joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2104f087
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x7530
mov dword [ebp - 0x24], eax
cmp dword [0x2109ce90], 0
je 0x2104f0b5
mov ecx, dword [0x2109ce90]
call fcn.21044dd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x24]
jbe 0x2104f0de
push 0x21094c68
push str.MyStartService
push 0x2729
call fcn.21012222
add esp, 0xc
xor eax, eax
jmp 0x2104f16d
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x2104f101
push str.QueryServiceStatus
call fcn.210123d5
add esp, 4
xor eax, eax
jmp 0x2104f16d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
je 0x2104f115
cmp dword [ebp - 0x28], 4
je 0x2104f13a
jmp 0x2104f14c
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x2104f138
push str.StartService
call fcn.210123d5
add esp, 4
xor eax, eax
jmp 0x2104f16d
jmp 0x2104f14c
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x2104f16d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x2109ce90], 0
je 0x2104f168
mov ecx, dword [0x2109ce90]
call fcn.21044dd0
jmp 0x2104f0b5
mov esp, ebp
pop ebp
ret

Function at 0x2104f327
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x2104f36d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x426
je 0x2104f355
jmp 0x2104f35c
mov eax, 1
jmp 0x2104f38d
push str.ControlService
call fcn.210123d5
add esp, 4
xor eax, eax
jmp 0x2104f38d
push 0x7530
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.2104f3c2
add esp, 0xc
test eax, eax
jne 0x2104f388
xor eax, eax
jmp 0x2104f38d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x2104f3c2
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x7530
mov dword [ebp - 0x28], eax
cmp dword [0x2109ce90], 0
je 0x2104f3f0
mov ecx, dword [0x2109ce90]
call fcn.21044dd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x28]
jbe 0x2104f416
push str.__timed_out_waiting_for_service
push str.WaitService
push 0x2729
call fcn.21012222
add esp, 0xc
xor eax, eax
jmp 0x2104f466
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x2104f42a
jmp 0x2104f3f0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x2104f43f
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2104f455
cmp dword [0x2109ce90], 0
je 0x2104f453
mov ecx, dword [0x2109ce90]
call fcn.21044dd0
jmp 0x2104f3f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x2104fd28
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x2104fd52
xor eax, eax
jmp 0x2104fd6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
add eax, 2
mov esp, ebp
pop ebp
ret 8
Function at 0x21050e30
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.210512b1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x21050e4c
or eax, 0xffffffff
jmp 0x21050f9c
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x21050e87
jmp 0x21050f9a
push 2
push 0xc
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x21050ea2
jmp 0x21050f98
mov dword [ebp - 0x20], 0
jmp 0x21050eb4
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x30]
jae 0x21050f7c
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x21050ed8
jmp 0x21050eab
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov al, byte [edx + 1]
and eax, 8
test eax, eax
je 0x21050ee9
jmp 0x21050eab
mov ecx, dword [ebp - 0x1c]
mov dl, byte [ecx]
mov byte [ebp - 0x34], dl
cmp byte [ebp - 0x34], 0
je 0x21050eff
cmp byte [ebp - 0x34], 1
je 0x21050f3c
jmp 0x21050f77
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 8
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x21050f3a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
and ecx, 0x20000
test ecx, ecx
je 0x21050f3a
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x20], edx
jmp 0x21050f77
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
add edx, 8
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x21050f77
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
and ecx, 0x20000
test ecx, ecx
je 0x21050f77
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x20], edx
jmp 0x21050eab
cmp dword [ebp - 0x10], 0xffffffff
jne 0x21050f89
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
jmp 0x21050f9c
jmp 0x21050f89
jmp 0x21050f89
mov esp, ebp
pop ebp
ret
Function at 0x21051301
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push edi
mov dword [ebp - 8], 0
mov word [ebp - 0x210], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], pe_nt_image_headers32
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x2105137b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x2105137b
xor eax, eax
jmp 0x210514ad
mov edx, dword [ebp - 8]
push edx
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x210513b0
push str.GetCurrentUserSid:_could_not_allocate_SID
call fcn.2101235d
add esp, 4
xor eax, eax
jmp 0x210514ad
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x210513df
jmp 0x210514ab
cmp dword [ebp - 0x214], 1
je 0x21051476
cmp dword [ebp - 0x214], 3
jne 0x21051474
push 0
push 0xffffffffffffffff
push 0x21094f18
mov ecx, dword [ebp + 8]
push ecx
call fcn.2103951b
add esp, 0x10
test eax, eax
jne 0x21051474
lea edx, [ebp - 0x614]
push edx
call fcn.21058a3b
add esp, 4
test eax, eax
jne 0x21051426
jmp 0x210514a9
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x614]
push ecx
call fcn.2105e7d8
add esp, 4
lea edx, [ebp + eax*2 - 0x614]
push edx
call fcn.2105e37e
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x61c], eax
mov ecx, dword [ebp - 0x61c]
push ecx
call fcn.2106e0a6
add esp, 4
mov edx, dword [ebp + 8]
push edx
call fcn.21051301
add esp, 4
jmp 0x210514ad
jmp 0x210514a7
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jne 0x210514a2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
push ecx
call fcn.2106e0a6
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
jmp 0x210514ad
jmp 0x2105147d
jmp 0x2105147d
jmp 0x2105147d
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x21052c5d
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push 0x21094f78
lea ecx, [ebp - 8]
push ecx
call fcn.2105e37e
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x21052c9e
xor eax, eax
jmp 0x21052cb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x21052cad
xor eax, eax
jmp 0x21052cb2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x2105484b
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.2105469b
test eax, eax
jne 0x21054866
jmp 0x210548f0
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x2c], eax
jne 0x2105489c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x210548f0
mov ecx, dword [ebp - 0x14]
call fcn.2105466c
test eax, eax
je 0x210548aa
jmp 0x210548f0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.210036d9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 8], edx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea ecx, [ebp - 4]
call fcn.21003702
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x210559b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push edi
mov eax, dword [ebp + 0xc]
mov word [eax], 0
mov word [ebp - 0x61c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x61c]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x210559fd
xor eax, eax
jmp 0x21055af5
mov edx, dword [ebp + 8]
push edx
call fcn.2105e7d8
add esp, 4
mov dword [ebp - 0x21c], eax
mov eax, dword [0x2109524c]
mov dword [ebp - 0x10], eax
mov cx, word [0x21095250]
mov word [ebp - 0xc], cx
lea edx, [ebp - 0x61c]
mov dword [ebp - 4], edx
jmp 0x21055a43
mov eax, dword [ebp - 4]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov cx, word [eax]
mov word [ebp - 8], cx
mov edx, dword [ebp - 8]
and edx, 0xffff
test edx, edx
je 0x21055af3
mov ax, word [ebp - 8]
mov word [ebp - 0x10], ax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x21055a82
jmp 0x21055a2d
lea eax, [ebp - 0x218]
push eax
call fcn.2105e7d8
add esp, 4
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
cmp ecx, dword [ebp - 0x21c]
jle 0x21055aa7
jmp 0x21055a2d
mov edx, dword [ebp - 0x620]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105f4f2
add esp, 0xc
test eax, eax
je 0x21055aca
jmp 0x21055a2d
mov edx, dword [ebp - 0x620]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*2]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x21095254
mov eax, dword [ebp + 0xc]
push eax
call fcn.2105e37e
add esp, 0x10
mov eax, 1
jmp 0x21055af5
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x21055afa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [ebp + 0x18], 0
je 0x21055b1b
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x21055b1b
mov dword [ebp - 0x64], 0
jmp 0x21055b22
mov dword [ebp - 0x64], 1
cmp dword [ebp - 0x64], 0
je 0x21055b4c
push 0
push 0
mov edx, dword [ebp + 0x14]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov cx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.2105b768
add esp, 0x1c
jmp 0x21055c58
mov dword [ebp - 0x14], 0xbb8
mov eax, dword [ebp + 8]
push eax
call fcn.2105f1c3
add esp, 4
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x21055b7c
push str.could_not_allocate_buffer_for_CreateProcess
call fcn.2101235d
add esp, 4
xor eax, eax
jmp 0x21055c58
push 0x44
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.2105e780
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov dx, word [ebp + 0xc]
mov word [ebp - 0x28], dx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
test eax, eax
je 0x21055c3d
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x21055c26
mov edx, dword [ebp - 0x5c]
push edx
call fcn.2105f1f1
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.21058fe3
add esp, 0x20
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
jmp 0x21055c58
cmp dword [ebp + 0x10], 0
jne 0x21055c2e
jmp 0x21055c3d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x21055ba2
push 0x210952b8
call fcn.210123d5
add esp, 4
mov eax, dword [ebp - 0x5c]
push eax
call fcn.2105f1f1
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x210560b6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x210560d4
jmp 0x210561e1
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shl edx, 1
push edx
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x14], 0
jne 0x21056106
jmp 0x210561e1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov word [ebp - 4], 0xff1a
mov word [ebp - 2], 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.2105d149
add esp, 0x14
mov word [ebp - 8], ax
mov eax, dword [ebp - 8]
and eax, 0xffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3a
je 0x21056151
jmp 0x21056153
jmp 0x210561bb
xor ecx, ecx
mov cx, word [0x2109bb26]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 4
je 0x21056173
cmp dword [ebp - 0x28], 0x10
jle 0x210561a3
cmp dword [ebp - 0x28], 0x12
jle 0x21056173
jmp 0x210561a3
mov edx, dword [ebp - 8]
and edx, 0xffff
mov eax, dword [ebp - 4]
and eax, 0xffff
cmp edx, eax
jne 0x2105618a
jmp 0x210561bb
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0xc], 1
jmp 0x210561bb
push 0x21095330
mov eax, dword [ebp - 0x14]
push eax
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x210561cf
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.2106e0a6
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x21056244
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x21056262
jmp 0x21056303
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2105628a
jmp 0x21056303
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 3
jl 0x210562cc
push 0x21095334
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*2 - 6]
push eax
call fcn.2105e83a
add esp, 8
test eax, eax
jne 0x210562cc
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x210562f1
push 0x2109533c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.2105e3ed
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.2106e0a6
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x21057889
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2107c5d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
call fcn.21058e19
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x210578ba
jmp 0x21057a9c
mov dword [ebp - 0x2c], pe_nt_image_headers32
lea ecx, [ebp - 0x28]
call fcn.2102d230
mov dword [ebp - 4], 0
push 0
push 2
mov eax, dword [ebp - 0x2c]
shl eax, 1
push eax
lea ecx, [ebp - 0x28]
call fcn.2102d311
test eax, eax
jne 0x210578fa
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.2102d2fe
jmp 0x21057a9c
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x10], eax
jmp 0x2105791a
push 2
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x21057a8d
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x21057946
jmp 0x2105790b
push 0x80
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x21057962
jmp 0x2105790b
push str.button
lea eax, [ebp - 0x138]
push eax
call fcn.2105e86f
add esp, 8
test eax, eax
jne 0x210579b6
push 0xfffffffffffffff0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xf
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xb
ja case.0x210579a6.1
mov eax, dword [ebp - 0x140]
xor edx, edx
mov dl, byte [eax + 0x21057ab2]
jmp dword [edx*4 + 0x21057aaa]
mov dword [ebp - 0x34], 1
jmp 0x210579fe
push str.static
lea ecx, [ebp - 0x138]
push ecx
call fcn.2105e86f
add esp, 8
test eax, eax
jne 0x210579fe
push 0xfffffffffffffff0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x1f
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jb 0x210579fe
cmp dword [ebp - 0x144], 2
jbe 0x210579f7
jmp 0x210579fe
mov dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0
jne 0x21057a09
jmp 0x2105790b
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x2c]
jle 0x21057a44
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x2c], ecx
push 0
push 2
mov edx, dword [ebp - 0x2c]
shl edx, 1
push edx
lea ecx, [ebp - 0x28]
call fcn.2102d311
test eax, eax
jne 0x21057a44
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.2102d2fe
jmp 0x21057a9c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x21057a65
jmp 0x2105790b
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.21057abe
add esp, 4
test eax, eax
jne 0x21057a7a
jmp 0x2105790b
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x2105790b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.2102d2fe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x2105871d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
cmp dword [0x2109c234], 0
je 0x21058748
push str.MyDeleteKeyW
push 0x2971
call fcn.21012222
add esp, 8
xor eax, eax
jmp 0x2105887b
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x2105878f
cmp dword [ebp - 0x418], 2
je 0x21058791
jmp 0x2105879b
jmp 0x210587af
mov eax, 1
jmp 0x2105887b
push str.RegOpenKeyExW
call fcn.210123d5
add esp, 4
xor eax, eax
jmp 0x2105887b
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x21058834
mov dword [ebp - 0xc], 0x200
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x414]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x210587ff
cmp dword [ebp - 0x41c], 0x103
je 0x2105881a
jmp 0x21058823
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.2105871d
add esp, 8
test eax, eax
jne 0x21058818
jmp 0x21058879
jmp 0x21058832
mov dword [ebp - 4], 0
jmp 0x21058832
push str.RegEnumKeyExW
call fcn.210123d5
add esp, 4
jmp 0x21058877
jmp 0x210587b6
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x21058859
jmp 0x21058875
mov dword [ebp - 8], 1
cmp dword [ebp - 0x10], 0
je 0x21058870
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x2105887b
jmp 0x21058860
jmp 0x21058860
jmp 0x21058860
mov esp, ebp
pop ebp
ret

Function at 0x210588d4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x210588fd
xor eax, eax
jmp 0x21058957
mov edx, dword [ebp - 8]
add edx, 0x10
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shl eax, 1
push eax
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x2105893a
push str.MyExpandEnvironmentStrings
call fcn.2101235d
add esp, 4
xor eax, eax
jmp 0x21058957
mov edx, dword [ebp - 4]
mov word [edx], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret