joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b99b8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5b99ca
add esp, 0xfffffff0
call fcn.00407fec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bb974
mov eax, dword [0x5ebaa8]
mov dword [eax + 4], ebx
mov dword [eax], 0x5b9e80
mov eax, dword [0x5ebab8]
mov dword [eax + 4], ebx
mov dword [eax], 0x5b9e8c
mov eax, ebx
call fcn.005b9e98
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5b4544
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4ecc38]
call fcn.004f2d9c
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4ecc38]
call fcn.004f2d9c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4ecc38]
call fcn.004f2d9c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4ecc38]
call fcn.004f2d9c
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4ecc38]
call fcn.004f2d9c
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005ba474
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ba2a4
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ba2a4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ba2a4
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ba2a4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5ba2a4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5b9b4a
call fcn.00408044
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5ba044
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ba1ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5ba1d0
mov dl, 1
mov eax, dword [0x487f4c]
call fcn.004ab2b8
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409700
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5ba1bf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00524fd8
test al, al
je 0x5ba1b2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5ba200
lea eax, [ebp - 0x394]
call fcn.00421ee8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5ba1b2
xor eax, eax
push ebp
push 0x5ba1ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5ba270
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5ba194
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5ba194
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba1b2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5ba0b5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004ab208
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba1f6
lea eax, [ebp - 0x3a0]
call fcn.00409700
ret

Function at 0x5bad9c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5f2760]
cmp byte [eax + 0xc5], 0
jne 0x5bae0e
cmp dword [0x5f2784], 0
jne 0x5badce
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5eb8f8]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5f2784], eax
cmp dword [0x5f2780], 0
jne 0x5bade9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5f2780], eax
cmp dword [0x5f2788], 0
jne 0x5bae0e
push esp
push 0
push 0
mov eax, dword [0x5eb8f4]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5f2788], eax
pop edx
ret
Function at 0x5bb230
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5bb247
add esp, 0xfffffff0
call fcn.00407fec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bb974
mov eax, dword [0x5eb96c]
cmp byte [eax], 0
jne 0x5bb274
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5ebc9c]
cmp word [eax + 2], 0
jne 0x5bb28e
mov eax, dword [0x5ebc9c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005bd504
mov eax, dword [0x5ebdd0]
cmp word [eax + 2], 0
jne 0x5bb2a8
mov eax, dword [0x5ebdd0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005bd708
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4ecc38]
call fcn.004f2d9c
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5bdc80
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f1660]
call fcn.004fc3ac
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5bb490
mov eax, dword [0x5ebb54]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fc844
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5bdf68
mov dl, 1
mov eax, dword [0x484790]
call fcn.00407950
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5ebb54]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421ce8
test eax, eax
je 0x5bb3c2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421b24
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421ccc
test eax, eax
je 0x5bb3da
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
push ebx
push 0x5bcee0
call fcn.005b0924
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5eb96c]
cmp byte [eax], 0
jne 0x5bb42b
mov eax, ebx
call fcn.005bb674
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005be1a0
mov eax, ebx
call fcn.005bee0c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5bb488
call fcn.00408044
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bb9b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5bba5a
cmp dword [ebx + 0xac], 0
jne 0x5bba54
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5bb8f4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5bba54
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5bba1a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5bba54
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a6958
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5bba29
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5bbc98
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f2760]
cmp dword [eax + 0x188], 0
je 0x5bbe12
test bl, bl
jne 0x5bbd5d
cmp dword [esi + 0xb4], 0
jne 0x5bbd52
mov eax, esi
call fcn.005bec5c
push eax
push 0x5bbb8c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5bbd23
mov eax, dword [0x5f2760]
cmp byte [eax + 0xeb], 0
je 0x5bbd23
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5bbd04
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbd23
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbd0c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbd52
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6958
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbd32
inc dword [esi + 0xb4]
jmp 0x5bbe12
cmp dword [esi + 0xb4], 0
jle 0x5bbe12
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5bbe12
cmp dword [esi + 0x58], 0
je 0x5bbdc7
mov eax, dword [0x5f2760]
cmp byte [eax + 0xeb], 0
je 0x5bbdc7
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5bbda8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbdc7
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbdb0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbdf6
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6958
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbdd6
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ad784]
call fcn.0040b7e0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5bca6c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5bcac9
cmp byte [ebx + 0xeb], 0
jne 0x5bcac9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409888
mov eax, dword [esi]
test eax, eax
je 0x5bcab6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5bcad6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
jmp 0x5bcad6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5be388
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5be3f9
mov eax, esi
call fcn.0051eb14
test al, al
je 0x5be3f9
mov eax, dword [ebx + 0x98]
call fcn.0051e744
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5be3f9
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5be3ea
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051e744
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00515388
jmp 0x5be3f9
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005be1c0
pop esi
pop ebx
ret
Function at 0x87174b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
xor ebx, ebx
cmp eax, ebx
je 0x8717a6
cmp eax, 0xffffffff
je 0x8717a6
cmp dword [ebp + 8], ebx
je 0x8717a6
push esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [edi + 0x44]
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
add esi, esi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x87f302
cmp esi, dword [ebp - 4]
jne 0x87f31d
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 4
mov ebx, 0x80070057
jmp 0x87179e

Function at 0x87227c
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x88621c
call fcn.00871350
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
push ebx
push 0x20019
push dword [0x88b458]
lea ecx, [ebp - 0x2c]
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.00872097
test eax, eax
jne 0x8723c4
lea eax, [ebp - 0x20]
push eax
push dword [0x88b45c]
lea ecx, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call fcn.008723dc
test eax, eax
jne 0x8723c4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 2
add eax, eax
pop edx
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call fcn.008713e0
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x8723c4
lea eax, [ebp - 0x20]
push eax
push dword [0x88b45c]
lea ecx, [ebp - 0x2c]
push esi
call fcn.008723dc
test eax, eax
jne 0x8723bb
push ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call esi
mov edi, eax
cmp edi, ebx
je 0x8723bb
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.008713e0
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x8723bb
push edi
push eax
push dword [ebp - 0x1c]
call esi
mov esi, eax
cmp esi, ebx
je 0x8723b2
cmp dword [ebp + 8], ebx
je 0x87ea08
push dword [0x88b460]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + esi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.008713e0
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x8723b2
push dword [ebp - 0x14]
push esi
push eax
call fcn.008721cb
push dword [0x88b460]
push edi
push dword [ebp - 0x18]
call fcn.00872436
push dword [ebp - 0x14]
call fcn.008713c0
pop ecx
push dword [ebp - 0x1c]
call fcn.008713c0
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.00871f10
mov eax, dword [ebp - 0x18]
call fcn.00871390
ret 4
Function at 0x8723dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
jbe 0x87242c
cmp dword [ebp - 4], 2
ja 0x87e965
mov ecx, dword [edi]
test cl, 1
jne 0x87242c
cmp esi, ebx
je 0x872425
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jne 0x87242c
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0xd
pop eax
jmp 0x872425

Function at 0x8724ed
Capabilities:
Delete file
Move file

Disassembly:
push 0x14
mov eax, 0x886b05
call fcn.00871350
mov esi, ecx
mov eax, dword [esi + 0x44]
xor edi, edi
mov ebx, 0x8007000e
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x872519
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x44], edi
cmp dword [ebp + 8], edi
je 0x87265b
cmp dword [ebp + 0xc], edi
je 0x87265b
push 1
call fcn.0087227c
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x87264a
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 4], edi
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea eax, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x20], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.008713e0
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x87259b
push dword [ebp - 0x1c]
inc edi
push edi
push eax
call fcn.008721cb
mov ebx, eax
test ebx, ebx
jl 0x87259b
push dword [ebp + 8]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call fcn.00872436
mov ebx, eax
test ebx, ebx
jl 0x87259b
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
test ebx, ebx
jl 0x872632
push 2
pop ebx
push dword [ebp - 0x1c]
mov dword [ebp - 4], ebx
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
mov eax, esi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.008713e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x872654
push dword [ebp - 0x1c]
inc edi
push edi
push eax
call fcn.008721cb
mov ebx, eax
test ebx, ebx
jl 0x872623
push dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
call fcn.00872436
mov ebx, eax
test ebx, ebx
jl 0x872623
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x872623
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x87f3a2
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x872632
push dword [ebp - 0x14]
call fcn.008713c0
pop ecx
cmp dword [ebp - 0x18], 0
je 0x872641
push dword [ebp - 0x18]
call fcn.008713c0
pop ecx
push dword [ebp - 0x1c]
call fcn.008713c0
pop ecx
mov eax, ebx
call fcn.00871390
ret 8
mov ebx, 0x8007000e
jmp 0x8725fe
mov ebx, 0x80070057
jmp 0x87264a
Function at 0x873a67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x873ae4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x873ac0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x873ad0
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0xffffffff
pop esi
je 0x87e30e
mov eax, dword [ebp - 8]
leave
ret
Function at 0x874267
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x88b00c], esi
jne 0x8742be
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x872c6f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x88b00c], eax
cmp eax, esi
je 0x87e4ec
push 0xffffffffffffffff
push dword [0x88b014]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x88b014]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x88b018], esi
jl 0x87e50a
pop esi
leave
ret

Function at 0x874441
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x874498
call fcn.00872712
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x874490
cmp ecx, 0xffffffff
je 0x874490
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x874489
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x874489
cmp edx, 0x10000000
jae 0x874489
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x87e892
mov dword [ebp - 4], 0xfffffffe
call fcn.00872757
ret 4

Function at 0x87681f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x88b004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, ecx
inc eax
cmp dword [esi + 0x2c], 0
jne 0x876933
push edi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x105
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x420], eax
cmp eax, edi
ja 0x87ed16
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.008721cb
test eax, eax
jl 0x876932
mov ecx, dword [ebp - 0x420]
cmp word [ebp + ecx*2 - 0x210], 0x5c
je 0x8768c3
push 0x876994
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.00872436
test eax, eax
jl 0x876932
push 0x876980
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.00872436
test eax, eax
jl 0x876932
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x87ed20
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x876970
push eax
call edi
push 0x87695c
push dword [esi + 0x2c]
mov dword [esi + 0x30], eax
call edi
push 0x876948
push dword [esi + 0x2c]
mov dword [esi + 0x34], eax
call edi
cmp dword [esi + 0x30], 0
mov dword [esi + 0x38], eax
je 0x876940
cmp dword [esi + 0x34], 0
je 0x876940
test eax, eax
je 0x876940
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.008720d4
leave
ret
mov eax, 0x8007007f
jmp 0x876932