joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fac0
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x503000]
cmp dword [eax], 2
je 0x47fadd
mov byte [ebp - 1], 1
jmp 0x47fcab
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x501dd4
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x47fcab
xor eax, eax
push ebp
push 0x47fca4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x47fb3f
push 0x47fcb8
push 0x47fce4
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409600
mov ebx, eax
test ebx, ebx
je 0x47fb66
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x47fc8d
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x47fc8d
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x47fbb7
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x47fb98
call fcn.00404b68
jmp 0x47fcab
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x47fbb7
call fcn.00404b68
jmp 0x47fcab
xor eax, eax
push ebp
push 0x47fc86
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x47fbfa
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x47fbfa
call fcn.00404b68
call fcn.00404b68
jmp 0x47fcab
mov eax, dword [ebp - 0x14]
call fcn.00403018
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x47fc2c
call fcn.00404b68
call fcn.00404b68
jmp 0x47fcab
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x47fc67
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x47fc63
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x47fc63
mov byte [ebp - 1], 1
jmp 0x47fc67
inc ebx
dec esi
jne 0x47fc39
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fc8d
mov eax, dword [ebp - 0x18]
call fcn.00403034
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fcab
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af334
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00406430
xor eax, eax
push ebp
push 0x4af418
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x4af37b
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0047e240
cmp dword [ebp + 0x18], 0
jne 0x4af37b
lea eax, [ebp + 0x18]
call fcn.0047f214
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403540
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x4af3a6
mov eax, ebx
call fcn.004064d4
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.004064d4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004064d4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.004064d4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4af3e8
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x4af402
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x4af402
push esi
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ebp + 0x14]
call fcn.004aefd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af41f
lea eax, [ebp + 0x18]
call fcn.00406438
ret

Function at 0x4af61c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4af64a
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00406630
jmp 0x4af653
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x24
pop ebx
ret

Function at 0x4af658
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4af689
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00406630
jmp 0x4af692
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x208
pop ebx
ret

Function at 0x4af6a4
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x503000]
cmp dword [eax], 2
jne 0x4af70c
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4af6c7
xor eax, eax
jmp 0x4af71b
lea eax, [esp + 8]
push eax
push 0x4af720
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4af70c
xor eax, eax
jmp 0x4af71b
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x4b3230
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x4b330a
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4b331c
call fcn.004b2444
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3288
mov eax, 0x4b337c
call fcn.004b21c0
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4b3273
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4b32db
cmp dword [esp], 0
jne 0x4b32bd
mov eax, 0x4b33d4
call fcn.004b21c0
jmp 0x4b32e5
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4b3410
call fcn.004b2444
jmp 0x4b32e5
mov eax, 0x4b3478
call fcn.004b21c0
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x4b330a
push 0xfa
call sub.kernel32.dll_Sleep_1
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x4bec60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x4bec74
add esp, 0xfffffff0
call fcn.004044d0
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0045db9c
mov eax, dword [0x4bed18]
not eax
and eax, dword [esi + 0x50]
mov dword [esi + 0x50], eax
mov edx, 0x79
mov eax, esi
call fcn.0045a22c
mov edx, 0x61
mov eax, esi
call fcn.0045a260
xor edx, edx
mov eax, esi
call fcn.0045ada8
mov dl, 1
mov eax, esi
call fcn.004637c0
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jae 0x4becd3
mov dx, 0xfffe
mov eax, esi
call fcn.0045adf0
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x4becf9
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x64]
call fcn.00430ae0
mov eax, esi
test bl, bl
je 0x4bed0e
call fcn.00404528
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
Function at 0x4c0270
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c0466
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4c02f5
lea edx, [ebp - 0x264]
mov eax, edi
call fcn.0047e2f8
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.0047dd64
mov eax, dword [ebp - 0x268]
pop edx
call fcn.0047df7c
test eax, eax
jne 0x4c02f5
lea edx, [ebp - 4]
mov eax, edi
call fcn.0047e2d0
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c0434
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x26c]
mov eax, ebx
call fcn.0047dd64
lea eax, [ebp - 0x26c]
mov edx, 0x4c0480
call fcn.00406844
mov eax, dword [ebp - 0x26c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4c041d
xor eax, eax
push ebp
push 0x4c0416
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.004be5e0
test al, al
je 0x4c03e7
lea eax, [ebp - 8]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00406630
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0047df7c
test eax, eax
je 0x4c03e7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.004bf8c4
test eax, eax
jne 0x4c03e7
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.0047dd64
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 8]
call fcn.00406844
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.004be724
mov eax, dword [ebp - 0x270]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.004bf7d0
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4c035d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c041d
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c043b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4dfccc
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x50a095], 1
call fcn.004af6a4
test al, al
jne 0x4dfd1e
push 5
mov eax, dword [0x502e08]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x502e08]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x502e18]
mov eax, dword [eax + 0x124]
mov cl, 2
xor edx, edx
call fcn.004dfbb0
ret

Function at 0x4e2e8c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4e2eb1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e4bd8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4e4c04
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4e4c0d
call fcn.004e38f8
mov eax, 0xa
call fcn.00480754
call fcn.004e38f8
call fcn.004e4ba4
test al, al
jne 0x4e4be2
pop ebx
ret

Function at 0x4e5130
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x5029b4]
cmp dword [eax], 0
je 0x4e51db
mov eax, dword [0x5029b4]
mov eax, dword [eax]
call fcn.00463890
test al, al
je 0x4e51db
mov eax, dword [0x5029b4]
mov eax, dword [eax]
cmp byte [eax + 0x1e2], 0
je 0x4e5185
cmp byte [ebx + 0x389], 0
jne 0x4e5185
mov eax, dword [0x502e08]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4e5189
xor eax, eax
jmp 0x4e518b
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x5029b4]
mov eax, dword [eax]
call fcn.004634e4
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x4e51db
test bl, bl
je 0x4e51c7
push 5
mov eax, dword [0x5029b4]
mov eax, dword [eax]
call fcn.004634e4
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e51db
push 0
mov eax, dword [0x5029b4]
mov eax, dword [eax]
call fcn.004634e4
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x1002306
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x1002343
add esi, ecx
mov ax, word [esi]
test ax, ax
je 0x100233b
cmp ax, 0x22
jne 0x100232b
cmp word [esi], 0x22
jne 0x100235b
jmp 0x1002359
cmp ax, 0x20
jbe 0x100235b
add esi, ecx
cmp word [esi], 0x20
ja 0x1002349
jmp 0x100235b
cmp ax, 0x20
ja 0x1002363
add esi, ecx
mov ax, word [esi]
test ax, ax
jne 0x1002353
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x100237d
movzx eax, word [ebp - 0x14]
jmp 0x1002380
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.01001c76
pop esi
leave
ret

Function at 0x10023ec
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1002409
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [0x100703c], 0
pop ebp
ret 4

Function at 0x1002c05
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 8
push ebx
mov dword [0x100703c], ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x1c]
test esi, esi
jne 0x1002c31
xor eax, eax
jmp 0x1002cc9
cmp dword [esi + 0x670], 0
push edi
je 0x1002c58
push 0xffffffffffffffff
push dword [esi + 0x66c]
lea edi, [esi + 0x6b0]
mov dword [edi], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [edi], 0
push esi
push 8
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push ebx
call fcn.01002520
test eax, eax
je 0x1002cbb
push 0
push dword [esi + 4]
push 0x170
push 0x3ef
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
test byte [esi + 0x65c], 1
je 0x1002cb1
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x407
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x402
push ebx
call esi
push eax
call edi
push ebx
call fcn.01002692
test eax, eax
jne 0x1002cc5
push ebx
call fcn.010023ec
xor eax, eax
jmp 0x1002cc8
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10030c8
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
call fcn.0100309d
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10030f9
push dword [ebp + 8]
call fcn.01004a68
test eax, eax
je 0x10030f9
push esi
push dword [ebp + 8]
call fcn.01004ac7
test eax, eax
jne 0x1003100
xor eax, eax
jmp 0x1003239
push ebx
push dword [ebp + 8]
lea ebx, [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 0x104
push eax
lea ecx, [esi + 0x418]
push ecx
push edi
push edi
push edi
push eax
lea eax, [esi + 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x100317f
test byte [ebp + 0xc], 1
je 0x1003147
push 0x68
push dword [0x1007038]
call dword [sym.imp.USER32.dll_LoadIconW]
jmp 0x100314f
push edi
push dword [esi]
call fcn.01004b7e
mov dword [esi + 4], eax
lea eax, [esi + 0x620]
push eax
push dword [esi]
call fcn.01004c73
test eax, eax
je 0x100317f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x100318d
mov ecx, esi
call fcn.0100309d
xor eax, eax
jmp 0x1003238
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
imul ebx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jb 0x10031a4
sub eax, dword [ebp - 4]
mov dword [ebp + 8], eax
jmp 0x10031a7
mov dword [ebp + 8], edi
xor eax, eax
push eax
push ebx
push edi
push dword [ebp - 4]
call fcn.01005780
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
push ebx
push eax
push dword [ebp + 8]
mov edi, edx
call fcn.01005780
mov ebx, eax
add eax, dword [ebp - 0x18]
mov ecx, edx
mov dword [ebp - 0x1c], ecx
adc ecx, edi
push ecx
push eax
xor eax, eax
mov ax, word [esi]
push eax
call fcn.01004b61
cmp edx, edi
mov dword [esi + 0x640], eax
mov dword [esi + 0x644], edx
jb 0x1003202
ja 0x10031f6
cmp eax, dword [ebp - 0x18]
jb 0x1003202
mov dword [esi + 0x664], 1
jmp 0x1003209
and dword [esi + 0x664], 0
mov eax, dword [ebp - 0x18]
and dword [esi + 0x638], 0
and dword [esi + 0x63c], 0
mov dword [esi + 0x628], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x634], eax
xor eax, eax
mov dword [esi + 0x62c], edi
mov dword [esi + 0x630], ebx
inc eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1003244
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1007028]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x90], ebx
je 0x100328d
mov ecx, dword [eax]
lea edx, [ebp - 0x90]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x14], ebx
cmp dword [esi + 0x18], ebx
je 0x10033af
mov eax, dword [edi + 0x65c]
test eax, eax
push 4
pop ebx
jns 0x1003359
test al, 1
je 0x10032d6
mov eax, dword [ebp - 0x8c]
push 2
pop edi
push dword [eax + 0x660]
lea eax, [ebp - 0x84]
push 0x1001570
push 0x1001560
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x10032eb
push 0x1001570
lea eax, [ebp - 0x84]
xor edi, edi
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0x18]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esi + 0x244], 0
je 0x1003336
or dword [ebp - 0x88], edi
jmp 0x100333e
not edi
and dword [ebp - 0x88], edi
push ebx
lea eax, [ebp - 0x88]
push eax
push ebx
push 0
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esi + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
test byte [ebp - 0x90], bl
je 0x10033af
cmp dword [esi + 0x244], 0
je 0x10033af
lea eax, [ebp - 0x8c]
push eax
push 0xf003f
push 0
push 0x10014e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10033af
lea eax, [esi + 0x1c]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x8c]
call edi
mov eax, dword [esi + 0x228]
test eax, eax
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
je 0x10033c2
push eax
call edi
mov esi, dword [esi + 0x224]
test esi, esi
je 0x10033cf
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005499
leave
ret 4
Function at 0x1003465
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1007028]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor esi, esi
inc ebx
cmp dword [ebp + 0xc], esi
push eax
je 0x100349a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
jmp 0x100351f
lea eax, [ebp - 0x61c]
push 0x1001588
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10035a7
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x62c]
push eax
push esi
push esi
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100350a
mov dword [ebp + 0xc], ebx
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], esi
je 0x10035a7
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jle 0x1003557
mov ax, word [ebp + esi*2 - 0x20c]
cmp ax, 0x2c
je 0x1003557
mov word [ebp + esi*2 - 0x414], ax
lea eax, [ebp - 0x20c]
push eax
inc esi
call edi
cmp esi, eax
jl 0x1003533
lea eax, [esi + esi]
and word [ebp + eax - 0x414], 0
lea eax, [ebp + eax - 0x20a]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push ebx
lea ecx, [ebp - 0x624]
push ecx
lea ecx, [ebp - 0x630]
push ecx
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
pop edi
je 0x10035a7
mov eax, dword [ebp - 0x624]
test eax, eax
jne 0x10035b5
mov eax, dword [ebp - 0x630]
test eax, eax
jne 0x10035b5
push 0x6f
push dword [0x1007044]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01005499
leave
ret 8