eax, dword [0x11f200c]
cmp eax, esi
je 0x113e34e
test byte [eax + 0x5c], 1
je 0x113e34e
push ebx
push 0x10
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.01034b88
lea ecx, [ebp - 0x3c]
call fcn.0112c1e2
jmp 0x113e2c7
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x113e360
sub eax, edx
sar eax, 1
lea eax, [edi + eax*2]
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.010387d0
push 0x101300c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0104acce
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x113e398
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edi, edi
mov dword [0x11fd838], eax
cmp eax, edi
jne 0x113e3d7
mov eax, dword [0x11f200c]
cmp eax, esi
je 0x113e3c7
test byte [eax + 0x5c], 1
je 0x113e3c7
push ebx
push 0x11
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.01034b88
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.010362ea
jmp 0x113e34e
push 0x1012ffc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x11fd83c], eax
cmp eax, edi
jne 0x113e425
mov eax, dword [0x11f200c]
cmp eax, esi
je 0x113e409
test byte [eax + 0x5c], 1
je 0x113e409
push ebx
push 0x12
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.01034b88
xor esi, esi
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.010362ea
lea ecx, [ebp - 0x3c]
call fcn.0112c1e2
mov eax, esi
jmp 0x113e2c9
call fcn.0113e100
test al, al
jne 0x113e44b
mov dword [0x11fd83c], edi
mov eax, dword [0x11f200c]
cmp eax, esi
je 0x113e46b
test dword [eax + 0x5c], 0x10000
je 0x113e46b
push ebx
push 0x13
jmp 0x113e460
mov eax, dword [0x11f200c]
cmp eax, esi
je 0x113e46b
test dword [eax + 0x5c], 0x10000
je 0x113e46b
push ebx
push 0x14
push dword [eax + 0x54]
push dword [eax + 0x50]
call fcn.01034b88
mov esi, dword [0x11fd83c]
jmp 0x113e40b
Function at 0x11472b2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x11c1bdc
call fcn.010b13ca
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x20
push dword [ebp + 0xc]
mov esi, 0x1004188
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
jne 0x1147358
push dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.0103fe03
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 4], ebx
push ebx
push 0x20
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1147350
mov esi, dword [ebp - 0x1c]
jmp 0x114734b
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x1147312
sub eax, ecx
sar eax, 1
mov edi, eax
push edi
push esi
lea ecx, [ebp - 0x3c]
call fcn.01037773
mov ecx, dword [ebp + 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.01060217
push ebx
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.010362ea
lea esi, [esi + edi*2 + 2]
cmp word [esi], bx
jne 0x114730d
lea ecx, [ebp - 0x20]
call fcn.0112c1e2
call fcn.010b14b6
ret 0xc

Function at 0x11535d5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push esi
xor esi, esi
push edi
mov edi, ecx
test eax, eax
jbe 0x1153615
mov ecx, dword [edi + 4]
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x115361d
add esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp esi, eax
jb 0x11535ee
pop edi
mov eax, esi
pop esi
leave
ret 8
push 0x100545c
call fcn.011565b2
push eax
push 0x45
push 0x1002b6a
push 0x1002b5c
push fcn.011569b2
lea eax, [ebp - 0x64]
push eax
call fcn.01035074
push 0x11c9264
lea eax, [ebp - 0x64]
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1153656
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push esi
xor esi, esi
push edi
mov edi, ecx
test eax, eax
je 0x11536ab
mov ecx, dword [edi + 4]
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1153699
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x11536b1
add esi, dword [ebp - 4]
cmp dword [ebp - 4], 0
jbe 0x11536a9
mov eax, dword [ebp + 8]
cmp esi, eax
jb 0x115366f
mov eax, esi
pop edi
pop esi
leave
ret 8
push 0x100545c
cmp eax, 0x6d
jne 0x11536e8
push 0x80070026
push 0x67
push 0x1002b6a
push 0x1002b5c
push fcn.011569b2
lea eax, [ebp - 0x64]
push eax
call fcn.01035074
push 0x11c9264
lea eax, [ebp - 0x64]
push eax
call sub.msvcrt.dll__CxxThrowException
call fcn.011565b2
push eax
push 0x6a
jmp 0x11536c2
Function at 0x1156922
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x11fdb10
lock bts dword [eax], 0x1e
jb 0x11569a6
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 1
push esi
push 0x1019068
push 0x80000001
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11569a5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x1019040
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x115699c
cmp dword [ebp - 8], 4
jne 0x115699c
cmp dword [ebp - 0xc], 4
jne 0x115699c
mov eax, dword [ebp - 0x10]
or eax, 0x40000000
mov dword [0x11fdb10], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [0x11fdb10]
leave
ret