joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3230
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8e20
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0xd
push eax
push 0x4397ac
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, 0xc
jne 0x5a33c7
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x38], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5a3292
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00459b10
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
mov edx, dword [ebp - 0x24]
cmovae eax, edi
cmovae ecx, edi
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
cmp ecx, eax
je 0x5a3300
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, 0x30
jl 0x5a3394
cmp al, 0x39
jle 0x5a32e6
cmp al, 0x41
jl 0x5a3394
cmp al, 0x46
jle 0x5a32f2
cmp al, 0x61
jl 0x5a3394
cmp al, 0x66
jg 0x5a3394
inc ecx
cmp ecx, dword [ebp - 0x48]
jne 0x5a32d0
xor ecx, ecx
lea eax, [ebp - 0x38]
cmp edx, 0x10
mov dword [ebp - 0x3c], ecx
xorps xmm1, xmm1
cmovae eax, edi
movq qword [ebp - 0x44], xmm1
cmp dword [ebp - 0x28], ecx
jbe 0x5a3336
push dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.005be280
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
movq xmm1, qword [ebp - 0x44]
mov edx, dword [ebp - 0x24]
mov byte [esi], 0
xorps xmm0, xmm0
movups xmmword [esi + 4], xmm0
movq qword [esi + 0x14], xmm0
mov byte [esi + 0x1c], 0
movq qword [esi + 0x1d], xmm0
mov dword [esi + 0x25], 0
mov byte [esi + 0x1c], 0
movq qword [esi + 0x1d], xmm1
mov dword [esi + 0x25], ecx
mov byte [esi + 0x1c], 1
cmp edx, 0x10
jb 0x5a33e6
lea ecx, [edx + 1]
mov eax, edi
mov dword [ebp - 4], 0
cmp ecx, 0x1000
jb 0x5a3403
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a340f
jmp 0x5a3403
cmp edx, 0x10
jb 0x5a33c7
lea ecx, [edx + 1]
mov eax, edi
mov dword [ebp - 4], 1
cmp ecx, 0x1000
jb 0x5a33bd
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a340f
push ecx
push edi
call fcn.005bc4f7
add esp, 8
mov byte [esi], 0
xorps xmm0, xmm0
movups xmmword [esi + 4], xmm0
movq qword [esi + 0x14], xmm0
mov byte [esi + 0x1c], 0
movq qword [esi + 0x1d], xmm0
mov dword [esi + 0x25], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bca10
mov esp, ebp
pop ebp
ret
push ecx
push edi
call fcn.005bc4f7
add esp, 8
jmp 0x5a33e6
call fcn.004d7f94
int3
Function at 0x5a6900
Capabilities:
Reference the vmware io port

Disassembly:
push ecx
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
pushal
mov eax, 0x564d5868
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [esp + 0x2c], ebx
popal
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x5c88d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x5c899c
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x5c899b
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
test edi, edi
je 0x5c8996
push esi
cmp edi, 0x40
jb 0x5c897b
lea eax, [edi - 1]
lea esi, [edi - 1]
add eax, edx
add esi, ebx
cmp ebx, eax
ja 0x5c8910
cmp esi, edx
jae 0x5c897b
movaps xmm1, xmmword [0x43cf50]
lea esi, [edx + 0x30]
mov eax, edi
mov edi, edx
and eax, 0xffffffc0
sub edi, ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
push ebp
nop dword [eax + eax]
movups xmm0, xmmword [esi - 0x30]
add ecx, 0x40
lea esi, [esi + 0x40]
lea eax, [eax + 0x40]
mov ebp, ecx
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [edi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [esi - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [esi - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp ecx, dword [esp + 0x14]
jb 0x5c8930
mov edi, dword [esp + 0x1c]
cmp ebp, edi
pop ebp
jae 0x5c8995
mov esi, edi
lea eax, [ecx + ebx]
sub edx, ebx
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor cl, 0x67
mov byte [eax - 1], cl
sub esi, 1
jne 0x5c8984
pop esi
mov byte [ebx + edi], 0
pop edi
pop ebx
ret
Function at 0x401971
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x401997
inc edi
cmp edi, 0x1f6502b1
jl 0x40197d
cmp dword [0x285fee4], 0x400
jne 0x4019f9
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x46ec20
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call fcn.00402169
push esi
call fcn.0040212f
push esi
push esi
call fcn.00402327
push esi
call fcn.004023d4
push esi
call fcn.004023e3
add esp, 0x18
xor edi, edi
cmp edi, 0xd09a
jge 0x401a0a
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ced2
jg 0x401a32
inc edi
cmp edi, 0x263ff
jl 0x4019fb
mov eax, dword [0x472044]
mov dword [0x285fee4], eax
call fcn.004016c8
mov edi, 0x3078f
cmp dword [0x285fee4], 0x51f
jne 0x401a5e
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a46
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4057ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x471a70]
jne 0x4057f8
repz ret
jmp fcn.0040785c
Function at 0x40705b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x471a70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004030c2
and dword [ebp - 0x14], 0
cmp dword [0x47cbac], 0
mov dword [ebp - 0x18], eax
jne 0x40710e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4071b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4071b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47cbac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47cbb0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47cbb4], eax
call edi
push eax
call esi
mov dword [0x47cbbc], eax
test eax, eax
je 0x40710e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47cbb8], eax
mov eax, dword [0x47cbb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407167
cmp dword [0x47cbbc], ecx
je 0x407167
push eax
call esi
push dword [0x47cbbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407167
test ebx, ebx
je 0x407167
call edi
test eax, eax
je 0x40715e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40715e
test byte [ebp - 8], 1
jne 0x407167
or dword [ebp + 0x10], 0x200000
jmp 0x40719a
mov eax, dword [0x47cbb0]
cmp eax, dword [ebp - 0x18]
je 0x40719a
push eax
call esi
test eax, eax
je 0x40719a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40719a
mov eax, dword [0x47cbb4]
cmp eax, dword [ebp - 0x18]
je 0x40719a
push eax
call esi
test eax, eax
je 0x40719a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47cbac]
call esi
test eax, eax
je 0x4071b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4071b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004057ee
leave
ret
Function at 0x100039cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000da1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push edi
mov dword [ebp - 0x218], 1
push 0x10102d24
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x224]
push eax
push 0xf003f
push 0
push str.SOFTWAREZKYRCheckToolOS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x10003a5c
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x214], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x220], 0x200
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push str.OSType
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::operator_2
push str.PeOS
lea eax, [ebp - 0x228]
push eax
call fcn.10009dd0
and eax, 0xff
test eax, eax
je 0x10003adb
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10003b1b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10003b34
mov eax, 1
jmp 0x10003b36
xor eax, eax
pop ebp
ret

Function at 0x10003be4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000da4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10003420
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x10003c43
mov eax, dword [ebp - 0x10]
and eax, 0x10
test eax, eax
je 0x10003c43
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x14]
jmp 0x10003c5c
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10008030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000df44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
push edi
mov dword [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 1
mov byte [ebp - 0x434], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x433]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x30], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x2f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
mov edx, dword [ecx]
push edx
push str._s_SOFTWAREMicrosoftWindows_NTCurrentVersion
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x440]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x438]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x434]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x1000812e
push 0x10102d8c
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp - 0x444]
or al, 1
mov dword [ebp - 0x444], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
jmp 0x10008192
mov dword [ebp - 0x34], 0x20
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.CurrentVersion
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x43c], eax
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [ebp - 0x444]
or ecx, 1
mov dword [ebp - 0x444], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000862d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e046
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push edi
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 2
push 0x10102da0
lea ecx, [ebp - 0x220]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x218], 4
cmp dword [0x10102cfc], 0
jne 0x100086b4
lea eax, [ebp - 0x21c]
push eax
push 0xf003f
push 0
lea ecx, [ebp + 0x10]
call fcn.10003420
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x214], eax
jmp 0x100086db
lea edx, [ebp - 0x21c]
push edx
push 0xf033f
push 0
lea ecx, [ebp + 0x10]
call fcn.10003420
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x214], eax
mov byte [ebp - 0x210], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x218], 0x200
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp + 0x18]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.10003420
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x220]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10008dc8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e14a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x24c], 0
push 0x10102db4
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 1
push str.vm_samSAMDomainsAccountUsers
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x140]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x248]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x10008e80
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [ebp - 0x25c]
or ecx, 1
mov dword [ebp - 0x25c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
jmp 0x10008fc6
mov byte [ebp - 0x28], 0
xor edx, edx
mov dword [ebp - 0x27], edx
mov dword [ebp - 0x23], edx
mov byte [ebp - 0x1f], dl
mov eax, 1
test eax, eax
je 0x10008f9c
mov dword [ebp - 0x2c], 0x104
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x260], ecx
mov edx, dword [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x140]
push eax
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x10008f08
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10008f9c
lea eax, [ebp - 0x13c]
push eax
call fcn.10008d08
add esp, 4
mov dword [ebp - 0x258], eax
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x258]
jne 0x10008f97
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [ebp - 0x10]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x12]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x14]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x16]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1a]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x1c]
and edx, 0xffff
push edx
push str._d__02d__02d__02d:_02d:_02d
lea eax, [ebp - 0x30]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x20
jmp 0x10008f9c
jmp 0x10008e8f
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x25c]
or edx, 1
mov dword [ebp - 0x25c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000aa47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.1000d350
push edi
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov byte [ebp - 0x1000c], 0
mov ecx, 0x3fff
xor eax, eax
lea edi, [ebp - 0x1000b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1000c]
test eax, eax
jne 0x1000aa9e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1000abc1
mov dword [ebp - 0x10010], 0
jmp 0x1000aab9
mov edx, dword [ebp - 0x10010]
add edx, 1
mov dword [ebp - 0x10010], edx
cmp dword [ebp - 0x10010], 0x10000
jge 0x1000aada
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x10010]
mov byte [ebp + ecx - 0x1000c], al
jmp 0x1000aaaa
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
ja 0x1000abbf
jb 0x1000ab02
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x1000abbf
xor ecx, ecx
mov cl, byte [0x10102df8]
test ecx, ecx
je 0x1000ab15
mov al, 1
jmp 0x1000abc1
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 4]
mov dword [ebp - 0x10020], edx
mov dword [ebp - 0x1001c], eax
cmp dword [ebp - 0x1001c], 0
ja 0x1000ab42
cmp dword [ebp - 0x10020], 0x100000
jbe 0x1000ab4b
mov dword [ebp - 0xc], 0x100000
jmp 0x1000ab5a
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x10000
jbe 0x1000ab6a
mov dword [ebp - 0xc], 0x10000
push 0
lea eax, [ebp - 0x10018]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x1000c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 0x10014], al
mov ecx, dword [ebp - 0x10014]
and ecx, 0xff
test ecx, ecx
jne 0x1000aba2
xor al, al
jmp 0x1000abc1
mov edx, dword [ebp - 0x10018]
xor eax, eax
mov ecx, dword [ebp - 8]
add ecx, edx
mov edx, dword [ebp - 4]
adc edx, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
jmp 0x1000aae8
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000aef6
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push edi
mov byte [ebp - 0x820], 0
mov ecx, 0x207
xor eax, eax
lea edi, [ebp - 0x81f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5c
mov edx, dword [ebp + 0xc]
push edx
call fcn.1000ce00
add esp, 8
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x824]
sub eax, dword [ebp + 0xc]
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x820]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x828], 0x19
jmp 0x1000af7a
mov eax, dword [ebp - 0x828]
add eax, 1
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0x1a
jae 0x1000b014
mov ecx, dword [ebp - 0x830]
add ecx, 1
mov dword [ebp - 0x82c], ecx
jmp 0x1000afa7
mov edx, dword [ebp - 0x82c]
add edx, 1
mov dword [ebp - 0x82c], edx
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
cmp dword [ebp - 0x82c], eax
jae 0x1000afe5
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x82c]
movsx edx, byte [ecx]
cmp edx, 0x2e
je 0x1000afe3
movsx eax, byte [ebp - 0x828]
add eax, 0x41
mov ecx, dword [ebp - 0x82c]
mov byte [ebp + ecx - 0x820], al
jmp 0x1000af98
lea edx, [ebp - 0x820]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000affc
jmp 0x1000b014
lea ecx, [ebp - 0x820]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x1000af6b
pop edi
mov esp, ebp
pop ebp
ret