joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10164090
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101640ea
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101640ea
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, eax
je 0x101640ff
mov eax, dword [esp]
test eax, eax
je 0x101640f9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x1016410e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x10164120
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10164179
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1016418e
mov eax, dword [esp]
test eax, eax
je 0x10164188
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x1016419d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x101641b0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x1016421b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1016421b
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x101641e4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1016420c
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x10164222
mov eax, dword [esp + 4]
test eax, eax
je 0x1016421b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x10164231
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x10164240
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x101643cb
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x101643cb
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x101643cb
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101643cb
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1016438c
cmp dword [esp + 0xc], 0x378
jne 0x1016438c
lea eax, [esp + 0x28]
push eax
push edi
call fcn.1017ae90
add esp, 8
test eax, eax
je 0x101643ac
cmp dword [esp + 0x154], 1
jne 0x101643ac
cmp dword [esp + 0x178], 2
jne 0x101643ac
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x10314830
push edx
call fcn.1017acb2
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
push eax
push ecx
push edx
mov ecx, esi
call fcn.10164120
test eax, eax
je 0x1016438c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1016439f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x10164396
push eax
call esi
jmp 0x10164392
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x101643ac
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x101643bb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x101643e0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x1016454c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x1016454c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x1016454c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x1016454c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10164530
cmp dword [esp + 0x10], 0x378
jne 0x10164530
cmp dword [esp + 0x158], 1
jne 0x10164559
cmp dword [esp + 0x17c], 2
jne 0x10164559
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x10314830
push ecx
call fcn.1017acb2
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10164530
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.10164590
test eax, eax
je 0x10164530
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.10164090
test eax, eax
je 0x10164530
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10164559
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10164541
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x1016454c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1016456a
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x10164575
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x10164590
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x10164651
mov eax, dword [esp + 0x488]
test eax, eax
je 0x10164651
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10164651
cmp dword [esp], 0x378
jne 0x10164651
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10164651
lea edx, [esp + 4]
push edx
call fcn.10164020
add esp, 4
test eax, eax
je 0x10164651
cmp dword [esp + 0x234], 1
jne 0x10164643
cmp dword [esp + 0x258], 2
jne 0x10164643
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10164651
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10164651
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x10164660
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x101646bf
push esi
call fcn.10164020
add esp, 4
test eax, eax
je 0x101646bf
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x101646bf
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x101646bf
push str.SetPara
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x10164750
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x10164784
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.10164660
test eax, eax
jne 0x1016479d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.101646d0
cmp eax, 1
je 0x1016492a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x101647d6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x10164852
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x101648d2
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.10164590
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x101648e9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x101647f2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x101648a0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.10164240
test eax, eax
je 0x101648d2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x1016486e
cmp dword [esp + 0x18], 1
jb 0x101648d2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.10164120
cmp eax, 1
je 0x1016491b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x101648f9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x101648d2
push ebp
mov ecx, ebx
call fcn.10164940
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1016492a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x10164940
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x10164972
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.101646d0
test eax, eax
jne 0x1016498f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x101649b6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x10164a04
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.101643e0
test eax, eax
jne 0x101649ed
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x101649d3
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.101641b0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x10164a27
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4
Function at 0x1016b600
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x1016b64c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x1016b64c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x1016b636
push eax
call ebp
test ax, ax
jl 0x1016b644
inc esi
add edi, 4
cmp esi, 6
jb 0x1016b628
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.1016b300
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1016e100
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x1016e160
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x1016e160
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x1016e160
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x1016e160
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x1016e170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x1018d1ac
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1018d1e4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1018b1b5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1018b18d
jmp 0x1018d1f0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1018e9aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1018e9ec
call fcn.10194fdd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1018e9ec
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1018e9e3
xor eax, eax
jmp 0x1018e9f4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1018e9fa
pop edi
pop esi
pop ebx
ret 4
Function at 0x402763
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 1
push 0x401108
push EnterCriticalSection
pop eax
lea esi, [ebp - 0x40]
call fcn.0040df9a
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
push 0x25
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x4013c0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
pop eax
test ebx, ebx
jne 0x4027b2
mov dword [ebp - 0x40], reloc.ADVAPI32.dll_TraceMessage
mov word [ebp - 0x3a], ax
jmp 0x40286b
push dword [ebx]
mov dword [ebp - 0x40], esi
mov word [ebp - 0x3c], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x4027f7
test al, 0x10
je 0x4027d4
mov dword [ebp - 0x40], esi
push 0x2d
jmp 0x402866
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4027ed
call fcn.0040f196
push 0x37
mov dword [ebp - 0x40], eax
pop eax
jmp 0x4027a9
push 0x37
pop eax
mov dword [ebp - 0x40], esi
mov word [ebp - 0x3c], ax
push esi
lea eax, [ebp - 4]
push eax
push 1
push 0x4011d8
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x402816
call fcn.0040f196
push 0x42
jmp 0x4027e7
push 0x42
pop eax
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40286b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40284f
mov eax, esi
test eax, eax
jle 0x40285d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x40], eax
push 0x4f
test eax, eax
js 0x4027ea
pop eax
mov word [ebp - 0x3c], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x40]
lea esi, [ebp - 0x1c]
call fcn.0040fca0
lea eax, [ebp - 0x40]
call fcn.0040e073
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x402cb0
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
push ebx
push 0x401150
push 0x55
pop eax
lea esi, [ebp - 0x34]
call fcn.0040df9a
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
mov edi, 0x4013c0
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp dword [ebp - 4], ebx
jbe 0x402d29
mov edx, dword [esi + ebx*4]
lea eax, [ebp - 0x10]
push eax
mov edi, 0x40115c
mov ecx, 0x401164
call fcn.0041048f
mov edi, eax
push 0x61
mov dword [ebp - 0x34], edi
pop eax
test edi, edi
js 0x402d80
inc ebx
mov word [ebp - 0x30], ax
cmp ebx, dword [ebp - 4]
jb 0x402cfa
mov edi, dword [ebp - 0x10]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov edi, eax
push 0x63
mov dword [ebp - 0x34], edi
pop eax
test edi, edi
js 0x402d80
push dword [ebp - 4]
mov word [ebp - 0x30], ax
push esi
call fcn.00402f6c
mov edi, eax
push 0x65
mov dword [ebp - 0x34], edi
pop eax
test edi, edi
js 0x402d80
mov word [ebp - 0x30], ax
test esi, esi
je 0x402d69
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x10]
call fcn.0040fca0
lea eax, [ebp - 0x34]
call fcn.0040e073
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov word [ebp - 0x2e], ax
jmp 0x402d5b

Function at 0x403637
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 1
push 0x401534
mov eax, 0x186
lea esi, [ebp - 0x24]
call fcn.0040df9a
mov edi, 0xffff
mov eax, 0x18a
cmp dword [ebp + 0x10], edi
jbe 0x403672
mov esi, 0x80070057
mov dword [ebp - 0x24], esi
mov word [ebp - 0x1e], ax
jmp 0x4036cd
cmp dword [ebp + 8], 0
mov word [ebp - 0x20], ax
mov eax, 0x18b
je 0x403664
and dword [ebp - 0x24], 0
push 0
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4036ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4036b8
and esi, edi
or esi, 0x80070000
mov dword [ebp - 0x24], esi
mov eax, 0x191
test esi, esi
js 0x40366c
mov word [ebp - 0x20], ax
jmp 0x4036cd
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x24]
call fcn.0040e073
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x403851
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x41200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
push 0x401564
mov eax, 0x1eb
lea esi, reloc.ADVAPI32.dll_TraceMessage
mov edi, ecx
call fcn.0040df9a
xor eax, eax
xor esi, esi
push 0x208
mov word [ebp - 0x218], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push esi
push eax
mov dword [ebp - 0x248], 0x4013c0
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x1f0
test edi, edi
jne 0x4038d1
mov edi, 0x80070057
mov word [ebp - 0x236], ax
jmp 0x4039c8
mov word [ebp - 0x238], ax
test ebx, ebx
jne 0x4038e3
mov eax, 0x1f1
jmp 0x4038c0
mov eax, 0x1f2
mov word [ebp - 0x238], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call fcn.0040fe83
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov edx, edi
call fcn.00410446
mov edi, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov eax, 0x1f5
test edi, edi
jns 0x40392b
mov word [ebp - 0x236], ax
jmp 0x4039ce
mov word [ebp - 0x238], ax
mov eax, 0x1f6
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
je 0x4038c0
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov word [ebp - 0x238], ax
call fcn.0041065f
mov edi, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov eax, 0x1f9
test edi, edi
js 0x40391f
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov word [ebp - 0x238], ax
mov edi, 0x105
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x248]
call esi
test eax, eax
mov eax, 0x200
jne 0x40399d
mov edi, 0x80004005
jmp 0x4038c5
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push edi
mov word [ebp - 0x238], ax
push ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call esi
test eax, eax
mov eax, 0x205
je 0x403993
xor edi, edi
mov word [ebp - 0x238], ax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0040fca0
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0040e073
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00410d69
leave
ret