joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b308
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.1003bb0a
push esi
test eax, eax
je 0x1003b395
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10062cf0
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x1003b38c
cmp esi, 0xffffffff
je 0x1003b38c
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x1003b388
push edi
lea eax, [esp + 0xc]
push eax
call fcn.1003bb0a
test eax, eax
je 0x1003b38c
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1003b36e
lea ecx, [esp + 4]
call fcn.10001340
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.1005ebcb
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b3aa
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 8
mov eax, 0x10076f05
call fcn.10060091
mov eax, dword [ebp + 0x238]
mov dword [ebp - 0x14], eax
test edi, edi
je 0x1003b43f
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x1003b437
cmp esi, 0xffffffff
je 0x1003b437
push 0x228
lea eax, [ebp + 4]
push 0
push eax
mov dword [ebp], 0x22c
call fcn.10062cf0
add esp, 0xc
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1003b433
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x1003b437
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1003b41c
lea ecx, [ebp - 0x10]
call fcn.10001340
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.1005ebcb
add ebp, 0x230
leave
ret 4

Function at 0x1003b464
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x1003b477
xor eax, eax
jmp 0x1003b4d0
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.10062cf0
mov dword [ebp - 0x14], esi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
add esp, 0xc
call fcn.100399e9
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1003b4c8
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.10039a16
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x1003b5b1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x1003b5ca
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.1003b4d6
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x1003b6c6
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.1003b3aa
cmp dword [ebp - 0x14], esi
je 0x1003b5c1
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x1003b606
cmp eax, 0xffffffff
jne 0x1003b612
lea ecx, [ebp - 0x10]
call fcn.10001340
mov eax, esi
jmp 0x1003b5c3
lea ecx, [ebp - 8]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1003b606
push esi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1003b6bc
mov edi, dword [ebp + 8]
call fcn.100399e9
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x74], 0x44
call fcn.10062cf0
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x44], ax
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x48], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1003b6ab
push dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
call ebx
push dword [ebp + 8]
call fcn.10039a16
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 8]
call ebx
jmp 0x1003b606

Function at 0x1003b876
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 4], eax
test edi, edi
jne 0x1003b89d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005ebcb
leave
ret 4
push esi
push dword [ebp + 8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
je 0x1003b8bf
cmp esi, 0xffffffff
jne 0x1003b8d1
xor esi, esi
lea ecx, [ebp - 0x210]
call fcn.10001340
mov eax, esi
pop esi
jmp 0x1003b88f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10062cf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jbe 0x1003b8bf
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.1003ad0f
xor esi, esi
inc esi
jmp 0x1003b8c1
Function at 0x1003b96d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp + 8], eax
jne 0x1003b980
xor eax, eax
inc eax
jmp 0x1003b9b2
push esi
push dword [ebp + 8]
xor esi, esi
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
cmp eax, esi
je 0x1003b9a7
cmp eax, 0xffffffff
je 0x1003b9a7
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
lea ecx, [ebp + 8]
call fcn.10001340
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1003bc79
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
or dword [esi], 0xffffffff
push ebx
push dword [esp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003bd0e
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x1003bd0e
push edi
lea edi, [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1003bd0d
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov edx, ecx
or edx, eax
je 0x1003bd0d
cmp eax, ebx
jl 0x1003bce2
mov eax, 0x400000
jg 0x1003bcde
cmp ecx, eax
jbe 0x1003bce2
mov edi, eax
jmp 0x1003bce4
mov edi, ecx
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi]
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x1003bd0d
push dword [esi + 0x18]
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop ebx
ret 4

Function at 0x1003c5e2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x4f90]
mov eax, 0x5010
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x4f8c], eax
cmp dword [ebp + 0x4f9c], 0
mov eax, dword [ebp + 0x4f98]
push esi
mov dword [ebp - 0x78], eax
mov esi, 0x80000002
je 0x1003c66b
xor eax, eax
push 0x4ffe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.10062cf0
and dword [ebp - 0x7c], 0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x80], 0x5000
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x7c], 1
jne 0x1003c66b
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1003c66b
inc eax
jmp 0x1003c693
xor eax, eax
cmp dword [ebp - 0x78], eax
je 0x1003c67b
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x78]
push 1
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x4f8c]
xor ecx, ebp
pop esi
call fcn.1005ebcb
add ebp, 0x4f90
leave
ret 8
Function at 0x1003c7d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a1f6
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov esi, edx
mov dword [ebp - 0x2018], ecx
mov dword [ebp - 0x202c], edi
call fcn.1002b0f0
lea eax, [ebp - 0x201c]
push eax
xor ebx, ebx
inc ebx
push ebx
push edi
push dword [ebp - 0x2018]
mov dword [ebp - 0x202c], ebx
push esi
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x201c], edi
je 0x1003c90a
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.10062cf0
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1003c8f0
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
lea ecx, [ebp - 0x2048]
call fcn.10007820
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2028]
push eax
call fcn.10021a90
lea esi, [ebp - 0x2048]
mov byte [ebp - 4], bl
call fcn.1002fe50
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x201c]
mov dword [ebp - 0x2024], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1003c89d
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x201c], edi
je 0x1003c928
push dword [ebp - 0x201c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005ebcb
leave
ret
Function at 0x1003c948
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a1f6
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov ebx, ecx
mov dword [ebp - 0x202c], edi
call fcn.1002b0f0
lea eax, [ebp - 0x201c]
push eax
push 8
push edi
xor esi, esi
push ebx
inc esi
push 0x80000002
mov dword [ebp - 0x202c], esi
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x201c], edi
je 0x1003ca77
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.10062cf0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1003ca61
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
lea ecx, [ebp - 0x2048]
call fcn.10007820
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2028]
push eax
call fcn.10021a90
lea esi, [ebp - 0x2048]
mov byte [ebp - 4], 1
call fcn.1002fe50
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x201c]
mov dword [ebp - 0x2024], 0x1000
call ebx
test eax, eax
je 0x1003ca0d
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x201c], edi
je 0x1003ca95
push dword [ebp - 0x201c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005ebcb
leave
ret

Function at 0x1003cab5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push 1
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1003cb04
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1003cb99
Capabilities:
Check if file exists
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0xc], 3
jbe 0x1003cbad
cmp dword [ebp + 0xc], esi
ja 0x1003cc1b
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003cc1b
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0xf003f
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1003cc13
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov eax, str.gxdte
push 1
push dword [ebp + 0xc]
push 2
push 0xf01ff
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.1003cb79
xor eax, eax
cmp dword [ebp - 4], esi
setne al
jmp 0x1003cc1d
lea eax, [ebp - 8]
call fcn.1003cb79
xor eax, eax
pop esi
leave
ret 8

Function at 0x1003cd31
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push 4
push edi
push edi
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1003cd8b
push 4
push str.gxdte
lea esi, [ebp - 8]
call fcn.1003cb4b
cmp dword [ebp - 8], edi
je 0x1003cd8b
push 6
mov dword [ebp - 0x24], edi
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1003cd8b
cmp dword [ebp - 0x20], 4
jne 0x1003cd8b
inc ebx
lea eax, [ebp - 8]
call fcn.1003cb79
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1003cd9a
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x23
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1003ce07
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10062cf0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1003ce07
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc ebx
cmp dword [ebp - 0x80], 0
je 0x1003ce16
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x18c]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1005ebcb
add ebp, 0x190
leave
ret
Function at 0x1003f549
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1790]
mov eax, 0x1810
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x178c], eax
push esi
push 4
pop esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.Softwareprojonepodlp_smpcache_
push 0x80000002
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1003f59a
cmp dword [ebp - 0x7c], esi
jne 0x1003f59a
mov eax, dword [ebp - 0x78]
jmp 0x1003f59c
xor eax, eax
test eax, eax
je 0x1003f625
push edi
push 0x7fe
lea eax, [ebp + 0xf8e]
push 0
push eax
call fcn.10062cf0
mov esi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
add esp, 0xc
push 0x5b
pop eax
mov edi, 0x400
push edi
mov word [ebp + 0xf8c], ax
push ebx
lea eax, [ebp + 0xf8c]
push eax
call esi
push 0x100880cc
lea eax, [ebp + 0xf8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push dword [ebp + 0x1798]
lea eax, [ebp + 0xf8c]
push eax
call esi
lea eax, [ebp + 0x179c]
push eax
lea eax, [ebp + 0xf8c]
push eax
push 0x800
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
mov ecx, dword [ebp + 0x178c]
xor ecx, ebp
pop esi
call fcn.1005ebcb
add ebp, 0x1790
leave
ret

Function at 0x1003f70f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
call fcn.1003f7ee
test al, al
je 0x1003f7e1
xor eax, eax
mov word [ebp - 0x80c], ax
mov word [ebp - 0x100c], ax
push 0x100880e8
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x100880fc
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2028]
push eax
call fcn.1003f63b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x1003f780
mov eax, dword [eax + 4]
jmp 0x1003f783
add eax, 4
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x100c]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea esi, [ebp - 0x2028]
call fcn.1002fe50
xor eax, eax
mov word [ebp - 0x200c], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x800
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.1005ebcb
leave
ret
Function at 0x1004017b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007d32c
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push esi
push edi
mov eax, dword [0x10099060]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.10040144
pop ecx
push ebx
lea ebx, [esp + 0x28]
mov edi, eax
call fcn.10044502
push dword [ebp + 0x14]
and dword [esp + 0x10c], 0
push edi
push esi
call fcn.1003fa9a
add esp, 0xc
test eax, eax
jne 0x1004022d
xor ebx, ebx
or dword [esp + 0x108], 0xffffffff
lea esi, [esp + 0x24]
call fcn.10044696
mov eax, ebx
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.1005ebcb
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
push 0x7e
push eax
mov word [esp + 0x7c], ax
lea eax, [esp + 0x7e]
push eax
call fcn.10062cf0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, dword [0x100a20e0]
inc dword [0x100a20e0]
call fcn.1003ab67
push eax
movzx eax, word [esp + 0x24]
push esi
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push eax
push str._04d__02d__02d__02d:_02d:_02d__d__08x
lea eax, [esp + 0x98]
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x2c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x5c]
call fcn.10045a67
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x110], 1
call fcn.10001360
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x100402cc
mov eax, dword [eax + 4]
jmp 0x100402cf
add eax, 4
push 0
push eax
lea ebx, [esp + 0x7c]
mov edi, str.Softwareprojonepodlp_rptcachependings_
call fcn.1003c5e2
lea esi, [esp + 0x3c]
mov ebx, eax
call fcn.1002fe50
lea ecx, [esp + 0x58]
mov byte [esp + 0x108], 0
call fcn.100077c0
test ebx, ebx
je 0x1004030f
push str.GlobalD36B0A68_AE78_4fa2_BD9C_05FD95224F52
call fcn.1003f839
jmp 0x100401f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x78]
push eax
push edi
push str.CachedReport_write_register_failed:__s._s__d
call fcn.1003e6e9
add esp, 0x10
jmp 0x100401f4
Function at 0x1004032e
Capabilities:
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007d2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
mov eax, dword [0x10099060]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
call fcn.10040144
pop ecx
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x18], eax
call fcn.10044502
xor eax, eax
push eax
push eax
push esi
mov dword [esp + 0x244], eax
call fcn.1003fa9a
add esp, 0xc
test eax, eax
jne 0x100403e1
xor edi, edi
or dword [esp + 0x238], 0xffffffff
lea esi, [esp + 0x1c]
call fcn.10044696
mov eax, edi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1005ebcb
mov esp, ebp
pop ebp
ret 0x10
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x100404a4
xor eax, eax
cmp dword [ebp + 0x14], ebx
setne al
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100443b5
lea eax, [esp + 0x34]
push eax
mov edx, str.__transferonwer
mov byte [esp + 0x254], 1
call fcn.10045627
mov edi, eax
mov byte [esp + 0x250], bl
call fcn.10044719
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x34]
call fcn.10007820
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x240], 2
call fcn.100013e0
sub esp, 0x10
mov byte [esp + 0x250], 3
mov edx, eax
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.100444c6
lea eax, [esp + 0x34]
push eax
mov edx, str.__attachment
mov byte [esp + 0x254], 4
call fcn.10045627
mov edi, eax
mov byte [esp + 0x250], 3
call fcn.10044719
lea ecx, [esp + 0x50]
call fcn.100077c0
lea esi, [esp + 0x34]
mov byte [esp + 0x238], bl
call fcn.1002fe50
cmp dword [0x1009d2c8], ebx
je 0x100404f0
push 0x190
lea eax, [esp + 0x70]
push ebx
push eax
call fcn.10062cf0
add esp, 0xc
lea eax, [esp + 0x6c]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push ebx
push 2
push 2
call sub.WS2_32.dll_socket
mov dword [0x1009d2cc], eax
cmp eax, 0xffffffff
jne 0x100404ea
xor edi, edi
inc edi
jmp 0x100403a8
mov dword [0x1009d2c8], ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x210]
call fcn.10045a67
cmp dword [esp + 0x224], 0x10
push 2
pop eax
mov word [esp + 0x1fc], ax
mov eax, 0xe832
mov word [esp + 0x1fe], ax
mov eax, dword [esp + 0x210]
mov dword [esp + 0x200], 0x100007f
jae 0x1004053c
lea eax, [esp + 0x210]
push 0x10
lea ecx, [esp + 0x200]
push ecx
push ebx
push dword [esp + 0x22c]
push eax
push dword [0x1009d2cc]
call sub.WS2_32.dll_sendto
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
lea ecx, [esp + 0x20c]
call fcn.100077c0
mov edi, esi
jmp 0x100403a8