joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425380
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x455c20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, str.postgres_9.5
push edi
mov edi, dword [ebp + 8]
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4253c2
test dl, dl
je 0x4253be
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4253c2
add ecx, 2
add eax, 2
test dl, dl
jne 0x4253a2
xor eax, eax
jmp 0x4253c7
sbb eax, eax
or eax, 1
test eax, eax
je 0x4253da
push 0x42b69a
push 0
call fcn.004296b0
add esp, 8
lea eax, [ebp - 0xc14]
push eax
push edi
call fcn.004254e0
add esp, 8
test eax, eax
js 0x4254c9
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0xc14]
push eax
call fcn.00428400
lea eax, [ebp - 0x814]
push eax
push esi
call sub.libintl_8.dll_libintl_bindtextdomain
push esi
call sub.libintl_8.dll_libintl_textdomain
mov esi, dword [sym.imp.MSVCR120.dll_getenv]
push str.PGLOCALEDIR
call esi
mov edi, dword [sym.imp.MSVCR120.dll__strdup]
add esp, 0x18
test eax, eax
jne 0x42546d
lea eax, [ebp - 0x814]
push eax
push str.PGLOCALEDIR_s
lea eax, [ebp - 0x414]
push 0x40e
push eax
call fcn.004262e0
lea eax, [ebp - 0x408]
push eax
call fcn.00427c20
lea eax, [ebp - 0x414]
push eax
call edi
push eax
call fcn.00427960
add esp, 0x1c
push str.PGSYSCONFDIR
call esi
add esp, 4
test eax, eax
jne 0x4254c9
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0xc14]
push eax
call fcn.00428340
lea eax, [ebp - 0x814]
push eax
push str.PGSYSCONFDIR_s
lea eax, [ebp - 0x414]
push 0x40e
push eax
call fcn.004262e0
lea eax, [ebp - 0x407]
push eax
call fcn.00427c20
lea eax, [ebp - 0x414]
push eax
call edi
push eax
call fcn.00427960
add esp, 0x24
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429e54
mov esp, ebp
pop ebp
ret
Function at 0x425d80
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push edi
xor edi, edi
mov dword [ebp - 0x1c], 0xc
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x425db6
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0xc]
push 2
push 0
push 0
push eax
call esi
push eax
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x425df2
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0x44
lea eax, [ebp - 0x70]
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x2c], xmm0
call sub.MSVCR120.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x70], 0x44
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x44], 0x100
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x38], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x425f5d
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push ebx
push 0
push esi
call sub.MSVCR120.dll_memset
dec ebx
add esp, 0xc
add ebx, esi
mov edi, esi
cmp esi, ebx
jae 0x425f4b
lea ebx, [ebx]
push 0x2710
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x425ee5
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
sub eax, edi
add eax, dword [ebp + 0x10]
push eax
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425ee5
mov ecx, edi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x425ec0
sub ecx, edx
add edi, ecx
cmp dword [ebp - 0x10], 0
je 0x425ee5
push 0xa
push esi
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
test eax, eax
jne 0x425ee5
cmp edi, ebx
jb 0x425e80
cmp edi, esi
je 0x425f4b
push 0xa
push esi
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
test eax, eax
je 0x425efd
mov byte [eax + 1], 0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x425f02
sub ecx, edx
cmp ecx, 2
jl 0x425f26
cmp byte [ecx + esi - 2], 0xd
jne 0x425f26
cmp byte [ecx + esi - 1], 0xa
jne 0x425f26
mov word [ecx + esi - 2], 0xa
dec ecx
test ecx, ecx
je 0x425f31
cmp byte [ecx + esi - 1], 0xa
je 0x425f47
lea edi, [esi - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x425f34
mov ax, word [0x42d94c]
mov word [edi], ax
mov edi, esi
jmp 0x425f4d
xor edi, edi
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x28]
call ebx
push dword [ebp - 8]
call ebx
push dword [ebp - 0xc]
call ebx
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4263a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x455c20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test eax, eax
jne 0x4263dd
call dword [sym.imp.MSVCR120.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e54
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea esi, [ebp - 0x404]
mov dword [ebp - 0x410], eax
push edx
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x418], esi
lea esi, [ebp - 5]
push ecx
push eax
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x408], 0
call fcn.00426520
mov esi, dword [ebp - 0x41c]
add esp, 0xc
mov eax, dword [ebp - 0x418]
sub esi, eax
mov bl, byte [ebp - 0x408]
test bl, bl
jne 0x426468
test esi, esi
je 0x426468
push dword [ebp - 0x410]
push esi
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [ebp - 0x40c]
add esp, 0x10
add ecx, eax
movzx ebx, bl
cmp eax, esi
mov edx, 1
cmovne ebx, edx
jmp 0x42646e
mov ecx, dword [ebp - 0x40c]
or eax, 0xffffffff
test bl, bl
pop esi
cmovne ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00429e54
mov esp, ebp
pop ebp
ret

Function at 0x4264d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
mov eax, dword [esi + 4]
sub edi, eax
cmp byte [esi + 0x14], 0
jne 0x42650d
test edi, edi
je 0x42650d
push dword [esi + 0xc]
push edi
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
mov eax, dword [esi + 4]
mov dword [esi], eax
je 0x42650f
pop edi
mov byte [esi + 0x14], 1
pop esi
pop ebp
ret
mov dword [esi], eax
pop edi
pop esi
pop ebp
ret
Function at 0x426f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x426fb5
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edi, ecx
test eax, eax
je 0x426fc7
dec eax
cmp byte [edi], 0
je 0x426fc7
inc edi
test eax, eax
jne 0x426fa8
jmp 0x426fc7
mov edi, dword [ebp + 8]
lea ecx, [edi + 1]
jmp 0x426fc0
mov al, byte [edi]
inc edi
test al, al
jne 0x426fc0
mov ebx, dword [ebp + 0x10]
sub edi, ecx
sub ebx, edi
mov eax, 0
cmovs ebx, eax
mov dword [ebp + 0x18], ebx
cmp dword [ebp + 0xc], eax
je 0x426fe3
neg ebx
mov dword [ebp + 0x18], ebx
mov esi, dword [ebp + 0x1c]
test ebx, ebx
jle 0x427044
lea ebx, [ebx]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x427035
mov eax, dword [esi]
cmp eax, ecx
jb 0x427035
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42703c
mov edx, dword [esi + 4]
sub eax, edx
cmp byte [esi + 0x14], 0
mov dword [ebp + 0x18], eax
jne 0x427030
test eax, eax
je 0x427030
push ecx
push eax
push 1
push edx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, dword [ebp + 0x18]
je 0x427030
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
dec ebx
test ebx, ebx
jg 0x426ff0
mov dword [ebp + 0x18], ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00427670
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.004278d0
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x427310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
dec edi
cmovs edi, eax
mov dword [ebp + 0x10], edi
cmp dword [ebp + 0xc], eax
je 0x42732b
neg edi
mov dword [ebp + 0x10], edi
mov esi, dword [ebp + 0x14]
test edi, edi
jle 0x427384
push ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x427374
mov ebx, dword [esi]
cmp ebx, eax
jb 0x427374
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42737b
mov ecx, dword [esi + 4]
sub ebx, ecx
cmp byte [esi + 0x14], 0
jne 0x42736f
test ebx, ebx
je 0x42736f
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, ebx
je 0x42736f
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
dec edi
test edi, edi
jg 0x427333
mov dword [ebp + 0x10], edi
pop ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x42739e
cmp dword [esi], eax
jb 0x42739e
cmp dword [esi + 0xc], 0
je 0x4273a7
push esi
call fcn.004264d0
add esp, 4
mov ecx, dword [esi]
mov al, byte [ebp + 8]
mov byte [ecx], al
inc dword [esi]
lea eax, [ebp + 0x10]
push esi
push eax
call fcn.004278d0
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x427670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x4276ec
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x42768b
sub eax, dword [esi]
jmp 0x42768d
mov eax, ebx
test eax, eax
jg 0x4276c9
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4276ea
mov edi, dword [esi]
mov ecx, dword [esi + 4]
sub edi, ecx
cmp byte [esi + 0x14], 0
jne 0x4276c2
test edi, edi
je 0x4276c2
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
je 0x4276c2
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
jmp 0x4276e6
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.MSVCR120.dll_memmove]
add dword [esi], edi
add esp, 0xc
add dword [ebp + 8], edi
sub ebx, edi
test ebx, ebx
jg 0x427680
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x427780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi], 0
jle 0x42782c
cmp dword [ebp + 8], 0
je 0x42782c
mov ebx, dword [ecx]
test ebx, ebx
je 0x4277d3
mov eax, dword [esi + 8]
test eax, eax
je 0x4277c5
cmp dword [esi], eax
jb 0x4277c5
cmp dword [esi + 0xc], 0
je 0x4277cb
push esi
call fcn.004264d0
mov ecx, dword [ebp + 0xc]
add esp, 4
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
dec dword [edi]
mov dword [ecx], 0
cmp dword [edi], 0
jle 0x42782c
mov eax, dword [esi + 8]
test eax, eax
je 0x427819
mov ebx, dword [esi]
cmp ebx, eax
jb 0x427819
mov eax, dword [esi + 0xc]
test eax, eax
je 0x427822
mov ecx, dword [esi + 4]
sub ebx, ecx
cmp byte [esi + 0x14], 0
jne 0x427814
test ebx, ebx
je 0x427814
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, ebx
je 0x427814
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov byte [eax], cl
inc dword [esi]
dec dword [edi]
cmp dword [edi], 0
jg 0x4277d8
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx], eax
setne al
cmp dword [edi], eax
jle 0x42788f
mov eax, dword [esi + 8]
test eax, eax
je 0x42787b
mov ebx, dword [esi]
cmp ebx, eax
jb 0x42787b
mov eax, dword [esi + 0xc]
test eax, eax
je 0x427882
mov ecx, dword [esi + 4]
sub ebx, ecx
cmp byte [esi + 0x14], 0
jne 0x427873
test ebx, ebx
je 0x427873
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, ebx
je 0x427873
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
dec dword [edi]
xor eax, eax
cmp dword [ecx], eax
setne al
cmp dword [edi], eax
jg 0x427837
mov ebx, dword [ecx]
test ebx, ebx
je 0x4278c8
mov eax, dword [esi + 8]
test eax, eax
je 0x4278af
cmp dword [esi], eax
jb 0x4278af
cmp dword [esi + 0xc], 0
je 0x4278b5
push esi
call fcn.004264d0
add esp, 4
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
mov eax, dword [edi]
test eax, eax
jle 0x4278c3
dec eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
jns 0x4278c8
inc eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4278d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jge 0x42792f
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x427922
mov edi, dword [esi]
cmp edi, eax
jb 0x427922
mov eax, dword [esi + 0xc]
test eax, eax
je 0x427929
mov ecx, dword [esi + 4]
sub edi, ecx
cmp byte [esi + 0x14], 0
jne 0x42791d
test edi, edi
je 0x42791d
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
je 0x42791d
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
inc dword [ebx]
js 0x4278e1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x427960
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [str.msvcrt], edi
je 0x427a00
mov eax, 0x455b98
xor esi, esi
nop
cmp dword [esi + 0x455ba0], 0
jne 0x4279de
cmp dword [esi + 0x455b9c], 0
jne 0x4279ea
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esi + 0x455b9c], eax
test eax, eax
jne 0x4279b0
mov dword [esi + 0x455b9c], 0xffffffff
jmp 0x4279ea
push 0x44bb88
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x455ba0], eax
test eax, eax
jne 0x4279de
push dword [esi + 0x455b9c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x455b9c], 0xffffffff
jmp 0x4279ea
mov eax, dword [esi + 0x455ba0]
push ebx
call eax
add esp, 4
inc edi
lea esi, [edi + edi*2]
shl esi, 2
cmp dword [esi + 0x455b98], 0
lea eax, [esi + 0x455b98]
jne 0x427980
push ebx
call dword [sym.imp.MSVCR120.dll__strdup]
mov esi, eax
add esp, 4
test esi, esi
je 0x427a2c
push 0x3d
push esi
call dword [sym.imp.MSVCR120.dll_strchr]
mov edx, eax
add esp, 8
test edx, edx
jne 0x427a36
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edx], 0
inc edx
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427a40
sub ecx, edi
je 0x427a57
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x427a22
push esi
call dword [sym.imp.MSVCR120.dll_free]
push ebx
call dword [sym.imp.MSVCR120.dll__putenv]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428480
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.APPDATA
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
jne 0x428499
xor al, al
pop ebp
ret
push eax
push str._s_postgresql
push 0x400
push dword [ebp + 8]
call fcn.004262e0
add esp, 0x10
mov al, 1
pop ebp
ret
Function at 0x429040
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x429050
sub esi, ecx
lea eax, [esi + 3]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x429085
call dword [sym.imp.MSVCR120.dll__errno]
pop edi
pop esi
pop ebx
mov dword [eax], 0xc
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebx + 1]
mov byte [ebx], 0x22
push edi
push eax
call sub.MSVCR120.dll_memcpy
push ebx
mov word [ebx + esi + 1], 0x22
call dword [sym.imp.MSVCR120.dll_system]
mov edi, dword [sym.imp.MSVCR120.dll__errno]
mov ebx, eax
call edi
push dword [ebp - 4]
mov esi, dword [eax]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x14
call edi
pop edi
mov dword [eax], esi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x10003001
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [0xb75070]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1000316b
push 0x40
mov edx, esi
mov ecx, edi
call 0x10005240
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call 0x10005240
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x100030c9
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call 0x10005240
add esi, 0x28
dec edi
jne 0x10003087
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x100030c9
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call 0x10005240
lea esi, [esi + 0x28]
dec ebx
jne 0x100030ae
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10001f85
push dword [ebp - 0x18]
mov ecx, dword [0xb76438]
mov edx, edi
call fcn.10001ee1
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10003168
cmp dword [ebx + 0x64], 0
je 0x10003168
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10003110
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x10003114
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x1000313d
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x1000313f
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10003162
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4022b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
lea eax, [ebp - 0x14]
sub esp, 0x28
mov dword [ebp - 0xc], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [esp], reloc.uxtheme.dll_Ordinal_2
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x402300
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40233a
cmp dword [ebp - 8], 4
je 0x402341
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
Function at 0x4025f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x868
mov dword [ebp - 0x854], eax
test byte [section..data], 8
jne 0x402790
mov eax, dword [ebp - 0x854]
mov dword [esp + 4], 0x4b0
lea esi, [ebp - 0x80c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 8
mov edi, eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1f51
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
xor ecx, ecx
mov edx, esi
mov eax, edi
sub esp, 0x10
call sym._add_listview_item
lea eax, [ebp - 0x850]
mov dword [esp + 4], 0x4192fe
mov dword [esp + 8], eax
mov eax, dword [0x4282e8]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x40271f
mov eax, dword [ebp - 0x854]
call sym._init_comboboxes
lea eax, [ebp - 0x848]
mov dword [esp], edi
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x848], 8
mov dword [ebp - 0x83c], 3
mov dword [ebp - 0x838], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104c
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
add ebx, 1
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edx, esi
mov ecx, eax
mov eax, edi
call sym._add_listview_item
lea eax, [ebp - 0x84c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x84c], 0x400
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x402708
mov eax, dword [ebp - 0x850]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x402699
mov dword [esp + 0xc], 0x4192fa
mov dword [esp + 8], str.init_appsheet
mov dword [esp + 4], 0x417000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x40260f