joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009d30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x248], 0xffffffff
mov byte [ebp - 0x231], 1
cmp dword [ebp + 8], 0
jne 0x10009d61
xor al, al
jmp 0x10009ec7
mov dword [ebp - 0x25c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x10009ea6
mov edx, dword [ebp + 8]
mov dword [ebp - 0x23c], edx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dx, word [ecx]
mov word [ebp - 0x23e], dx
mov eax, dword [ebp - 0x23c]
cmp dx, word [eax]
jne 0x10009e27
cmp word [ebp - 0x23e], 0
je 0x10009e1b
mov ecx, dword [ebp - 0x238]
mov dx, word [ecx + 2]
mov word [ebp - 0x240], dx
mov eax, dword [ebp - 0x23c]
cmp dx, word [eax + 2]
jne 0x10009e27
add dword [ebp - 0x238], 4
add dword [ebp - 0x23c], 4
cmp word [ebp - 0x240], 0
jne 0x10009dc1
mov dword [ebp - 0x24c], 0
jmp 0x10009e32
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x254], edx
cmp dword [ebp - 0x254], 0
jne 0x10009e87
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x248]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x258], eax
push 1
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x10009e87
mov byte [ebp - 0x231], 0
jmp 0x10009ea6
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x250], eax
jmp 0x10009d9f
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [ebp - 0x248], 0xffffffff
jne 0x10009ec1
xor al, al
jmp 0x10009ec7
mov al, byte [ebp - 0x231]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x1000a000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.100109e0
add esp, 0xc
mov dword [ebp - 0x38], 3
lea ecx, [ebp - 0x1c]
call fcn.1000b9d0
mov dword [ebp - 0x34], eax
mov eax, 0x614
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x1000a074
mov dword [ebp - 0x44], 1
jmp 0x1000a07b
mov dword [ebp - 0x44], 0
mov dl, byte [ebp - 0x44]
mov byte [ebp - 0x3d], dl
lea ecx, [ebp - 0x1c]
call fcn.1000bb50
movzx eax, byte [ebp - 0x3d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x10013be0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
xor eax, eax
jne 0x10013be9
cmp dword [ebp + 0xc], 0
je 0x10013bfc
mov dword [ebp - 0xc], 1
jmp 0x10013c03
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x10013c16
mov eax, 0xd
jmp 0x10013c6b
xor edx, edx
jne 0x10013bed
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x10013c29
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10014b10
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x40000001
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x10014b63
push 0
mov ecx, dword [ebp + 8]
call fcn.10015a40
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
jmp 0x10014be1
push 4
lea ecx, [ebp - 8]
call fcn.100075e0
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10015ac0
add esp, 8
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.10005be0
push eax
push 0x40000001
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x10014bc1
push 0
mov ecx, dword [ebp + 8]
call fcn.10015a40
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 8]
call fcn.10015790
mov eax, dword [ebp + 8]
jmp 0x10014be1
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10015a70
mov edx, dword [ebp - 0x10]
or edx, 1
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 8]
call fcn.10015790
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x10014bf0
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b159e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0x10
mov dword [ebp - 0x34], 4
push 4
mov ecx, dword [ebp + 8]
call fcn.100075e0
mov ecx, dword [ebp + 8]
call fcn.10015b40
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
push 0
push 0
push 0x100d1034
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jl 0x10014d26
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
jl 0x10014d19
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jl 0x10014d0e
push 4
lea ecx, [ebp - 0x24]
push ecx
call fcn.10015b70
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp + 8]
call fcn.10015bf0
lea ecx, [ebp - 0x24]
call fcn.10015790
nop
mov ecx, dword [ebp + 8]
call fcn.10005be0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0
push 0x10
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
jge 0x10014d0e
push 0
mov ecx, dword [ebp + 8]
call fcn.10015820
nop
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
nop
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x1001cac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x1001caea
jl 0x1001cae1
cmp dword [ebp + 0xc], 0
ja 0x1001caea
xor eax, eax
xor edx, edx
jmp 0x1001cc2c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x1001cb0c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1000afe0
jmp 0x1001cc2c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.1000d2c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x1001cb7c
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10005440
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1000d420
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10004c90
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.1000d3a0
nop
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x1001cc1d
mov ecx, dword [ebp - 0x10]
call fcn.1001dbe0
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x1001cbec
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10094fb7
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x1001cbea
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1001cc2c
jmp 0x1001cb98
cmp dword [ebp - 8], 0
jbe 0x1001cc1d
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10094fb7
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001ef50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b207d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.100075e0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.1001f140
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x1001f1a0
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.10005be0
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.100944c2
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x1001efdd
lea ecx, [ebp - 0x14]
call fcn.1001f020
nop
jmp 0x1001efef
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.1008937a
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1001f050
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f3b0
Capabilities:
Accept command line arguments
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b20f5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100e30c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
movzx eax, byte [0x100e6c64]
test eax, eax
jne 0x1001f41f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x14], eax
push str.__enable_debug_log
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1001f390
add esp, 8
test eax, eax
je 0x1001f40b
mov byte [ebp - 0xd], 1
jmp 0x1001f40f
mov byte [ebp - 0xd], 0
mov dl, byte [ebp - 0xd]
mov byte [0x100e6c65], dl
mov byte [0x100e6c64], 1
movzx eax, byte [0x100e6c65]
test eax, eax
je 0x1001f47f
push str._GInstaller_
lea ecx, [ebp - 0x50]
call fcn.1000bbd0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 1
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x38]
push ecx
call fcn.10010560
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.1000b9d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x38]
call fcn.1000bb50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.1000bb50
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000bb50
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001f550
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b212d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100e30c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x100d4aad
mov ecx, dword [ebp - 0x14]
call fcn.10004790
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov dword [ebp - 0x18], ecx
push 0x100d4aad
mov ecx, dword [ebp - 0x18]
call fcn.10004790
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001f9c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x22c], 0xffffffff
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001fbf0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1001fa4d
mov dword [ebp - 0x210], 0x64
mov dword [ebp - 0x228], 0
jmp 0x1001fa68
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [ebp - 0x210]
jae 0x1001fbf0
mov dword [ebp - 0x220], 0
push 0x104
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.1008b830
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0x104
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1008b830
add esp, 0xc
mov ecx, dword [ebp - 0x228]
push ecx
push str._04u
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.10020c70
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001fb19
jmp 0x1001fa59
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push str.NetCfgInstanceId
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001fb59
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1001fa59
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.100045f0
push eax
call fcn.1009550a
add esp, 8
test eax, eax
je 0x1001fb88
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1001fa59
mov dword [ebp - 0x214], 4
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push str.Characteristics
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001fbdd
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1001fbf0
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1001fa59
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x10021390
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b212d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100e30c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.1000c060
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1000c060
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
mov dword [ecx + 0x38], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10024610
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10021cf0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.10021d80
call fcn.10021cf0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.10021dc0
nop
cmp dword [ebp + 0x18], 0
je 0x1002466e
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x20], eax
push 0x100233e0
call fcn.10021cf0
mov ecx, eax
call fcn.10005bf0
push eax
call dword [ebp - 0x20]
nop
mov ecx, dword [ebp + 0xc]
mov dword [0x100e6c9c], ecx
mov edx, dword [ebp + 0x14]
mov dword [0x100e6ca0], edx
mov eax, dword [ebp + 0x10]
mov dword [0x100e6c98], eax
xor ecx, ecx
jne 0x10024620
lea edx, [ebp - 0xc]
push edx
call fcn.10023190
add esp, 4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xc]
call fcn.10025be0
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.10025c40
add esp, 8
mov ecx, eax
call fcn.10025bc0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.10005990
add esp, 0xc
mov ecx, eax
call fcn.1000b9d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x48]
call fcn.1000bb50
nop
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.10005990
add esp, 0xc
mov ecx, eax
call fcn.1000b9d0
push eax
call fcn.10023250
lea ecx, [ebp - 0x60]
call fcn.1000bb50
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x100256d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10021cf0
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x808]
call fcn.10021d80
call fcn.10021cf0
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x80c]
call fcn.10021dc0
nop
cmp dword [ebp + 0x18], 0
je 0x10025743
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x810], eax
push 0x100233e0
call fcn.10021cf0
mov ecx, eax
call fcn.10005bf0
push eax
call dword [ebp - 0x810]
nop
mov ecx, dword [ebp + 0xc]
mov dword [0x100e6c9c], ecx
mov edx, dword [ebp + 0x14]
mov dword [0x100e6ca0], edx
mov eax, dword [ebp + 0x10]
mov dword [0x100e6c98], eax
xor ecx, ecx
jne 0x100256e3
push 0x800
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.1008b830
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
call fcn.100231c0
nop
call fcn.100068f0
movzx ecx, al
test ecx, ecx
je 0x100257d4
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x814], esp
lea edx, [ebp - 0x804]
push edx
call fcn.1000bbd0
call fcn.10021780
add esp, 0x1c
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x818], esp
lea eax, [ebp - 0x804]
push eax
call fcn.1000bbd0
call fcn.10021780
add esp, 0x1c
jmp 0x10025809
push 0
push 0
push 0
lea ecx, [ebp - 0x804]
push ecx
push str.taskbarunpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0
lea edx, [ebp - 0x804]
push edx
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret
Function at 0x100258a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.10021cf0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 8]
call fcn.10021d80
call fcn.10021cf0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.10021dc0
nop
cmp dword [ebp + 0x18], 0
je 0x100258f4
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
push 0x100233e0
call fcn.10021cf0
mov ecx, eax
call fcn.10005bf0
push eax
call dword [ebp - 0x10]
nop
mov ecx, dword [ebp + 0xc]
mov dword [0x100e6c9c], ecx
mov edx, dword [ebp + 0x14]
mov dword [0x100e6ca0], edx
mov eax, dword [ebp + 0x10]
mov dword [0x100e6c98], eax
xor ecx, ecx
jne 0x100258a6
call fcn.100232b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
je 0x10025992
push str.GlobalGCMainWnd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10025945
cmp dword [ebp - 0x18], 0
jne 0x10025992
push str.GCMainWnd
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10025988
push 0
push 0xf020
push 0x112
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xf120
push 0x112
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
nop
push 1
call fcn.10023310
nop
jmp 0x1002599a
push 0
call fcn.10023310
nop
mov esp, ebp
pop ebp
ret

Function at 0x10025e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b265d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.100075e0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10026260
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x100262c0
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.10005be0
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.100944c2
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x10025efd
lea ecx, [ebp - 0x14]
call fcn.1001f020
nop
jmp 0x10025f0f
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.1008937a
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10026220
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
ret 4