joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002107c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x220], 0
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [ebp - 0x220]
push eax
push 0x1005b573
push ecx
xor esi, esi
push ebx
mov dword [ebp - 0x210], ecx
inc esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x220], 0
jne 0x100210e0
xor eax, eax
jmp 0x10021175
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10074510
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x220]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100779cf
pop ecx
pop ecx
test eax, eax
jne 0x10021173
push 0x1011
xor esi, esi
call fcn.1005868d
push 0xa
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.100787d6
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
push esi
push 0x468
push dword [ebp - 0x210]
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret 0xc
Function at 0x10035106
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
push 0x1005b573
push ecx
mov dword [ebp - 0x20], ecx
mov edi, ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov esi, ebx
mov eax, dword [ebp + esi*4 - 0x30]
test eax, eax
je 0x1003521f
xor ecx, ecx
mov word [ebp - 0xc], cx
push 4
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0xa], ebx
mov word [ebp - 6], bx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.100779cf
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10078bfd
mov edx, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ecx
test edx, edx
jne 0x1003519c
xor ebx, ebx
test esi, esi
jne 0x1003521f
xor eax, eax
mov dword [ebp - 0x14], eax
test edx, edx
jle 0x100351c8
movzx eax, byte [ebp + eax*2 - 0xc]
push eax
call fcn.1007895a
pop ecx
test eax, eax
je 0x100351c6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x18]
jl 0x100351a5
mov ecx, dword [ebp - 0x1c]
jmp 0x100351c8
xor ecx, ecx
test esi, esi
jne 0x100351f9
test ecx, ecx
je 0x100351ec
cmp ebx, 1
jl 0x100351ec
cmp ebx, 0x7f
je 0x100351ec
cmp ebx, 0xdf
jle 0x100351f5
xor edi, edi
inc edi
mov ebx, 0xdf
jmp 0x1003522e
xor edi, edi
xor ecx, ecx
inc edi
inc ecx
mov dword [ebp - 0x10], ecx
xor ebx, ebx
jmp 0x1003521b
test ecx, ecx
je 0x10035213
test ebx, ebx
js 0x10035213
cmp ebx, 0xff
jle 0x100351f5
push 2
pop edi
mov ebx, 0xff
jmp 0x1003522e
push 2
xor ebx, ebx
pop edi
mov dword [ebp - 0x10], ebx
test edi, edi
jg 0x1003522b
inc esi
cmp esi, 4
jl 0x10035140
jmp 0x1003527d
mov ebx, dword [ebp - 0x10]
mov eax, edi
dec eax
je 0x1003523d
dec eax
jne 0x10035248
push 0x1012
jmp 0x10035242
push 0x1011
call fcn.1005868d
pop ecx
push 0xa
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.100787d6
add esp, 0x10
cmp esi, 4
jge 0x1003526c
lea eax, [ebp - 0xc]
push eax
push dword [ebp + esi*4 - 0x30]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push esi
push 0x468
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret 4
Function at 0x1003ad4b
Capabilities:
Get file attributes

Disassembly:
push 0x1c
mov eax, 0x1008aab7
call fcn.10075620
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push str.pFileName___1_lS__n
push 0x100ae928
push 5
mov edi, eax
call fcn.10009c3c
push edi
push str.dwRet__0x_1_lx_._n
push str.FILEEXISTW
push 5
call fcn.10009c3c
add esp, 0x20
lea ecx, [ebp - 0x28]
call fcn.100038d4
xor eax, eax
cmp edi, 0xffffffff
setne al
call fcn.100755cf
ret

Function at 0x1003c772
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x100aa9a4
push 1
xor esi, esi
push esi
push 0x100aa994
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x1003c82f
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1003c83c
lea edx, [ebp - 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x1c]
mov eax, dword [ebp - 8]
test al, 1
je 0x1003c7dd
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
js 0x1003c82f
mov eax, dword [ebp - 8]
test al, 2
je 0x1003c7f9
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
push edx
push 2
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
js 0x1003c82f
mov eax, dword [ebp - 8]
test al, 4
je 0x1003c812
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
push edx
push 4
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
js 0x1003c82f
or eax, 0xffffffff
cmp word [ebp - 0xc], ax
je 0x1003c827
cmp word [ebp - 0x10], ax
je 0x1003c827
cmp word [ebp - 0x14], ax
jne 0x1003c82a
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1003c83c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1003c842
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x100aa9a4
xor ecx, ecx
push 1
push ecx
push 0x100aa994
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x1003c8c6
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1003c8c9
mov eax, dword [ecx]
lea edx, [ebp - 8]
push edx
push ecx
call dword [eax + 0x48]
mov esi, eax
test esi, esi
js 0x1003c8c6
cmp dword [ebp - 8], 0
je 0x1003c8d6
push dword [ebp + 8]
call fcn.1003ca55
push 6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1003c8e8
mov esi, eax
add esp, 0x18
test esi, esi
js 0x1003c8c6
push 0x11
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1003c8e8
add esp, 0x14
mov esi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test edx, edx
je 0x1003c8d9
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1003c8e3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
pop esi
leave
ret
Function at 0x1003c8e8
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push 0xc
mov eax, 0x1008ac8f
call fcn.100755ed
lea eax, [ebp - 0x10]
push eax
push 0x100afbb0
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
push edi
push 0x100afba0
mov dword [ebp - 0x10], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x1003ca40
cmp dword [ebp - 0x10], edi
je 0x1003ca4d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.1003cbb0
mov eax, dword [eax]
mov dword [ebp - 4], edi
test eax, eax
je 0x1003c93d
mov edx, dword [eax]
jmp 0x1003c93f
mov edx, edi
mov eax, dword [ebp - 0x10]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov esi, eax
test ecx, ecx
je 0x1003c95b
call fcn.1003cc0d
test esi, esi
js 0x1003ca40
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
call fcn.1003cbb0
mov edx, dword [eax]
mov dword [ebp - 4], ebx
test edx, edx
je 0x1003c97b
mov edx, dword [edx]
jmp 0x1003c97d
mov edx, edi
mov eax, dword [ebp - 0x10]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov esi, eax
test ecx, ecx
je 0x1003c999
call fcn.1003cc0d
test esi, esi
js 0x1003ca40
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.1003cbb0
mov edx, dword [eax]
mov dword [ebp - 4], 2
test edx, edx
je 0x1003c9bd
mov edx, dword [edx]
jmp 0x1003c9bf
mov edx, edi
mov eax, dword [ebp - 0x10]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
mov esi, eax
test ecx, ecx
je 0x1003c9de
call fcn.1003cc0d
mov dword [ebp - 0x14], edi
test esi, esi
js 0x1003ca40
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
mov esi, eax
test esi, esi
js 0x1003ca40
mov eax, dword [ebp - 0x10]
push SysReAllocString
mov ecx, dword [eax]
push eax
call dword [ecx + 0x98]
mov esi, eax
test esi, esi
js 0x1003ca40
mov eax, dword [ebp - 0x10]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa8]
mov esi, eax
test esi, esi
js 0x1003ca40
mov eax, dword [ebp - 0x10]
push 0xffffffffffffffff
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov esi, eax
test esi, esi
js 0x1003ca40
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1003ca4d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
call fcn.100755bb
ret
Function at 0x1004343e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100ea384], 0
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x21c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x224], eax
mov eax, 0x80004005
movsd dword es:[edi], dword [esi]
mov esi, eax
je 0x10043536
test ebx, ebx
je 0x100435e6
cmp dword [ebp + 0x24], 0
je 0x100435e6
push str.Shell32.dll
call int.10004f10
mov edi, eax
pop ecx
test edi, edi
jne 0x100434bd
push str.Shell32.dll_SAW_LoadLibrary_failed._n
push 0x100b2f88
push 4
call fcn.10009c3c
add esp, 0xc
jmp 0x100435dd
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100434e3
push str.SHGetKnownFolderPath_GetProcAddress_failed._n
push str.GetKnownFolderPath
push 4
call fcn.10009c3c
add esp, 0xc
jmp 0x1004352a
lea ecx, [ebp - 0x220]
push ecx
push dword [ebp - 0x224]
lea ecx, [ebp - 0x21c]
push dword [ebp + 0x18]
push ecx
call eax
mov esi, eax
test esi, esi
jne 0x1004351e
push dword [ebp - 0x220]
push dword [ebp + 0x24]
push ebx
call fcn.10077973
add esp, 0xc
test eax, eax
mov eax, 0x80004005
cmovne esi, eax
push dword [ebp - 0x220]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100435dd
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10074510
add esp, 0xc
mov dword [ebp - 0x220], 0xffff
test ebx, ebx
je 0x100435e1
cmp dword [ebp + 0x24], 0
je 0x100435e1
lea eax, [ebp - 0x220]
push eax
sub esp, 0x10
lea esi, [ebp - 0x21c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100439fe
add esp, 0x14
test eax, eax
je 0x100435e1
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10043b4b
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x224]
push dword [ebp - 0x220]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jne 0x100435dd
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x24]
push ebx
call fcn.10077973
add esp, 0xc
test eax, eax
mov eax, 0x80004005
cmovne esi, eax
mov eax, esi
jmp 0x100435e6
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret
Function at 0x100435f5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100ea384], 0
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x22c], ebx
mov edi, 0x80004005
je 0x100436d6
and dword [ebp - 0x224], 0
push 0x100b2b9c
call int.10004f10
mov esi, eax
pop ecx
test esi, esi
jne 0x1004366a
push 0x100b2bb4
push 0x100b2bdc
push 4
call fcn.10009c3c
add esp, 0xc
jmp 0x100436cf
push 0x100b2bf0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10043690
push 0x100b2c08
push 0x100b2c38
push 4
call fcn.10009c3c
add esp, 0xc
jmp 0x100436c8
lea ecx, [ebp - 0x224]
push ecx
push dword [ebp - 0x228]
lea ecx, [ebp - 0x220]
push dword [ebp + 0x18]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x100436bc
push dword [ebp - 0x224]
mov ecx, ebx
call fcn.10004097
push dword [ebp - 0x224]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x1004378b
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.10074510
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
sub esp, 0x10
lea esi, [ebp - 0x220]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x224], 0xffff
movsd dword es:[edi], dword [esi]
call fcn.100439fe
add esp, 0x14
test eax, eax
jne 0x10043729
mov eax, 0x80070057
jmp 0x1004378b
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.10043b4b
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x228]
push dword [ebp - 0x224]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jne 0x10043789
cmp word [ebp - 0x210], bx
je 0x10043776
lea eax, [ebp - 0x210]
push eax
call fcn.10074c74
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x22c]
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.100040be
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret
Function at 0x10043898
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x18], eax
mov esi, 0x80004005
cmp dword [0x100ea384], ebx
je 0x10043951
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.10043a3a
pop ecx
pop ecx
test eax, eax
jne 0x100438ea
mov eax, esi
jmp 0x1004395e
push edi
push 0x100b2d04
call int.10004f10
mov edi, eax
pop ecx
test edi, edi
jne 0x10043912
push 0x100b2d1c
push 0x100b2d44
push 4
call fcn.10009c3c
add esp, 0xc
jmp 0x1004394c
push str.SHGetKnownFolderIDList
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10043938
push str.SHGetKnownFolderIDList_GetProcAddress_failed._n
push str.GetKnownFolderIDList
push 4
call fcn.10009c3c
add esp, 0xc
jmp 0x10043945
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ebx
push ebx
push ecx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
jmp 0x1004395e
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret

Function at 0x1004c1f9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x108], eax
jne 0x1004c240
cmp dword [ebp - 0x114], 4
jne 0x1004c240
cmp dword [ebp - 0x110], 0xa
jae 0x1004c242
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075551
leave
ret
Function at 0x1004c2a3
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x103
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
mov bl, 1
call fcn.10078398
add esp, 0x10
cmp word [ebp - 0x20c], 0
lea esi, [ebp - 0x20c]
je 0x1004c377
jmp 0x1004c2fb
test ax, ax
je 0x1004c306
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push 0x5c
pop ecx
movzx eax, word [esi]
cmp ax, cx
jne 0x1004c2ed
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x414]
cmp eax, esi
je 0x1004c328
mov ecx, eax
mov ax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ecx, esi
jne 0x1004c318
xor eax, eax
mov word [edx], ax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1004c352
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x1004c354
test al, 0x10
je 0x1004c373
push 0x5c
pop ecx
cmp word [esi], cx
jne 0x1004c36a
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 0x5c
mov esi, eax
pop ecx
xor eax, eax
cmp word [esi], ax
jne 0x1004c2fe
jmp 0x1004c377
xor eax, eax
mov bl, al
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret
Function at 0x1004ed03
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x103
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call fcn.10074510
add esp, 0xc
mov dword [ebp - 0x110], ebx
test esi, esi
je 0x1004ed6f
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
push 0x104
push eax
call fcn.10074484
add esp, 0x10
push 0xf0000000
push 0x18
push ebx
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1004ed94
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004ee88
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x800c
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1004edcd
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1004edd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004ee5d
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
push 2
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1004edcd
push dword [ebp - 0x110]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1004ee5b
push 0
lea eax, [ebp - 0x110]
push eax
push esi
push 2
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1004ee49
push dword [ebp - 0x110]
push esi
push dword [ebp - 0x110]
push dword [ebp - 0x118]
call fcn.10074484
add esp, 0x10
jmp 0x1004ee4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [ebp - 0x10c], 0
je 0x1004ee72
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x114], 0
je 0x1004ee88
push ebx
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret
Function at 0x1005030a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100e5bc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x105
lea eax, [ebp - 0x210]
push eax
mov ebx, ecx
mov edi, esi
push esi
jmp 0x10050373
push 0x105
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call fcn.100785c2
add esp, 0xc
test eax, eax
je 0x10050382
push 0x105
lea eax, [ebp - 0x210]
inc edi
push eax
push edi
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10050347
jmp 0x10050385
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075551
leave
ret 4

Function at 0x10050a63
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.10050398
test eax, eax
je 0x10050af5
push edi
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esi + 4]
call ebx
mov eax, dword [ebp - 4]
lea edi, [eax + 2]
test eax, eax
je 0x10050aec
cmp edi, eax
jbe 0x10050aec
cmp dword [esi + 0x20], 0
je 0x10050ab3
push dword [esi + 0x20]
call fcn.100450c6
and dword [esi + 0x20], 0
pop ecx
push 0x292
push str...CommonRegistry.cpp
push edi
call fcn.1004501b
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
je 0x10050af4
push edi
push 0
push eax
call fcn.10074510
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [esi + 0x20]
push 0
push 0
push dword [ebp + 8]
push dword [esi + 4]
call ebx
mov eax, dword [esi + 0x20]
shr edi, 1
mov dword [esi + 0x24], edi
pop edi
pop esi
pop ebx
leave
ret 4