joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401077
Capabilities:
Print debug messages

Disassembly:
push esi
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
mov esi, section..data
push esi
call dword [sym.imp.USER32.dll_wvsprintfA]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x200010
push str.Loader
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret

Function at 0x401108
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x2e4]
xor edi, edi
push eax
xor ebx, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x401284
cmp eax, esi
jae 0x40128a
cmp word [ebp - 0x2e4], di
lea eax, [ebp - 0x2e4]
je 0x40115a
inc eax
inc eax
cmp word [eax], di
jne 0x401153
lea ecx, [ebp - 0x9e]
push ecx
mov edx, str._version.dll
call fcn.0040103a
push 8
push edi
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
je 0x401284
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoW
push ebx
call esi
cmp eax, edi
mov dword [ebp - 0x1c], eax
je 0x401284
push str.GetFileVersionInfoSizeW
push ebx
call esi
mov edi, eax
test edi, edi
je 0x401284
push str.VerQueryValueW
push ebx
call esi
mov esi, eax
test esi, esi
je 0x401284
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call edi
mov ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x40128a
call fcn.004018bd
test eax, eax
mov dword [ebp - 8], eax
je 0x40128a
push eax
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [ebp - 0x1c]
test eax, eax
je 0x40128a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 8]
call esi
test eax, eax
je 0x40128a
cmp dword [ebp - 4], 4
jb 0x40128a
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x9c]
push str.StringFileInfo_04x_04xArguments
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 8]
call esi
test eax, eax
je 0x40128a
cmp dword [ebp - 0xc], 0
je 0x40128a
mov eax, dword [ebp - 4]
test eax, eax
je 0x40128a
lea ecx, [eax + eax + 2]
call fcn.004018bd
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 4]
and word [esi + eax*2], 0
jmp 0x40128a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
call fcn.004018ce
test ebx, ebx
je 0x40129d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4012a7
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x4012d4
xor eax, eax
jmp 0x401458
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10000
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jae 0x4012f0
dec ecx
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
push edi
push edi
lea esi, [eax - 0x10000]
push 2
push edi
push dword [ebp + 8]
and esi, 0xffff0000
sub eax, esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 4], 0
je 0x401343
push ebx
push esi
push dword [ebp - 8]
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 4]
mov esi, eax
mov dword [ebp + 8], esi
call edi
test esi, esi
jne 0x40134a
xor eax, eax
jmp 0x401456
lea ecx, [esi + ebx]
push 0x7c
lea eax, [ecx - 2]
pop edx
xor ebx, ebx
cmp byte [eax], dl
lea esi, [ecx - 4]
jne 0x4013f4
cmp byte [eax + 1], 0x3e
jne 0x4013f4
mov edi, dword [ebp + 8]
add edi, 2
cmp eax, edi
mov esi, eax
jbe 0x40144b
lea ecx, [esi - 1]
cmp byte [ecx], dl
jne 0x401387
cmp byte [esi - 2], 0x3c
je 0x401392
mov esi, ecx
cmp esi, edi
ja 0x40137a
jmp 0x40144b
sub eax, esi
mov edi, eax
mov eax, dword [ebp + 8]
add eax, 5
cmp esi, eax
jbe 0x4013d5
cmp byte [esi - 5], 0xef
jne 0x4013d5
cmp byte [esi - 4], 0xbb
jne 0x4013d5
cmp byte [esi - 3], 0xbf
jne 0x4013d5
lea ecx, [edi + edi + 2]
call fcn.004018bd
push edi
mov ebx, eax
push ebx
push edi
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and word [ebx + eax*2], 0
jmp 0x40144b
lea ecx, [edi + edi + 2]
call fcn.004018bd
push edi
mov ebx, eax
push ebx
push edi
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [ebx + eax*2], si
jmp 0x40144b
cmp word [esi], dx
jne 0x40144b
cmp word [esi + 2], 0x3e
jne 0x40144b
mov edi, dword [ebp + 8]
add edi, 4
cmp esi, edi
mov ecx, esi
mov dword [ebp - 4], ecx
jbe 0x40144b
jmp 0x401414
mov ecx, dword [ebp - 4]
lea eax, [ecx - 2]
cmp word [eax], dx
jne 0x401423
cmp word [ecx - 4], 0x3c
je 0x40142c
cmp eax, edi
mov dword [ebp - 4], eax
ja 0x401411
jmp 0x40144b
mov eax, esi
sub eax, ecx
sar eax, 1
lea edi, [eax + eax]
lea ecx, [edi + 2]
call fcn.004018bd
mov ecx, dword [ebp - 4]
mov ebx, eax
add edi, ebx
push edi
push esi
call fcn.00401058
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, ebx
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x40145d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00401108
test eax, eax
push 2
mov dword [ebp - 4], eax
pop esi
jne 0x401486
mov ecx, esi
call fcn.004018bd
and word [eax], 0
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004012a7
mov ebx, eax
test ebx, ebx
mov dword [ebp + 8], ebx
jne 0x4014a7
mov ecx, esi
call fcn.004018bd
mov ebx, eax
and word [ebx], 0
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
movzx ecx, word [edi]
cmp cx, 0x27
mov dword [ebp - 8], edi
je 0x4014ce
cmp cx, 0x22
jne 0x4014e8
jmp 0x4014ce
cmp ax, cx
jne 0x4014ce
cmp word [edi + 2], cx
jne 0x4014e6
add edi, esi
movzx eax, word [edi]
test ax, ax
jne 0x4014c3
jmp 0x4014e8
cmp ax, 0x20
je 0x4014f0
cmp ax, 9
je 0x4014f0
add edi, esi
movzx eax, word [edi]
test ax, ax
jne 0x4014da
mov dword [ebp - 0x10], edi
jmp 0x401503
cmp ax, 0x20
je 0x401501
cmp ax, 9
jne 0x40150b
add edi, esi
movzx eax, word [edi]
test ax, ax
jne 0x4014f5
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push ebx
mov dword [ebp - 0xc], eax
call esi
mov ecx, dword [ebp - 0xc]
push dword [ebp - 4]
lea ebx, [ecx + eax]
call esi
mov ecx, dword [ebp + 0xc]
add eax, ebx
lea eax, [eax + ecx + 0x20]
lea esi, [eax + eax]
mov ecx, esi
call fcn.004018bd
mov ecx, dword [ebp - 8]
mov ebx, eax
lea esi, [esi + ebx - 2]
push esi
push dword [ebp - 0x10]
call fcn.00401058
mov edx, dword [ebp - 4]
cmp word [edx], 0
je 0x401563
mov word [eax], 0x20
push esi
add eax, 2
call fcn.0040103a
mov edx, dword [ebp + 8]
cmp word [edx], 0
je 0x40157a
mov word [eax], 0x20
push esi
add eax, 2
call fcn.0040103a
cmp word [edi], 0
je 0x401590
mov word [eax], 0x20
push esi
add eax, 2
mov edx, edi
call fcn.0040103a
mov ecx, dword [ebp - 4]
call fcn.004018ce
mov ecx, dword [ebp + 8]
call fcn.004018ce
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x401921
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 0x10]
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
jmp 0x401954
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40195d
mov eax, dword [ebp - 4]
test eax, eax
je 0x401965
add dword [esi + 0xc], eax
sub edi, eax
jne 0x401934
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40195a
mov eax, dword [esi + 0xc]
cmp dword [esi + 4], eax
sbb eax, eax
and eax, 0xffffffda
add eax, 0x26
jmp 0x40195a
Function at 0x10025cb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f5b4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100b0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x10], esi
push dword [eax]
call fcn.10007090
mov dword [ebp - 4], 0
add esi, 0x18
mov dword [ebp + 0xc], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 3
push 0x18
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.1007a1ba
add esp, 4
mov dword [esi + 0x30], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080cd0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], edx
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x10030b1f
xor al, al
jmp 0x10030cc0
push 0x21
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x2c]
push str.SystemCurrentControlSet_services
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.10005540
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x44]
call fcn.1006ab10
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x80000002
mov dword [ebp - 0x48], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x10030b97
xor bl, bl
jmp 0x10030c13
push 0x400
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0x400
call fcn.1007a21b
push dword [ebp - 0x4c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push 0
push str.ImagePath
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030bfc
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10030be1
mov ecx, dword [ebp - 0x50]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.10005540
mov bl, 1
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10030c0a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1007a8ad
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x10030c53
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10030c49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030c49
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007a1ea
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10030caa
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10030ca0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030ca0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007a1ea
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov al, bl
mov dword [ebp - 0x18], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a1a9
mov esp, ebp
pop ebp
ret
Function at 0x10030ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d10
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x10030d1e
xor al, al
jmp 0x10030ec8
push 0x21
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x30]
push str.SystemCurrentControlSet_services
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.10005540
mov dword [ebp - 4], 0
lea edx, [ebp - 0x30]
push esi
lea ecx, [ebp - 0x48]
call fcn.1006ab10
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push ecx
cmovae eax, dword [ebp - 0x48]
push eax
push 0x80000002
mov dword [ebp - 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x10030d96
xor bl, bl
jmp 0x10030e1b
push 0x40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x4c], 0x40
call fcn.1007a21b
push dword [ebp - 0x4c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push str.Type
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030e04
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x10030e04
mov dword [ebp - 0x14], 0
cmp eax, 4
jbe 0x10030def
mov eax, dword [esi]
jmp 0x10030e00
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [edi], eax
mov bl, 1
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x10030e12
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1007a8ad
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x10030e5b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10030e51
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030e51
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007a1ea
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x10030eb2
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10030ea8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030ea8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007a1ea
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov al, bl
mov dword [ebp - 0x1c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a1a9
mov esp, ebp
pop ebp
ret
Function at 0x10030ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d10
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x10030f2e
xor al, al
jmp 0x100310d8
push 0x21
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x30]
push str.SystemCurrentControlSet_services
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.10005540
mov dword [ebp - 4], 0
lea edx, [ebp - 0x30]
push esi
lea ecx, [ebp - 0x48]
call fcn.1006ab10
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push ecx
cmovae eax, dword [ebp - 0x48]
push eax
push 0x80000002
mov dword [ebp - 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x10030fa6
xor bl, bl
jmp 0x1003102b
push 0x40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x4c], 0x40
call fcn.1007a21b
push dword [ebp - 0x4c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push str.Start
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10031014
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x10031014
mov dword [ebp - 0x14], 0
cmp eax, 4
jbe 0x10030fff
mov eax, dword [esi]
jmp 0x10031010
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [edi], eax
mov bl, 1
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x10031022
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1007a8ad
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x1003106b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10031061
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10031061
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007a1ea
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x100310c2
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100310b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100310b8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007a1ea
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov al, bl
mov dword [ebp - 0x1c], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a1a9
mov esp, ebp
pop ebp
ret
Function at 0x1003fa70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008248c
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x100b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x244]
call fcn.10004cb0
push 0x20c
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1003fb12
xor eax, eax
lea ecx, [ebp - 0x21c]
mov word [ebp - 0x12], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003faf0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.10005540
cmp dword [ebp - 0x234], 0
je 0x1003fbd3
xorps xmm0, xmm0
lea ecx, [ebp - 0x22c]
movups xmmword [ebp - 0x22c], xmm0
call fcn.1002fdb0
mov byte [ebp - 4], 1
call fcn.10071230
test al, al
je 0x1003fb5d
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x1003fb5d
cmp dword [ebp - 0x220], 0
jne 0x1003fb5d
lea ecx, [ebp - 0x220]
push ecx
call eax
push str.pmdata.dat
lea ecx, [ebp - 0x274]
call fcn.100054f0
lea eax, [ebp - 0x274]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x244]
lea ecx, [ebp - 0x25c]
call fcn.1006ab10
add esp, 4
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 4
call fcn.10004c20
lea ecx, [ebp - 0x25c]
call fcn.1006c750
test al, al
je 0x1003fbb5
lea ecx, [ebp - 0x25c]
call fcn.100738d0
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 1
call fcn.10004c20
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0
call fcn.10030010
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], 0xffffffff
call fcn.10004c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a1a9
mov esp, ebp
pop ebp
ret
Function at 0x10054c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008248c
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x100b0008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x244]
call fcn.10004cb0
push 0x20c
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x10054cb2
xor eax, eax
lea ecx, [ebp - 0x21c]
mov word [ebp - 0x12], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054c90
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.10005540
cmp dword [ebp - 0x234], 0
je 0x10054d73
xorps xmm0, xmm0
lea ecx, [ebp - 0x22c]
movups xmmword [ebp - 0x22c], xmm0
call fcn.1002fdb0
mov byte [ebp - 4], 1
call fcn.10071230
test al, al
je 0x10054cfd
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x10054cfd
cmp dword [ebp - 0x220], 0
jne 0x10054cfd
lea ecx, [ebp - 0x220]
push ecx
call eax
push str.fmdata.dat
lea ecx, [ebp - 0x274]
call fcn.100054f0
lea eax, [ebp - 0x274]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x244]
lea ecx, [ebp - 0x25c]
call fcn.1006ab10
add esp, 4
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 4
call fcn.10004c20
lea ecx, [ebp - 0x25c]
call fcn.1006c750
test al, al
je 0x10054d55
lea ecx, [ebp - 0x25c]
call fcn.100738d0
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 1
call fcn.10004c20
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0
call fcn.10030010
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], 0xffffffff
call fcn.10004c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a1a9
mov esp, ebp
pop ebp
ret