joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ee28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x49ef6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x49ef80
call fcn.0049ec90
lea eax, [ebp - 0x3f0]
call fcn.00405268
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004056f8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x49ef33
xor edx, edx
push ebp
push 0x49ef2c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x49efc0
call fcn.0049ec90
mov eax, dword [ebp - 0x408]
call fcn.004056f8
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49ef12
push ebp
mov eax, 0x49efec
call fcn.0049ed80
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ef33
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.004052bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ef74
lea eax, [ebp - 0x408]
call fcn.00405268
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040528c
ret
Function at 0x49f188
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x49f34c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x49f360
call fcn.0049eff0
lea eax, [ebp - 0x3f0]
call fcn.00405268
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004056f8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x49f30d
xor eax, eax
push ebp
push 0x49f306
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x49f398
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49f262
push ebp
mov eax, 0x49f3b4
call fcn.0049f0e0
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x49f3c0
call fcn.0049eff0
mov eax, dword [ebp - 0x408]
call fcn.004056f8
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49f2ec
push dword [ebp - 0x3f0]
push 0x49f3e4
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004054d8
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004055fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f30d
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.004052bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f353
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040528c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040528c
ret
Function at 0x49fdbc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e8
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49ff24
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004711b4
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004711d4
mov ebx, eax
jmp 0x49fef6
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054d8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a5b0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409690
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409690
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405690
je 0x49fed6
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054d8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409690
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409690
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405690
jne 0x49feeb
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004711f4
mov ebx, eax
test ebx, ebx
jne 0x49fe37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ff2b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040528c
lea eax, [ebp - 4]
call fcn.00405268
ret
Function at 0x4a025c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
test ebx, ebx
je 0x4a0300
mov eax, ebx
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, edx
mov esi, eax
mov edx, dword [esi + 0x78]
mov eax, ebx
call fcn.0049ffc0
mov esi, eax
mov ebp, dword [esi + 0x18]
dec ebp
test ebp, ebp
jb 0x4a0300
inc ebp
xor edi, edi
mov edx, dword [esi + 0x20]
mov eax, ebx
call fcn.0049ffc0
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
mov edx, dword [esp + 8]
mov eax, ebx
call fcn.0049ffc0
mov dword [esp + 0xc], eax
mov eax, dword [esp]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x4a02fc
mov edx, dword [esi + 0x24]
mov eax, ebx
call fcn.0049ffc0
movzx eax, word [eax + edi*2]
mov word [esp + 0x10], ax
mov edx, dword [esi + 0x1c]
mov eax, ebx
call fcn.0049ffc0
movzx edx, word [esp + 0x10]
mov eax, dword [eax + edx*4]
mov edx, eax
mov eax, ebx
call fcn.0049ffc0
mov dword [esp + 4], eax
inc edi
dec ebp
jne 0x4a0298
mov eax, dword [esp + 4]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a1570
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e8
xor eax, eax
push ebp
push 0x4a164a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4a1660
mov edx, dword [ebp - 4]
call fcn.00405580
mov eax, dword [ebp - 8]
call fcn.004056f8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4a15ba.0
jmp dword [eax*4 + 0x4a15c1]
mov eax, ebx
mov edx, 0x4a166c
call fcn.004052bc
jmp 0x4a162f
mov eax, ebx
mov edx, 0x4a167c
call fcn.004052bc
jmp 0x4a162f
mov eax, ebx
mov edx, 0x4a168c
call fcn.004052bc
jmp 0x4a162f
mov eax, ebx
mov edx, 0x4a16a0
call fcn.004052bc
jmp 0x4a162f
mov eax, ebx
mov edx, 0x4a16b0
call fcn.004052bc
jmp 0x4a162f
mov eax, ebx
mov edx, 0x4a16c4
call fcn.004052bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1651
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040528c
ret
Function at 0x4a1814
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e8
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4a1986
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004711b4
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004711d4
mov ebx, eax
jmp 0x4a1958
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054d8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a5b0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409690
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409690
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405690
je 0x4a192e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054d8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409690
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409690
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405690
jne 0x4a194d
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [edi + 8]
je 0x4a194d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004711f4
mov ebx, eax
test ebx, ebx
jne 0x4a188f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a198d
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040528c
lea eax, [ebp - 4]
call fcn.00405268
ret
Function at 0x4a4d00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e8
xor eax, eax
push ebp
push 0x4a4d95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4a4dac
mov edx, dword [ebp - 4]
call fcn.00405580
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.004056f8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00409f78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4d9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040528c
ret

Function at 0x4a7d40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e8
xor eax, eax
push ebp
push 0x4a7e7b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a7e4b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004056f8
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a38c
test al, al
jne 0x4a7dbb
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.004036d8
lea eax, [ebp - 0x1d0]
call fcn.00403474
call fcn.004030b0
push dword [0x5b4de8]
push 0x4a7e94
push dword [0x5b4dec]
push 0x4a7e94
push dword [0x5b4df0]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004055fc
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004a1994
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405a18
call fcn.00403dd0
call fcn.004030b0
lea eax, [ebp - 0x1d0]
call fcn.004037a0
call fcn.004030b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a7e55
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7e82
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040528c
lea eax, [ebp - 4]
call fcn.00405268
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ab004]
jne 0x40100a
repz ret
jmp fcn.00401a5a

Function at 0x407a98
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004025da
and dword [ebp - 4], 0
cmp dword [0x4ad264], 0
mov ebx, eax
jne 0x407b49
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407bfa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407bfa
push eax
call fcn.00402568
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ad264], eax
call esi
push eax
call fcn.00402568
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ad268], eax
call esi
push eax
call fcn.00402568
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ad26c], eax
call esi
push eax
call fcn.00402568
pop ecx
mov dword [0x4ad274], eax
test eax, eax
je 0x407b49
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402568
pop ecx
mov dword [0x4ad270], eax
mov eax, dword [0x4ad270]
cmp eax, ebx
je 0x407ba1
cmp dword [0x4ad274], ebx
je 0x407ba1
push eax
call fcn.004025e3
push dword [0x4ad274]
mov esi, eax
call fcn.004025e3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407ba1
test edi, edi
je 0x407ba1
call esi
test eax, eax
je 0x407b98
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407b98
test byte [ebp - 0xc], 1
jne 0x407ba1
or dword [ebp + 0x10], 0x200000
jmp 0x407bda
mov eax, dword [0x4ad268]
cmp eax, ebx
je 0x407bda
push eax
call fcn.004025e3
pop ecx
test eax, eax
je 0x407bda
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407bda
mov eax, dword [0x4ad26c]
cmp eax, ebx
je 0x407bda
push eax
call fcn.004025e3
pop ecx
test eax, eax
je 0x407bda
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ad264]
call fcn.004025e3
pop ecx
test eax, eax
je 0x407bfa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407bfc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a6ea
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4ab004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test ebx, ebx
jle 0x40a747
and dword [ebp - 0x808], 0
lea ecx, [ebp - 0x808]
call fcn.0040a6e2
mov al, byte [ebp - 0x808]
xor byte [edi + esi], al
cmp ebx, 0xf
jne 0x40a742
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc esi
cmp esi, ebx
jl 0x40a704
pop esi
cmp ebx, 0x2d
jne 0x40a75e
or dword [0x23c4a9c], 0xffffffff
mov dword [0x23c4a98], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
leave
ret
Function at 0x10005baf
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1074
call fcn.100588e0
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x1070], eax
push esi
mov esi, dword [esp + 0x107c]
push edi
mov edi, dword [esp + 0x1084]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x100c4ef4]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x108c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
mov ecx, 0x800
cvtdq2pd xmm0, xmm0
push ecx
andps xmm0, xmmword [0x100c4f30]
divsd xmm0, qword [0x100c4f00]
addsd xmm0, qword [0x100c4ef8]
cvttsd2si eax, xmm0
xorps xmm0, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x7c]
push eax
push 0x1002
push ecx
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
push 5
lea eax, [esp + 0x7c]
push 0x100c2e18
push eax
call fcn.100aadfa
test eax, eax
mov ecx, 0x100c2e24
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.100aadfa
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x1078]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100587af
add esp, 0x1074
ret 0xc
Function at 0x1000fffd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x134
mov eax, dword [0x1011ca44]
xor eax, ebp
mov dword [ebp + 0x70], eax
movzx eax, word [ebp + 0x7c]
push esi
mov esi, dword [0x1011fbe8]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x98], ecx
push esi
inc edi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x1001016e
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x1001016e
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001016e
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x1001016d
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x9c], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x100100e7
push 3
lea eax, [ebp - 0x90]
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], eax
call fcn.10010db8
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x90]
cmove edi, ecx
cmp dword [ebp - 0x94], eax
je 0x1001015f
push dword [ebp - 0x94]
call fcn.100aadfa
pop ecx
jmp 0x1001015f
mov ecx, 0x1234
cmp cx, ax
jne 0x1001015f
or dword [ebp - 0xbc], 0xffffffff
lea eax, [ebp - 0x90]
push 3
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x94], eax
call fcn.10010db8
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xb8], eax
cmp eax, ecx
je 0x10010139
push eax
call fcn.100aadfa
pop ecx
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0x98]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x9c]
test edi, edi
jne 0x1001005e
pop ebx
mov ecx, dword [ebp + 0x70]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100587af
add ebp, 0x74
leave
ret 4
Function at 0x10010183
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x4a8
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x4a4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x4b4]
lea eax, [esp + 0x2a4]
push esi
mov esi, dword [esp + 0x4bc]
mov ebx, 0x208
push edi
push ebx
push 0
push eax
call fcn.1005c640
push ebx
lea eax, [esp + 0xb4]
push 0
push eax
call fcn.1005c640
push 0x44
pop edi
push edi
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.1005c640
push ebp
lea eax, [esp + 0x2d4]
mov dword [esp + 0x88], edi
push ebx
push eax
call fcn.100aadfa
push esi
push ebp
push 0x100c6a40
lea eax, [esp + 0xe0]
push ebx
push eax
call fcn.100aadfa
add esp, 0x44
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x2d0]
push eax
call fcn.100aadfa
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
add esp, 0x28
test eax, eax
jne 0x100102c7
call ebx
mov esi, eax
mov edi, 0x2e4
cmp esi, edi
jne 0x100102c0
lea eax, [esp + 0xa4]
mov dword [esp + 0x24], 0x3c
xor ecx, ecx
mov dword [esp + 0x34], eax
xorps xmm0, xmm0
mov dword [esp + 0x28], 0x40
lea eax, [esp + 0x24]
movlpd qword [esp + 0x48], xmm0
push eax
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], 0x100c6a4c
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 5
mov dword [esp + 0x48], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100102fa
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x100102fa
mov dword [esp + 0x14], eax
jmp 0x100102cb
call fcn.100aadfa
jmp 0x100102f8
mov eax, dword [esp + 0x14]
push eax
call fcn.10004cff
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x100102ea
mov esi, dword [esp + 0x10]
jmp 0x100102ee
call ebx
mov esi, eax
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, esi
push ebp
call fcn.100aadfa
pop ecx
mov ecx, dword [esp + 0x4b4]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100587af
add esp, 0x4a8
ret
Function at 0x10011b8b
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1fac]
mov eax, 0x202c
call fcn.100588e0
mov eax, dword [0x1011ca44]
xor eax, ebp
mov dword [ebp + 0x1fa8], eax
push ebx
push esi
mov esi, dword [ebp + 0x1fb4]
lea eax, [ebp - 0x60]
push edi
mov ebx, 0x1000
xor edi, edi
push ebx
push edi
push eax
call fcn.1005c640
push ebx
lea eax, [ebp + 0xfa0]
push edi
push eax
call fcn.1005c640
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x800
call dword [sym.imp.kernel32.dll_GetTempPathW]
push 3
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x1fa0]
push 4
push eax
call fcn.100aadfa
lea eax, [ebp + 0x1fa0]
push eax
call fcn.100aadfa
add esp, 0x14
cmp eax, 0x64
jae 0x10011c3e
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x80], vtable.ATL::CSimpleDialog_110__1_.0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x80]
call fcn.1000ff90
cmp dword [ebp - 0x6c], edi
je 0x10011cb1
push dword [ebp - 0x6c]
call fcn.100aadfa
jmp 0x10011cb1
lea eax, [ebp + 0xfa0]
push eax
push edi
push 0x100c6a50
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
test eax, eax
je 0x10011cac
lea ecx, [ebp + 0xfa0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10011c62
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 8]
cmp ecx, ebx
jae 0x10011cce
xor eax, eax
mov word [ebp + ecx + 0xfa0], ax
lea eax, [ebp + 0xfa0]
push eax
push str._s.exe
push ebx
push esi
call fcn.100aadfa
push edi
push esi
call fcn.100aadfa
add esp, 0x18
cmp eax, 0xffffffff
jne 0x10011c3e
xor eax, eax
jmp 0x10011cb6
call fcn.100aadfa
mov eax, 0x80004005
mov ecx, dword [ebp + 0x1fa8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100587af
add ebp, 0x1fac
leave
ret
call fcn.100aadfa
int3

Function at 0x10013e25
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x1011ca44]
xor eax, ebp
mov dword [ebp + 0x790], eax
push esi
lea eax, [ebp - 0x74]
xor esi, esi
push eax
push 0x20019
push esi
push 0x100c6928
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10013e97
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x800
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push str.Allow_Unsigned_Installers
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10013e97
xor eax, eax
inc eax
jmp 0x10013ec2
push str.TOOLKIT_ALLOW_UNSIGNED
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.100aadfa
add esp, 0xc
test eax, eax
jne 0x10013ec0
cmp dword [ebp - 0x78], eax
je 0x10013ec0
push dword [ebp - 0x78]
call fcn.100aadfa
pop ecx
jmp 0x10013e92
xor eax, eax
mov ecx, dword [ebp + 0x790]
xor ecx, ebp
pop esi
call fcn.100587af
add ebp, 0x794
leave
ret