joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100252d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10025315
jmp 0x10025388
mov eax, 1
test eax, eax
je 0x10025377
mov byte [ebp - 0x110], 0
mov dword [ebp - 0x11c], 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x110]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1002535c
jmp 0x10025377
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.100252d0
add esp, 8
test eax, eax
jne 0x10025375
jmp 0x10025377
jmp 0x10025315
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x1002539f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret

Function at 0x100262a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
movsx eax, byte [ebp - 1]
test eax, eax
je 0x100262c3
mov eax, 1
jmp 0x100262c5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10026350
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x70
je 0x10026376
mov eax, 1
jmp 0x10026378
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10026b22
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10053170], 0
push esi
jne 0x10026a95
call fcn.100269c0
test eax, eax
je 0x10026ad8
mov eax, dword [0x10053170]
cmp eax, 1
jne 0x10026ab6
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10026ad8
pop esi
ret
push eax
call dword [0x10053178]
test eax, eax
jne 0x10026b20
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10026adc
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x10053170]
call dword [0x10053178]
mov edi, eax
test edi, edi
je 0x10026b03
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x10026b1f
lea edi, [esi + 0xff0]
push esi
push dword [0x10053170]
call dword [0x10053174]
add esi, 0x10
cmp esi, edi
jb 0x10026b09
mov eax, esi
pop edi
pop esi
ret
jmp 0x10026a82
Function at 0x10027880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.ProgramFiles
stosb byte es:[edi], al
call fcn.100306cd
add esp, 4
test eax, eax
je 0x100278db
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x40c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x400
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 8]
push 0x400
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 8]
push 0x1004e768
push edx
call fcn.1003058d
add esp, 8
test eax, eax
je 0x10027960
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x40c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Program_Files
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x400
ret

Function at 0x100279b0
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
Function at 0x100279eb
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret

Function at 0x100279fd
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
Function at 0x10027a0f
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret

Function at 0x10027a21
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
Function at 0x10027a33
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret

Function at 0x10027a45
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10027a50
call sub.WSOCK32.dll_WSAGetLastError
add eax, 0xffffd8e2
cmp eax, 0x4e
ja case.0x100279e4.10019
xor ecx, ecx
mov cl, byte [eax + 0x10027a70]
jmp dword [ecx*4 + 0x10027a58]
push str.the_underlying_network_subsystem_is_not_ready_for_network_communication._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.The_lpWSAData_is_not_a_valid_pointer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
push str.Socket_Startup_failed__but_unknown_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x190
ret
Function at 0x10028c30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
jle 0x10028c87
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x1c]
push 1
push eax
push ebp
call sub.WSOCK32.dll_recv
cmp eax, 1
jne 0x10028c6c
mov al, byte [esp + 0x18]
cmp al, 0xa
je 0x10028c8b
mov byte [esi], al
inc esi
inc edi
cmp edi, ebx
jl 0x10028c46
jmp 0x10028c8b
test eax, eax
mov byte [esi], 0
jne 0x10028c7f
cmp edi, 1
jne 0x10028c8b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov esi, dword [esp + 0x18]
mov byte [esi], 0
mov al, byte [esi - 1]
dec esi
cmp al, 0xd
jne 0x10028c9a
mov byte [esi], 0
dec edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10028cb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
test ebp, ebp
push edi
mov esi, ebp
jle 0x10028cde
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 0
push esi
push edi
push ebx
call sub.WSOCK32.dll_send
test eax, eax
jl 0x10028ce2
je 0x10028ce7
sub esi, eax
add edi, eax
test esi, esi
jg 0x10028cc6
mov eax, ebp
sub eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10029570
Capabilities:
Check if file exists
Get file version info

Disassembly:
sub esp, 0x408
push ebx
mov ebx, dword [esp + 0x410]
push ebp
push esi
push edi
push 0
push ebx
mov dword [esp + 0x18], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x10029600
mov ecx, 0xff
lea edi, [esp + 0x19]
mov byte [esp + 0x18], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100295c1
push ebx
lea eax, [esp + 0x1c]
push str._VerUp_Ver__File_not_found__s_
push eax
jmp 0x100295cc
push eax
lea ecx, [esp + 0x1c]
push str._VerUp_Ver__Error_in_retrieving_version_1___d_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x430]
mov edi, dword [esp + 0x42c]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 0xc
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x408
ret
push esi
call fcn.1002b1c7
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x1002975f
push ebp
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10029664
mov ecx, 0xff
lea edi, [esp + 0x19]
mov byte [esp + 0x18], al
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1002b28a
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1c]
push str._VerUp_Ver__Error_in_retrieving_version_2___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x1004e768
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x100296c0
mov ecx, 0xff
lea edi, [esp + 0x19]
mov byte [esp + 0x18], al
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1002b28a
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1c]
push str._VerUp_Ver__Error_in_retrieving_version_3___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret
mov eax, dword [esp + 0x428]
test eax, eax
jne 0x100296d7
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
jmp 0x100296e6
cmp eax, 1
jne 0x10029756
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov ecx, dword [esp + 0x424]
mov edi, dword [esp + 0x420]
mov ebx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov eax, edx
and ecx, 0xffff
and eax, 0xffff
shr esi, 0x10
push ecx
push esi
mov esi, dword [esp + 0x428]
push eax
shr edx, 0x10
push edx
push str._d._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push ebp
call fcn.1002b28a
push 0x100531c0
push esi
call fcn.1002fb46
add esp, 0x24
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
pop ebp
dec eax
pop ebx
add esp, 0x408
ret
push ebp
call fcn.1002b28a
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x408
ret
Function at 0x10029970
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x454
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x60]
push eax
call fcn.10027880
mov edi, str.SoftForumXecureWebActiveX_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x68]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ClientSM.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x68]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.10030895
add esp, 0xc
test eax, eax
je 0x10029a11
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x454
ret
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0x44
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x34], ecx
mov word [esp + 0x68], cx
push ecx
lea ecx, [esp + 0x80]
push 0x100531c0
push ecx
mov dword [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
dec eax
pop ebp
add esp, 0x454
ret
Function at 0x1002a600
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
push str.ProgramFiles
call fcn.100306cd
add esp, 4
test eax, eax
je 0x1002a640
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x1002a6c3
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xc]
push 0x1004e768
push edx
call fcn.1003058d
add esp, 8
test eax, eax
jne 0x1002a678
mov eax, 0x1004edac
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Program_Files
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.SoftForumXecureWebActiveX_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret