joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15be4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x15da0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x15c45
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x15dbc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x15cb7
xor eax, eax
push ebp
push 0x15cb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00015a3c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x15c99
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x15ddc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x15cb7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x15d98
cmp byte [ebp - 0xd], 0
jne 0x15cf9
cmp byte [ebp - 0x12], 0
je 0x15d98
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x15d12
dec ebx
cmp byte [ebx], 0x2e
je 0x15d21
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x15d11
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x15d98
inc ebx
cmp byte [ebp - 0x12], 0
je 0x15d4e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x15d98
cmp byte [ebp - 0xd], 0
je 0x15d98
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x15d98
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x16350
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x163ac
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x1639e
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x16393
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x1638e
mov eax, 0x64
jmp 0x163a3
call sub.kernel32.dll_GetLastError
call fcn.0001280c
xor eax, eax
jmp 0x1638e
mov eax, 0x67
jmp 0x163a3
Function at 0x163b4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x1640f
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x16401
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x163f6
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x163f1
mov eax, 0x65
jmp 0x16406
call sub.kernel32.dll_GetLastError
call fcn.0001280c
xor eax, eax
jmp 0x163f1
mov eax, 0x67
jmp 0x16406

Function at 0x165e8
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x16618
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x1660e
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.0001281c
or eax, 0xffffffff
jmp 0x1660c
mov eax, 0x67
call fcn.0001280c
or eax, 0xffffffff
jmp 0x1660c

Function at 0x19c98
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00012c70
ret
Function at 0x1a500
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, eax
lea edi, [esp]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, edx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
xor ecx, ecx
mov eax, esp
lea edx, [esp + 0x10]
xor ebx, ebx
mov bl, cl
mov edi, 0x1a55c
mov bl, byte [edi + ebx - 1]
xor bl, byte [eax]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp cl, 0x10
jne 0x1a527
mov edi, esi
lea esi, [esp + 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x1b9e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014620
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1b9f9
test al, 0x10
jne 0x1b9fd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x1ba04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014620
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1ba1d
test al, 0x10
je 0x1ba21
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x1bd9c
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.000271f0
mov dword [esp + 4], 0x400
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_GetUserNameW
mov eax, ebx
mov edx, dword [esp]
call fcn.00014548
mov eax, esp
mov edx, 0x400
call fcn.00027218
pop ecx
pop edx
pop ebx
ret

Function at 0x1bde8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x400
call fcn.000271f0
mov dword [esp], 0x400
push esp
mov eax, dword [esp + 8]
push eax
push 2
call sub.secur32.dll_GetUserNameExW
mov eax, ebx
mov edx, dword [esp + 4]
call fcn.00014548
lea eax, [esp + 4]
mov edx, 0x400
call fcn.00027218
pop ecx
pop edx
pop ebx
ret

Function at 0x1be30
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, esp
mov edx, 0x20
call fcn.000271f0
mov eax, ebx
call fcn.000143f0
mov dword [esp + 4], 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x1be70
mov eax, ebx
mov edx, dword [esp]
call fcn.00014548
jmp 0x1be7c
mov eax, ebx
mov edx, 0x1be90
call fcn.0001442c
mov eax, esp
mov edx, 0x20
call fcn.00027218
pop ecx
pop edx
pop ebx
ret

Function at 0x1bf0c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00014620
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x1bf2e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x1bf34
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014620
push eax
call sub.kernel32.dll_GetFileAttributesW
pop ebx
ret
Function at 0x1bf50
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1c068
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00013d18
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, ebx
call fcn.00014620
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x1c02d
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA
test al, al
je 0x1c01e
xor eax, eax
push ebp
push 0x1c00c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00027338
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00013e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1c01e
cmp dword [ebp - 0x20], 0
je 0x1c02d
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00013d6c
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00027218
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.00027218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1c06f
lea eax, [ebp - 0x1c]
call fcn.00013d18
ret
Function at 0x1ca88
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1cbcc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.000143f0
lea eax, [ebp - 0xc]
call fcn.000143f0
lea eax, [ebp - 4]
mov edx, 0x800
call fcn.000271f0
push 0x7fe
mov eax, dword [ebp - 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jbe 0x1cae4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00014548
lea eax, [ebp - 4]
mov edx, 0x800
call fcn.00027218
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0001bc38
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0001c9b0
test ebx, ebx
jne 0x1cb1a
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0001442c
jmp 0x1cba4
test ebx, ebx
jle 0x1cba4
xor edi, edi
call sub.kernel32.dll_GetCommandLineW
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x1cb81
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_CommandLineToArgvW
mov edi, eax
cmp dword [ebp - 0x10], 0
jle 0x1cb81
test edi, edi
je 0x1cb81
mov eax, dword [ebp - 0x14]
call fcn.00014630
test eax, eax
jle 0x1cb81
lea eax, [ebp - 8]
mov edx, dword [edi]
call fcn.00014548
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0001c9b0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.0001495c
test eax, eax
jne 0x1cb81
dec ebx
test edi, edi
je 0x1cb9a
cmp dword [ebp - 0x10], 0
jle 0x1cb9a
cmp ebx, dword [ebp - 0x10]
jge 0x1cb9a
mov eax, esi
mov edx, dword [edi + ebx*4]
call fcn.00014548
test edi, edi
je 0x1cba4
push edi
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1cbd3
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00014408
ret
Function at 0x1cf84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d060
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi], 0xffffffff
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [edi + 8]
call fcn.00014620
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
mov dword [edi], esi
cmp esi, 0xffffffff
jne 0x1cfdc
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
jmp 0x1d04a
mov eax, ebx
mov byte [edi + 4], al
cmp al, 2
jne 0x1d035
xor eax, eax
mov dword [edi + 0xc], eax
lea eax, [ebp - 8]
mov edx, 0x1d074
call fcn.0001442c
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00014630
add eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00014620
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1d02c
mov eax, 2
mov dword [edi + 0x10], eax
mov dword [edi + 0xc], eax
xor ebx, ebx
jmp 0x1d04a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
jmp 0x1d04a
cmp al, 1
jne 0x1d045
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0xc], eax
xor ebx, ebx
jmp 0x1d04a
mov ebx, 0x6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d067
lea eax, [ebp - 8]
call fcn.000143f0
ret

Function at 0x1d078
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1d148
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx]
cmp esi, 0xffffffff
jne 0x1d0a9
mov esi, 0x6e
jmp 0x1d132
cmp byte [ebx + 4], 2
jne 0x1d120
lea eax, [ebp - 8]
mov edx, edi
call fcn.0001442c
lea eax, [ebp - 8]
mov edx, 0x1d15c
call fcn.0001463c
lea eax, [ebp - 8]
mov edx, 0x1d164
call fcn.0001463c
push 0
push 0
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00014630
add eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00014620
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1d117
xor esi, esi
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], eax
jmp 0x1d132
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x1d132
cmp byte [ebx + 4], 1
jne 0x1d12d
mov esi, 1
jmp 0x1d132
mov esi, 0x6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d14f
lea eax, [ebp - 8]
call fcn.000143f0
ret
Function at 0x1d168
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1d234
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0xffffffff
jne 0x1d196
mov esi, 0x6e
jmp 0x1d21e
mov al, byte [ebx + 4]
cmp al, 2
jne 0x1d1a4
mov esi, 1
jmp 0x1d21e
cmp al, 1
jne 0x1d219
lea eax, [ebp - 4]
mov edx, esi
call fcn.00013db0
lea eax, [ebp - 4]
mov edx, 0x1d24c
call fcn.00013fb0
lea eax, [ebp - 4]
mov edx, 0x1d258
call fcn.00013fb0
push 0
push 0
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00013fa8
push eax
lea eax, [ebp - 4]
call fcn.00014178
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1d210
xor esi, esi
mov eax, dword [ebp - 8]
add dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], eax
jmp 0x1d21e
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x1d21e
mov esi, 0x6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d23b
lea eax, [ebp - 4]
call fcn.00013d18
ret

Function at 0x24424
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x24571
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x24545
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x2447b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x16a878], 0
je 0x24471
mov eax, dword [0x16a878]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x24485
xor eax, eax
mov dword [0x16a878], eax
xor eax, eax
push ebp
push 0x244b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x16a880], 0
je 0x244ae
mov eax, dword [0x16a880]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x244c2
xor eax, eax
mov dword [0x16a880], eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00027444
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x24588
call fcn.00013ff4
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x16a880], eax
cmp dword [0x16a880], 0
je 0x2453b
push 0
push 0
push 0
push 4
mov eax, dword [0x16a880]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x16a878], eax
cmp dword [0x16a878], 0
jne 0x2453b
mov eax, dword [0x16a880]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x16a880], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x24556
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x24578
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00013d3c
ret
Function at 0x246a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov edx, dword [0x16a888]
call fcn.000271f0
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [0x16a888]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
push eax
call sub.kernel32.dll_ReadFile_1
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x24], eax
lea edx, [ebp - 4]
mov eax, 0x16a878
mov ecx, 4
call fcn.0001291c
add dword [ebp - 4], 0x138
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp eax, dword [0x16a888]
jne 0x247c9
mov eax, dword [0x253944]
add eax, 0x107884
add eax, 0x400
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push 0
mov eax, dword [0x16a888]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xc]
mov eax, dword [ebp - 4]
call fcn.00022e74
mov edx, dword [ebp + 8]
mov dword [edx - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x28], 0
jne 0x247c9
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
xor ecx, ecx
mov edx, 0x10
call fcn.00012c70
cmp dword [0x253940], 7
jne 0x2479e
lea ecx, [ebp - 0x14]
mov edx, dword [0x253944]
add edx, 0x107884
mov eax, dword [ebp - 4]
call fcn.00019dc8
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x14]
lea edi, [eax - 0x1c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edx, 0x253930
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
mov ecx, 0x10
call fcn.00027350
test al, al
je 0x247c9
mov bl, 1
mov eax, 0x16a858
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x2c]
call fcn.0001442c
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov edx, dword [0x16a888]
call fcn.00027218
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x27550
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0001416c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x27572
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x27684
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x27727
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x276fa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000142dc
push 0x3ff
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jle 0x276e5
cmp eax, 0x3ff
jge 0x276e5
lea edx, [ebp - 8]
xchg edx, eax
call fcn.000142dc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00013d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x27711
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2772e
lea eax, [ebp - 8]
call fcn.00013d18
ret

Function at 0x27744
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov edx, 0x800
call fcn.000271f0
xor edx, edx
push ebp
push 0x277a8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x3ff
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
jle 0x27791
cmp eax, 0x3ff
jge 0x27791
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00014548
jmp 0x2779e
mov eax, dword [ebp - 4]
mov edx, 0x277d8
call fcn.0001442c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x277bf
lea eax, [ebp - 8]
mov edx, 0x800
call fcn.00027218
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x277dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x2787f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x27852
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000142dc
mov eax, dword [ebp - 8]
call fcn.0001416c
push eax
push 0x3ff
call sub.kernel32.dll_GetTempPathA
test eax, eax
jle 0x2783d
cmp eax, 0x3ff
jge 0x2783d
lea edx, [ebp - 8]
xchg edx, eax
call fcn.000142dc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00013d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x27869
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x27886
lea eax, [ebp - 8]
call fcn.00013d18
ret
Function at 0x278b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x279e0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x279ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.000149ac
mov eax, dword [ebp - 0xc]
call fcn.00014620
push eax
push 0x3ff
call sub.kernel32.dll_GetTempPathW
mov ebx, eax
test ebx, ebx
jbe 0x27913
cmp ebx, 0x3ff
jae 0x27913
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.000149ac
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0001442c
xor eax, eax
push ebp
push 0x2798f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x2800
call fcn.000149ac
mov ebx, 0x2800
push ebx
mov eax, dword [ebp - 8]
call fcn.00014620
push eax
mov eax, dword [ebp - 0xc]
call fcn.00014620
push eax
call sub.kernel32.dll_GetLongPathNameW
mov ebx, eax
test ebx, ebx
jbe 0x27985
cmp ebx, 0x27f6
jae 0x27985
lea eax, [ebp - 8]
mov edx, ebx
call fcn.000149ac
mov eax, dword [ebp - 8]
call fcn.0001b9e0
test al, al
je 0x27985
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0001442c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x279a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x279c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x279e7
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00014408
ret

Function at 0x27a14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
mov edx, 0x27ad0
call fcn.0001442c
lea eax, [esp + 4]
mov edx, 0x1000
call fcn.000271f0
xor eax, eax
mov dword [esp], eax
push esp
mov eax, dword [0x16a95c]
add eax, case.0x1ffea.3
push eax
push 0
push 0x27af4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x27aa9
mov dword [esp + 8], 0x1000
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x27b20
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x27aa9
cmp dword [esp + 0xc], 1
jne 0x27aa9
cmp dword [esp + 8], 0
jbe 0x27aa9
cmp dword [esp + 8], 0xfff
ja 0x27aa9
mov eax, ebx
mov edx, dword [esp + 4]
call fcn.00014548
cmp dword [esp], 0
je 0x27ab8
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [esp + 4]
mov edx, 0x1000
call fcn.00027218
add esp, 0x10
pop ebx
ret