joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a61d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0054546a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x54a68c
cmp esi, dword [ebp - 4]
je 0x54a687
cmp dword [ebp + 0xc], 0
je 0x54a687
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x54a664
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0054a6e6
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x54a68e
xor eax, eax
inc eax
jmp 0x54a68e
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x54aa35
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x54aa80
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0054abab
test al, al
jne 0x54aa7a
sub edx, 2
cmp edx, edi
jne 0x54aa60
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x54aaa2
lea eax, [edi + 2]
cmp edx, eax
je 0x54aaa2
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0054a981
add esp, 0x10
jmp 0x54ab9c
push esi
lea ecx, [ebp - 0x255]
call fcn.0054abab
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x54aae5
push dword [ebp - 0x25c]
jmp 0x54aa92
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x54ab22
cmp word [ebp - 0x226], 0
je 0x54ab43
cmp word [ebp - 0x226], ax
jne 0x54ab22
cmp word [ebp - 0x224], 0
je 0x54ab43
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0054a981
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x54ab8f
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x54aafc
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x54ab77
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x54ab9c
push 0x54abd0
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00541910
add esp, 0x10
jmp 0x54ab6c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00528e13
leave
ret
Function at 0x54c17d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x54c21a
push ebx
push esi
call fcn.0054c26b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0054c081
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x54c1c7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x54c219
push edi
push eax
call fcn.00460530
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x54c1e7
call fcn.00460590
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x54c218
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0054c081
add esp, 0x20
test eax, eax
jne 0x54c206
push edi
call fcn.00460590
jmp 0x54c20e
push ebx
call fcn.00460590
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x54c21d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x54c22e
pop esi
ret
push ebx
push edi
push esi
call fcn.0054c26b
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00460530
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x54c256
push ebx
push esi
push edi
call fcn.0052bc90
add esp, 0xc
push 0
call fcn.00460590
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x54c2ad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054c518

Function at 0x54e185
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x54e1c8
call fcn.00539d3f
mov dword [eax], 0xf
call fcn.00539d2c
mov dword [eax], 0xd
call fcn.00546e92
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00528e13
leave
ret
test eax, eax
jne 0x54e1cf
inc eax
jmp 0x54e1bc
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x54e1ba
xor eax, eax
cmp ecx, 1
setne al
jmp 0x54e1bc
Function at 0x1003ae5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
cmp byte [0x10114a5], 0
mov eax, dword [0x10112d4]
mov dword [ebp - 4], eax
jne 0x1003b6d
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x1001d38
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1003b3d
cmp eax, 0x64
ja 0x1003b3d
lea eax, [ebp - 0xcc]
push 0x1001d24
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1003b3d
mov byte [0x10114a4], 1
test byte [0x10110dc], 4
mov byte [0x10114a5], 1
je 0x1003b6d
movzx eax, byte [0x10114a4]
push eax
push 0x1001c08
push 0xe
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
mov ecx, dword [ebp - 4]
mov al, byte [0x10114a4]
call fcn.01006c1c
leave
ret

Function at 0x10042e2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x30
call fcn.01007253
mov esi, eax
test esi, esi
je 0x1004304
mov ecx, esi
call fcn.01003986
mov ecx, esi
jmp 0x1004306
xor ecx, ecx
mov dword [0x10114d0], ecx
call fcn.010057d2
mov esi, eax
test esi, esi
jge 0x100433c
test byte [0x10110dc], 1
je 0x1004339
push esi
push 0x1001c08
push 0x22
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push esi
jmp 0x10043a8
test byte [0x10110dc], 4
mov esi, 0x1001c08
je 0x100435e
push esi
push 0x23
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a4a
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10114d0]
push 0x1005b04
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10043be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x10110dc], 1
je 0x10043a3
push eax
push esi
push 0x24
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push 0xc00e0027
lea ecx, [ebp - 0x14]
call fcn.01007891
push 0x100ecf0
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll__CxxThrowException
test byte [0x10110dc], 4
je 0x10043db
push esi
push 0x25
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a4a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x1004ce5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100e45f
call fcn.01006f08
mov eax, 0x1598
call fcn.01006fb0
mov eax, dword [0x10112d4]
push esi
push edi
push 0x7f
pop ecx
mov dword [ebp - 0x10], eax
xor eax, eax
xor esi, esi
mov word [ebp - 0x210], si
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
push 0x1001fc8
push 0x1001f80
push 0x1001f70
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push 0x100
push eax
call fcn.01003d4d
add esp, 0x14
cmp eax, esi
jge 0x1004d6d
test byte [0x10110dc], 1
je 0x1004e34
push eax
push 0x1001f48
push 0xa
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
jmp 0x1004e34
mov dword [ebp - 0x159c], esi
lea eax, [ebp - 0x159c]
push eax
push 1
push esi
lea eax, [ebp - 0x210]
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1004db0
test byte [0x10110dc], 1
je 0x1004e1c
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1001f48
push 0xb
jmp 0x1004e0b
lea eax, [ebp - 0x15a4]
push eax
lea eax, [ebp - 0x1598]
push eax
push esi
push esi
lea eax, [ebp - 0x15a0]
push eax
lea eax, [ebp - 0x9e0]
push eax
push esi
push dword [ebp - 0x159c]
mov dword [ebp - 0x15a0], 0x3e8
mov dword [ebp - 0x15a4], 0xbb8
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
je 0x1004e38
test byte [0x10110dc], 1
je 0x1004e1c
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1001f48
push 0xc
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01008cb8
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x159c], esi
je 0x1004e34
push dword [ebp - 0x159c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1004e81
test byte [0x10110dc], 4
je 0x1004e67
lea eax, [ebp - 0x9e0]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1001f48
push 0xd
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01004a78
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x159c], esi
je 0x1004e7f
push dword [ebp - 0x159c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.01006c1c
leave
ret
Function at 0x1005427
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test byte [0x101111c], 4
push ebx
push esi
push edi
mov ebx, 0x1001f48
je 0x1005452
push ebx
push 0x12
push dword [0x1011114]
push dword [0x1011110]
call fcn.01003a4a
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, edi
je 0x10054d6
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x10054d6
cmp dword [eax], edi
je 0x10054f3
push 8
call fcn.01007253
mov word [eax], 4
mov word [eax + 2], 1
mov ecx, dword [esi + 0xc]
mov ecx, dword [edi + ecx]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
test byte [0x101111c], 4
mov dword [ebp - 4], eax
je 0x10054bc
mov eax, dword [esi + 0xc]
mov eax, dword [edi + eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push ebx
push 0x14
push dword [0x1011114]
push dword [0x1011110]
call fcn.010048ab
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0100530a
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], 0
jne 0x1005470
jmp 0x10054f3
test byte [0x101111c], 2
je 0x10054f3
push ebx
push 0x13
push dword [0x1011114]
push dword [0x1011110]
call fcn.01003a4a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10063b1
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
test byte [0x101111c], 4
mov eax, dword [0x10112d4]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
je 0x10063e5
push 0x10020c8
push 0xa
push dword [0x1011114]
push dword [0x1011110]
call fcn.01003a4a
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10063f3
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x100643b
test byte [0x10110dc], 1
je 0x1006427
push 0x10020c8
push 0xb
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a4a
push 0xa
push dword [0x1011290]
call fcn.01004c8a
xor al, al
jmp 0x10065a1
push ebx
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 0xfffffffffffffffb
mov ebx, GetCurrentThreadId
push ebx
push eax
mov dword [ebp - 0x1c], 1
call edi
test eax, eax
je 0x1006490
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10110dc], 1
mov esi, eax
je 0x1006489
push esi
push 0x10020c8
push 0xc
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push 0x14
jmp 0x100655c
cmp dword [ebp + 8], 0
je 0x10064d8
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x20
push ebx
push dword [esi]
call edi
test eax, eax
je 0x10064d8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10110dc], 1
mov esi, eax
je 0x10064d1
push esi
push 0x10020c8
push 0xd
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push 0x1e
jmp 0x100655c
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x14], 2
mov dword [ebp - 0x2c], 0x1001cc8
mov dword [ebp - 0x28], 0x10020e0
mov dword [ebp - 0x24], 0x709
call fcn.010080f0
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x100656c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10110dc], 1
mov esi, eax
je 0x100655a
push esi
push 0x10020c8
push 0xe
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push 0x28
push dword [0x1011290]
push esi
call fcn.01006330
xor al, al
jmp 0x100659f
test byte [0x101111c], 4
je 0x100659d
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp - 0x18]
push dword [ebp + 8]
push 0x10020c8
push 0xf
push dword [0x1011114]
push dword [0x1011110]
call fcn.01006355
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01006c1c
leave
ret 8
Function at 0x10065b3
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
test byte [0x101111c], 4
push ebx
push esi
push edi
mov esi, ecx
je 0x10065e4
push 0x10020c8
push 0x12
push dword [0x1011114]
push dword [0x1011110]
call fcn.01003a4a
mov ebx, dword [esi]
xor ecx, ecx
cmp ebx, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10c], ecx
jbe 0x1006645
mov edi, ebx
xor eax, eax
cmp dword [ebp - 0x10c], eax
jbe 0x100661a
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx + 4]
cmp dword [ebp + eax*4 - 0x108], edx
je 0x100661a
inc eax
cmp eax, dword [ebp - 0x10c]
jb 0x1006608
cmp eax, dword [ebp - 0x10c]
jne 0x100663f
cmp dword [ebp - 0x10c], 0x40
jae 0x100663f
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx + 4]
mov dword [ebp + eax*4 - 0x108], edx
inc dword [ebp - 0x10c]
add ecx, 0x18
dec edi
jne 0x10065f7
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x10c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100668e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10110dc], 1
mov esi, eax
je 0x1006687
push esi
push 0x10020c8
push 0x13
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push 0x5a
jmp 0x100676d
xor edi, edi
test ebx, ebx
jbe 0x10066b7
xor ebx, ebx
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx + 4]
lea ecx, [ebp - 0x10c]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x10066ea
inc edi
add ebx, 0x18
cmp edi, dword [ebp - 8]
jb 0x1006696
test byte [0x10110dc], 1
je 0x10066d8
push 0x10020c8
push 0x15
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a4a
push 0x64
push dword [0x1011290]
call fcn.01004c8a
jmp 0x1006779
test byte [0x101111c], 4
mov ebx, 0x10020c8
je 0x100670d
push edi
push ebx
push 0x14
push dword [0x1011114]
push dword [0x1011110]
call fcn.01003a70
mov ecx, dword [esi + 4]
lea eax, [edi + edi*2]
lea eax, [ecx + eax*8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 4], 0x10
mov eax, dword [eax + 4]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jne 0x100677d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10110dc], 1
mov esi, eax
je 0x100676b
push edi
push ebx
push 0x16
push dword [0x10110d4]
push dword [0x10110d0]
call fcn.01003a70
push 0x6e
push dword [0x1011290]
push esi
call fcn.01006330
xor al, al
jmp 0x100679d
test byte [0x101111c], 4
je 0x100679b
push eax
push ebx
push 0x17
push dword [0x1011114]
push dword [0x1011110]
call fcn.01003a70
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x1006c1c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10112d4]
jne 0x1006c2d
test ecx, 0xffff0000
jne 0x1006c2d
ret
jmp fcn.01006c37
Function at 0x1006d1c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1002190
call fcn.01007000
cmp word [0x1000000], 0x5a4d
jne 0x1006d5b
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1006d5b
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1006d74
cmp ecx, 0x20b
je 0x1006d61
and dword [ebp - 0x1c], 0
jmp 0x1006d8b
cmp dword [eax + 0x1000084], 0xe
jbe 0x1006d5b
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1006d85
cmp dword [eax + 0x1000074], 0xe
jbe 0x1006d5b
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10118a4], 0xffffffff
or dword [0x10118a8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1011800]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10117fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10118a0], eax
call fcn.01009f26
cmp dword [0x10112e0], 0
jne 0x1006de8
push fcn.01009f26
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010071a3
push 0x1001298
push 0x1001294
call sub.msvcrt.dll__initterm
mov eax, dword [0x10117f8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10117f4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1001290
push 0x100125c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100390e
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x1006e60
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1006e95
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100703b
ret

Function at 0x1007cc6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push esi
push 0x1007b78
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
jne 0x1007d29
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x101103c], 1
mov esi, eax
je 0x1007d12
push esi
push 0x100227c
push 0xa
push dword [0x1011034]
push dword [0x1011030]
call fcn.01003a70
push esi
lea ecx, [ebp - 0x14]
call fcn.01007891
push 0x100f16c
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll__CxxThrowException
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push 0x1011304
push 1
call dword [eax + 4]
pop esi
leave
ret 4
Function at 0x1007f12
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100e5f6
call fcn.01006f08
sub esp, 0x10
push esi
push edi
mov esi, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [esi + esi]
cmp eax, dword [0x10118ac]
ja 0x1007f75
mov ecx, dword [0x10118b0]
lea edi, [esi + esi + 8]
add ecx, edi
cmp ecx, eax
jb 0x1007f75
push ecx
call fcn.0100e1af
test eax, eax
je 0x1007f75
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.01006fb0
mov edi, esp
test edi, edi
mov dword [ebp - 0x10], edi
je 0x1007f75
mov dword [edi], 0x6b637453
add edi, 8
mov dword [ebp - 0x10], edi
jne 0x1007f95
lea eax, [esi + esi + 8]
push eax
call dword [0x10118b4]
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x1007f95
mov dword [edi], 0x70616548
add edi, 8
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
push esi
push edi
call fcn.01007482
test eax, eax
jge 0x1007fc7
test byte [0x101103c], 1
je 0x1008027
push esi
push 0x1002740
push 0xa
push dword [0x1011034]
push dword [0x1011030]
call fcn.01003a70
jmp 0x1008027
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1008000
test byte [0x101103c], 1
je 0x1008027
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002740
push 0xb
push dword [0x1011034]
push dword [0x1011030]
call fcn.01003a70
jmp 0x1008027
cmp esi, eax
jae 0x1008043
test byte [0x101103c], 1
je 0x1008027
push eax
push esi
push 0x1002740
push 0xc
push dword [0x1011034]
push dword [0x1011030]
call fcn.01007e1d
push 0x10021ec
lea ecx, [ebp - 0x1c]
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::bad_alloc::constructor_char_const__]
push 0x100f024
lea eax, [ebp - 0x1c]
push eax
call sub.msvcrt.dll__CxxThrowException
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01007ef4
lea esp, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
leave
ret 8

Function at 0x1008067
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100e60d
call fcn.01006f08
sub esp, 0xc
push ebx
push esi
push 1
push edi
mov esi, ecx
call fcn.01007eb7
mov ebx, eax
mov dword [ebp - 0x18], ebx
and dword [ebp - 4], 0
test ebx, ebx
je 0x10080db
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0
push dword [edi + 8]
mov dword [ebp - 0x14], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10080b9
push edi
call fcn.01007e65
jmp 0x10080d0
cmp dword [ebp - 0x10], 2
jne 0x10080d0
cmp dword [ebp + 8], 1
jne 0x10080d0
shr esi, 1
push esi
push dword [ebp + 0xc]
call fcn.01007f12
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8