joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2d40
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x506508
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, edx
mov eax, dword [esp + 0x34]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [edi + 0x18]
push ecx
call fcn.004c53a0
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x34]
push edx
call fcn.00401640
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x2c], 0
call fcn.0041ca50
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c2dcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x24
ret 8

Function at 0x4c2f90
Capabilities:
Set registry value

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x68], eax
push 0x66
lea eax, [esp + 4]
push 0
push eax
call fcn.004e8fe0
mov ecx, dword [esp + 0x7c]
push ecx
push 0x5120d0
lea edx, [esp + 0x14]
push 0x32
push edx
call fcn.004e5398
lea eax, [esp + 0x1c]
add esp, 0x1c
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c2fd0
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 4]
push ecx
push 1
push str.Shell_Icon_Size
push str.Control_PanelDesktopWindowMetrics
push SHChangeNotifyDeregister
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esi + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push str.WindowMetrics
push 0x2a
push 0x1a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x40dc]
test eax, eax
je 0x4c3025
push 1
call eax
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004e3edb
add esp, 0x6c
ret 4

Function at 0x4c3040
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x70], eax
xor eax, eax
push 0x62
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.004e8fe0
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push str.Shell_Icon_Size
push str.Control_PanelDesktopWindowMetrics
push SHChangeNotifyDeregister
mov dword [esp + 0x1c], 0x62
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c30ce
lea edx, [esp]
push edx
lea eax, [esp + 0x10]
push 0x5120d0
push eax
call fcn.004e52d8
mov eax, dword [esp + 0xc]
add esp, 0xc
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004e3edb
add esp, 0x74
ret
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004e3edb
add esp, 0x74
ret
Function at 0x4f7460
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004e9977
and dword [ebp - 4], 0
cmp dword [0x563eb8], 0
mov ebx, eax
jne 0x4f7511
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4f75c2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4f75c2
push eax
call fcn.004e9905
mov dword [esp], 0x50e92c
push edi
mov dword [0x563eb8], eax
call esi
push eax
call fcn.004e9905
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x563ebc], eax
call esi
push eax
call fcn.004e9905
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x563ec0], eax
call esi
push eax
call fcn.004e9905
pop ecx
mov dword [0x563ec8], eax
test eax, eax
je 0x4f7511
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004e9905
pop ecx
mov dword [0x563ec4], eax
mov eax, dword [0x563ec4]
cmp eax, ebx
je 0x4f7569
cmp dword [0x563ec8], ebx
je 0x4f7569
push eax
call fcn.004e9980
push dword [0x563ec8]
mov esi, eax
call fcn.004e9980
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4f7569
test edi, edi
je 0x4f7569
call esi
test eax, eax
je 0x4f7560
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4f7560
test byte [ebp - 0xc], 1
jne 0x4f7569
or dword [ebp + 0x10], 0x200000
jmp 0x4f75a2
mov eax, dword [0x563ebc]
cmp eax, ebx
je 0x4f75a2
push eax
call fcn.004e9980
pop ecx
test eax, eax
je 0x4f75a2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4f75a2
mov eax, dword [0x563ec0]
cmp eax, ebx
je 0x4f75a2
push eax
call fcn.004e9980
pop ecx
test eax, eax
je 0x4f75a2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x563eb8]
call fcn.004e9980
pop ecx
test eax, eax
je 0x4f75c2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4f75c4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430a6450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x430a645f
pop dword [ebp - 0x50]
mov eax, 0x430a645f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3c782
push 0
mov eax, 0x5de70c54
sub eax, 0x1adcfbb4
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xfffe0422
add ecx, 0x2574d
mov esi, eax
mov edx, 0x88dfc32c
add edx, 0xba2b1ad4
add edx, dword [ebp - 0x50]
mov edi, 0x9da49cb0
sub edi, 0x86a69191
sub dword [ebp - 0x2c], 0x10b3cba7
mov ebx, dword [edx]
add dword [ebp - 8], ecx
xor ebx, edi
add dword [ebp - 8], ebx
mov dword [esi], ebx
xor dword [ebp - 0x4c], edx
add esi, 4
add edx, 4
loop 0x430a64b9
add eax, 0xf02cd6e4
sub eax, 0xf02b7655
mov ebx, eax
add eax, 0x498b7122
add eax, 0xb6748ee3
mov ecx, 0xf9862c8c
sub ecx, 0xb67c2c8c
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9
Function at 0x72a617e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
test byte [0x72a76584], 1
jne 0x72a61820
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, 6
cmp dword [eax], 1
je 0x72a61871
mov dword [esp], ebx
call sym._SetLastError_4
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], str.DeleteForm__p___S__n
xor edi, edi
mov ebx, 6
mov dword [esp + 0x10], 0x1fa
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.LocalDeleteForm
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x72a7704d
mov dword [esp + 4], 0x72a76584
mov dword [esp], 0
call sym._ros_dbg_log
mov eax, dword [ebp + 8]
cmp dword [eax], 1
jne 0x72a61801
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov ebx, 0x57
call sym._FindForm_8
mov esi, eax
test eax, eax
je 0x72a61801
lea eax, [ebp - 0x34]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x72a61801
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call sym._RegDeleteValueW_8
sub esp, 8
mov ebx, eax
test eax, eax
jne 0x72a61801
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edi, 1
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov dword [esp], esi
call sym._DllFreeSplMem_4
mov eax, dword [ebp + 8]
sub esp, 4
mov dword [esp], eax
call sym._BroadcastChange
jmp 0x72a61801
Function at 0x72a61cb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [ebp + 0x14]
test byte [0x72a76584], 1
jne 0x72a61d10
mov eax, dword [ebp + 8]
cmp dword [eax], 1
jne 0x72a61d00
mov eax, dword [ebp + 0x10]
xor edi, edi
lea edx, [eax - 1]
mov eax, 0x7c
cmp edx, 1
jbe 0x72a61d62
mov dword [esp], eax
call sym._SetLastError_4
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
xor edi, edi
mov eax, 6
jmp 0x72a61ce3
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], str.SetFormW__p___S___lu___p__n
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x2b3
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.LocalSetForm
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x72a7704d
mov dword [esp + 4], 0x72a76584
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x72a61cc5
mov ecx, dword [ebp + 0xc]
xor edx, edx
call sym._FindForm_8
mov edx, eax
mov eax, 0x57
test edx, edx
mov dword [ebp - 0x3c], edx
je 0x72a61ce3
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp + 8], 0
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x72a61ce3
mov eax, dword [esi]
mov edx, dword [ebp - 0x3c]
cmp dword [ebp + 0x10], 2
mov dword [edx + 0x10], eax
mov ecx, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [edx + 0x18], ecx
lea ecx, [ebp - 0x30]
mov dword [edx + 0x1c], ebx
mov eax, dword [esi + 0x10]
mov dword [edx + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [edx + 0x24], eax
mov eax, dword [esi + 0x18]
mov dword [edx + 0x28], eax
mov eax, dword [esi + 0x1c]
mov dword [edx + 0x2c], eax
jne 0x72a61e0e
mov eax, dword [esi + 0x20]
mov dword [edx + 0x30], eax
mov eax, dword [esi + 0x28]
mov dword [edx + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [edx + 0x40], eax
mov eax, dword [esi + 0x24]
mov dword [edx + 0x34], eax
mov eax, dword [esi + 0x2c]
mov dword [edx + 0x3c], eax
mov eax, dword [edx + 0x20]
mov esi, dword [edx + 0x18]
mov edi, dword [edx + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], eax
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [esp + 0x14], 0x20
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov eax, dword [edx + 0x14]
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call sym._RegSetValueExW_24
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
sub esp, 0x18
mov dword [esp], eax
call sym._BroadcastChange
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
test eax, eax
sete cl
mov edi, ecx
jmp 0x72a61ce3
Function at 0x72a63d20
Capabilities:
Check if file exists
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x234
mov ebx, dword [ebp + 8]
test byte [0x72a765e8], 8
jne 0x72a63d60
xor edi, edi
cmp dword [ebx], 1
mov esi, 6
je 0x72a63dab
mov dword [esp], esi
call sym._SetLastError_4
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], ebx
xor edi, edi
mov esi, 6
mov dword [esp + 0x14], str.LocalScheduleJob__p___lu__n
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0x462
mov dword [esp + 0xc], str.LocalScheduleJob
mov dword [esp + 8], 0x72a77301
mov dword [esp + 4], 0x72a765e8
mov dword [esp], 3
call sym._ros_dbg_log
cmp dword [ebx], 1
jne 0x72a63d44
lea eax, [ebp + 0xc]
mov ebx, dword [ebx + 4]
mov dword [esp + 8], 0
mov esi, 0x57
mov dword [esp + 4], eax
mov dword [esp], 0x72a7c020
call sym._LookupElementSkiplist
mov edx, eax
test eax, eax
je 0x72a63d44
mov eax, dword [ebx + 8]
cmp dword [edx + 0xc], eax
jne 0x72a63d44
test byte [edx + 4], 1
mov esi, 0xbbc
mov dword [ebp - 0x21c], edx
je 0x72a63d44
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x218]
mov esi, 0xbba
mov dword [esp], 0x72a775fc
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call sym._GetJobFilePath
mov dword [esp], ebx
call sym._GetFileAttributesW_4
sub esp, 4
cmp eax, 0xffffffff
je 0x72a63d44
and eax, 0x10
mov esi, eax
jne 0x72a63ed0
mov edx, dword [ebp - 0x21c]
and dword [edx + 0x54], 0xfffffff7
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call sym._wcsrchr
mov dword [esp + 4], str..SHD
mov dword [esp], eax
call sym._wcscpy
mov edx, dword [ebp - 0x21c]
mov dword [esp], ebx
mov dword [esp + 4], edx
call sym._WriteJobShadowFile
mov edx, dword [ebp - 0x21c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], sym._PrintingThreadProc_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
test eax, eax
je 0x72a63eda
mov dword [esp], eax
mov edi, 1
call sym._CloseHandle_4
sub esp, 4
jmp 0x72a63d44
mov esi, 0xbba
jmp 0x72a63d44
call sym._GetLastError_0
mov esi, eax
test byte [0x72a765e8], 2
jne 0x72a63ef8
xor eax, eax
test esi, esi
sete al
mov edi, eax
jmp 0x72a63d44
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.CreateThread_failed_with_error__lu__n
mov dword [esp + 0x10], 0x493
mov dword [esp + 0xc], str.LocalScheduleJob
mov dword [esp + 8], 0x72a77301
mov dword [esp + 4], 0x72a765e8
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a63eea
Function at 0x72a63f40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
test byte [0x72a765e8], 8
jne 0x72a64061
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0xc]
add eax, 0x28
mov dword [esp], eax
call sym._DeleteElementSkiplist
mov dword [esp + 4], ebx
mov dword [esp], 0x72a7c020
call sym._DeleteElementSkiplist
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x72a777dc
call sym._GetJobFilePath
mov dword [esp], eax
call sym._DllAllocSplMem_4
sub esp, 4
mov esi, eax
test eax, eax
je 0x72a63fc5
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], 0x72a777dc
mov dword [esp + 4], eax
call sym._GetJobFilePath
test eax, eax
jne 0x72a640a0
mov eax, dword [ebx + 0x5c]
mov dword [esp], eax
call sym._DllFreeSplMem_4
mov eax, dword [ebx + 0x34]
sub esp, 4
mov dword [esp], eax
call sym._DllFreeSplStr_4
mov eax, dword [ebx + 0x30]
sub esp, 4
mov dword [esp], eax
call sym._DllFreeSplStr_4
mov eax, dword [ebx + 0x58]
sub esp, 4
mov dword [esp], eax
call sym._DllFreeSplStr_4
mov eax, dword [ebx + 0x2c]
sub esp, 4
mov dword [esp], eax
call sym._DllFreeSplStr_4
mov eax, dword [ebx + 0x28]
sub esp, 4
mov dword [esp], eax
call sym._DllFreeSplStr_4
mov eax, dword [ebx + 0x38]
sub esp, 4
test eax, eax
je 0x72a6402b
mov dword [esp], eax
call sym._DllFreeSplStr_4
sub esp, 4
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x72a6403d
mov dword [esp], eax
call sym._DllFreeSplStr_4
sub esp, 4
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x72a6404f
mov dword [esp], eax
call sym._DllFreeSplStr_4
sub esp, 4
mov dword [esp], ebx
call sym._DllFreeSplMem_4
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.FreeJob__p__n
mov dword [esp + 0x10], 0x5b0
mov dword [esp + 0xc], str.FreeJob
mov dword [esp + 8], 0x72a77301
mov dword [esp + 4], 0x72a765e8
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x72a63f58
mov dword [esp], esi
call sym._DeleteFileW_4
sub esp, 4
jmp 0x72a63fc5
Function at 0x72a68ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
test byte [0x72a76690], 8
jne 0x72a68b30
test ebx, ebx
je 0x72a68b94
test esi, esi
je 0x72a68b9f
test edi, edi
je 0x72a68baa
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x72a68bd4
mov eax, dword [edi]
cmp eax, 1
je 0x72a68be0
mov edi, 6
cmp eax, 2
je 0x72a68bb4
mov dword [esp], edi
call sym._SetLastError_4
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], str.LocalGetPrinterDataEx__p___S___S___p___p___lu___p__n
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x141
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], str.LocalGetPrinterDataEx
mov dword [esp + 8], 0x72a78c99
mov dword [esp + 4], 0x72a76690
mov dword [esp], 3
call sym._ros_dbg_log
test ebx, ebx
jne 0x72a68ae3
lea ebx, [ebp - 0x1c]
test esi, esi
jne 0x72a68aeb
lea esi, [ebp - 0x1d]
test edi, edi
jne 0x72a68af3
mov edi, 6
jmp 0x72a68b17
mov eax, dword [ebp + 0x20]
mov ecx, esi
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
call sym.__LocalGetPrintServerHandleData
mov edi, eax
jmp 0x72a68b17
mov edi, 0x57
jmp 0x72a68b17
mov eax, dword [edi + 4]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
add eax, 8
call sym.__MakePrinterSubKey.isra.0.constprop.1
mov edi, eax
test eax, eax
jne 0x72a68c81
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [0x72a7c508]
mov dword [esp], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
mov edi, eax
test eax, eax
je 0x72a68cb0
test byte [0x72a76690], 2
je 0x72a68c81
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], str.RegOpenKeyExW_failed_for___S__with_error__lu__n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x3f
mov dword [esp + 0xc], str._LocalGetPrinterHandleData
mov dword [esp + 8], 0x72a78c99
mov dword [esp + 4], 0x72a76690
mov dword [esp], 1
call sym._ros_dbg_log
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x72a68c93
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x72a68b17
mov dword [esp], eax
call sym._DllFreeSplMem_4
sub esp, 4
jmp 0x72a68b17
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov dword [eax], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
mov edi, eax
jmp 0x72a68c81
Function at 0x72a69770
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
xor ebx, ebx
sub esp, 0x2c
mov eax, dword [ecx + 0x820]
mov word [ecx + eax*2], bx
mov eax, dword [ecx + 0x824]
mov word [ecx + eax*2 + 0x410], di
mov eax, 1
test esi, esi
je 0x72a69804
cmp word [esi], 0
je 0x72a69804
mov ebx, ecx
test byte [ecx + 0x828], 0x10
je 0x72a69853
lea edi, [ebx + 0x410]
mov dword [esp + 4], edx
mov dword [esp], edi
call sym._lstrcatW_8
sub esp, 8
test byte [0x72a76838], 1
jne 0x72a69870
mov dword [esp], esi
mov dword [esp + 8], 0
mov dword [esp + 4], edi
call sym._CopyFileW_12
sub esp, 0xc
mov esi, eax
test byte [0x72a76838], 1
jne 0x72a69810
xor eax, eax
or esi, dword [ebx + 0x82c]
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetLastError_0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], str.got__d_with__u_n
mov dword [esp + 0x10], 0x364
mov dword [esp + 0xc], str.apd_copyfile
mov dword [esp + 8], 0x72a791bd
mov dword [esp + 4], 0x72a76838
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x72a697f9
mov dword [esp + 4], edx
mov esi, ecx
mov dword [esp], ecx
mov dword [ebp - 0x14], edx
call sym._lstrcatW_8
mov edx, dword [ebp - 0x14]
sub esp, 8
jmp 0x72a697b5
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call sym._wine_dbgstr_wn
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
mov dword [ebp - 0x14], eax
call sym._wine_dbgstr_wn
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], str._s____s_n
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0x360
mov dword [esp + 0xc], str.apd_copyfile
mov dword [esp + 8], 0x72a791bd
mov dword [esp + 4], 0x72a76838
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x72a697d7
Function at 0x72a6c570
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov edx, dword [ebp + 0x18]
lea edx, [eax + edx + 1]
lea eax, [edx + edx]
mov dword [ebp - 0x3c], eax
test ebx, ebx
je 0x72a6c700
mov ecx, dword [ebx]
mov dword [ebp - 0x44], edx
xor eax, eax
lea edi, [ecx + 4]
mov dword [ecx], 0
and edi, 0xfffffffc
mov dword [ecx + 0x78], 0
sub ecx, edi
add ecx, 0x7c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xb0]
mov eax, dword [ebx]
mov dword [eax + 8], ecx
mov edi, dword [ebx]
call sym._GetVersion_0
mov dword [edi + 0x2c], eax
mov eax, dword [ebx]
mov ecx, dword [esi + 8]
mov dword [eax + 0x60], ecx
mov eax, dword [ebx]
mov dword [eax + 0x30], 1
lea eax, [ebp - 0x34]
mov dword [esp], eax
call sym._GetSystemInfo_4
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x20]
sub esp, 4
mov dword [eax + 0x4c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov dword [eax + 0x50], ecx
movzx ecx, word [ebp - 0x34]
mov eax, dword [ebx]
mov word [eax + 0x6c], cx
movzx ecx, word [ebp - 0x14]
mov eax, dword [ebx]
mov word [eax + 0x6e], cx
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._DllAllocSplMem_4
mov edx, dword [ebp - 0x44]
mov edi, eax
mov dword [ebp - 0x40], eax
sub esp, 4
mov dword [ebp - 0x38], eax
mov eax, edx
and eax, 0x7fffffff
je 0x72a6c6e3
mov dword [ebp + 8], esi
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp + 0x1c]
jmp 0x72a6c652
mov edx, ecx
movzx edi, word [esi]
test di, di
je 0x72a6c720
lea ecx, [edx + 2]
add esi, 2
mov word [ecx - 2], di
sub eax, 1
jne 0x72a6c650
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ecx - 2], ax
mov eax, 1
mov edi, dword [esi]
jmp 0x72a6c693
add edx, 2
add edi, 2
mov word [edx - 2], cx
sub eax, 1
je 0x72a6c735
movzx ecx, word [edi]
test cx, cx
jne 0x72a6c680
xor esi, esi
mov word [edx], si
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [esp + 8], 0x72a768bc
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 4], eax
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sym._PackStrings_16
mov esi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x40]
add dword [ebx], 0x7c
mov dword [esp], eax
call sym._DllFreeSplMem_4
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x1c]
cmp word [eax], 0
je 0x72a6c6a0
test edi, edi
jne 0x72a6c6a0
mov edx, dword [ebp - 0x3c]
mov eax, edx
shr eax, 1
cmp edx, 1
jbe 0x72a6c6a0
xor edx, edx
jmp 0x72a6c72d
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp - 0x3c]
mov eax, dword [eax]
lea eax, [esi + eax + 0x7c]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
mov esi, dword [ebp + 8]
and eax, 0x7fffffff
mov word [edx], di
test eax, eax
jne 0x72a6c67b
xor ecx, ecx
mov word [edx - 2], cx
jmp 0x72a6c6a0