joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002279d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002dfd9
call fcn.1002b2c2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228e2
cmp dword [ebp - 0x18], 1
jne 0x100228e2
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f8f1
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x100228e2
push dword [ebp - 0x14]
push ebx
push esi
call fcn.1001f8f1
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228d7
cmp dword [ebp - 0x18], 1
jne 0x100228d7
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f8f1
mov dword [edi], eax
pop ecx
test eax, eax
je 0x100228d7
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.1001f8f1
lea eax, [ebp - 0x20]
push eax
push 0x10033448
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x100228bb
push ebx
call fcn.1001f8f1
pop ecx
test al, al
je 0x100228bb
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x100228d7
push dword [edi]
call fcn.1002b561
and dword [edi], 0
pop ecx
jmp 0x100228d7
test esi, esi
je 0x100228e2
push esi
call fcn.1002b561
pop ecx
call fcn.1002b220
ret

Function at 0x10023089
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x100331a4
xor esi, esi
call fcn.1001f8f1
pop ecx
test eax, eax
jne 0x100230aa
push 0x100331bc
call fcn.1001f8f1
pop ecx
test eax, eax
je 0x100230ad
xor esi, esi
inc esi
cmp byte [0x1003ce0b], 0
jne 0x100230bf
cmp byte [0x1003ce0a], 0
je 0x100230f5
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d650
push edi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100230e4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100230f4
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x1002549d
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003ce0b], 0
jne 0x100254df
cmp byte [0x1003ce0a], 0
je 0x10025516
movzx eax, bl
mov esi, 0x1003e1b8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10025506
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10025516
push esi
call fcn.10005ee0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003ce0b], 0
jne 0x1002552d
cmp byte [0x1003ce0a], 0
je 0x1002555f
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1b8
push esi
call fcn.1001f8f1
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002554f
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002555f
push esi
call fcn.10005ee0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028ddc
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028df9
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003ce0b], 0
jne 0x10028e0f
cmp byte [0x1003ce0a], 0
je 0x10028f4e
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e608
push edi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e35
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e4e
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e57
cmp byte [0x1003ce0a], 0
je 0x10028e77
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e77
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e90
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e99
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028ed2
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028edb
cmp byte [0x1003ce0a], 0
je 0x10028efb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028efb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f14
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028f1d
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push 4
push str.sizeof_void____d
push edi
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f4d
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028fdd
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e2c3
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, 0x1003e608
mov edi, dword [ebp + 8]
jne 0x10029008
mov al, byte [0x1003ce0a]
test al, al
jne 0x10029008
lea esi, [edi + 4]
jmp 0x1002901f
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.1001f8f1
mov al, byte [0x1003ce0a]
add esp, 0xc
test al, al
je 0x1002902a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002903a
push ebx
call fcn.10005ee0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1001f8f1
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1002906d
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.10003172
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b235
ret
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.1001f8f1
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.1001f8f1
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.1001f8f1
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.1001f8f1
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret
Function at 0x4015a0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x484004]
test eax, 0xc000000
je 0x4015ca
test dword [ebp + 8], eax
jne 0x401708
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
leave
ret
push esi
xor eax, eax
mov word [ebp - 0x504], ax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x518]
push eax
push 0x200
lea eax, [ebp - 0x504]
push eax
call fcn.004018cf
test eax, eax
jl 0x401820
test dword [0x484004], 0x8000000
push edi
mov edi, 0x401870
je 0x401801
cmp dword [0x484008], esi
je 0x401801
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x506]
push eax
movzx eax, word [ebp - 0x508]
push eax
movzx eax, word [ebp - 0x50a]
push eax
movzx eax, word [ebp - 0x50c]
push eax
movzx eax, word [ebp - 0x50e]
push eax
movzx eax, word [ebp - 0x512]
push eax
movzx eax, word [ebp - 0x514]
push eax
push 0x401828
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004016cf
add esp, 0x28
test eax, eax
jl 0x4017d5
push dword [0x484008]
lea eax, [ebp - 0x104]
push eax
call sub.msvcrt.dll_fputws
pop ecx
pop ecx
push dword [0x484008]
lea eax, [ebp - 0x504]
push eax
call sub.msvcrt.dll_fputws
push dword [0x484008]
push edi
call sub.msvcrt.dll_fputws
push dword [0x484008]
call sub.msvcrt.dll_fflush
add esp, 0x14
test dword [0x484004], 0x4000000
je 0x40181f
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x504]
push eax
call esi
push edi
call esi
pop edi
pop esi
jmp 0x4015ca

Function at 0x40650a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x8c]
push 0x4065e8
push 8
call fcn.004015a0
xor ebx, ebx
add esp, 0xc
xor edi, edi
cmp dword [esi + 0xb8], ebx
jne 0x426d2a
cmp byte [esi + 0x1f8], bl
jne 0x409fb6
cmp dword [esi + 0x1f4], ebx
jne 0x409fb6
push dword [esi + 0x8c]
push 0x406570
push 8
call fcn.004015a0
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
pop ebx
leave
ret
push ebx
push ebx
push esi
push 0x40a61f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x426d3a
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x409fff
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x409fff
mov edi, dword [ebp - 8]
cmp edi, ebx
jl 0x426d68
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x40656b
add esp, 0x10
cmp edi, ebx
jge 0x409fd1
jmp 0x40a008
push dword [esi + 0x8c]
push 0x426e58
jmp 0x40655e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x426d4e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push dword [esi + 0x8c]
push 0x426de0
push 1
call fcn.004015a0
jmp 0x40a00f
push edi
push dword [esi + 0x8c]
push 0x426d88
push 1
call fcn.004015a0
add esp, 0x10
jmp 0x409fff
Function at 0x409bdb
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x2c], ebx
jne 0x409d05
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x30], eax
cmp eax, ebx
je 0x439e78
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x34], eax
cmp eax, ebx
je 0x439e90
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x38], eax
cmp eax, ebx
je 0x439e97
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x3c], eax
cmp eax, ebx
je 0x439e9e
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x40], eax
cmp eax, ebx
je 0x439ea5
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x44], eax
cmp eax, ebx
je 0x439eac
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x48], eax
cmp eax, ebx
je 0x439eb3
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x4c], eax
cmp eax, ebx
je 0x439eba
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x50], eax
cmp eax, ebx
je 0x439ec1
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x40b1bb
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x2c], eax
cmp eax, ebx
je 0x439ec8
push 0x409ee8
push 8
call fcn.004015a0
pop ecx
pop ecx
push ebx
push 0xffffffffffffffff
push 1
lea esi, [edi + 0x30]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x439ecf
push 0x409e40
push 8
call fcn.004015a0
pop ecx
pop ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x409db0
push 8
call fcn.004015a0
pop ecx
pop ecx
push dword [edi + 0x20]
push 0x409d20
push 8
call fcn.004015a0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
push 0x43a588
push 1
call fcn.004015a0
pop ecx
pop ecx
mov eax, 0x8007000e
jmp 0x409d19
push 0x43a4e0
jmp 0x439e7d
push 0x43a428
jmp 0x439e7d
push 0x43a368
jmp 0x439e7d
push 0x43a2b0
jmp 0x439e7d
push 0x43a218
jmp 0x439e7d
push 0x43a170
jmp 0x439e7d
push 0x43a0d8
jmp 0x439e7d
push 0x43a038
jmp 0x439e7d
push 0x439f98
jmp 0x439e7d
push 0x439ee0
mov ebx, 0x8000ffff
push 1
jmp 0x409ce8
Function at 0x40e547
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
push edi
mov edi, dword [eax + 0xe0]
imul edi, edi, 0x27
inc edi
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402dad
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41f850
mov eax, dword [esi + 0x94]
and dword [ebp - 8], 0
cmp dword [eax + 0xe0], 0
jbe 0x40e5cf
mov dword [ebp - 4], ebx
push dword [ebp - 8]
add eax, 0xc0
mov ecx, eax
call fcn.004028b8
push 0x27
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ole32.dll_StringFromGUID2]
inc dword [ebp - 8]
mov eax, dword [esi + 0x94]
mov ecx, dword [ebp - 8]
add dword [ebp - 4], 0x4e
cmp ecx, dword [eax + 0xe0]
jb 0x40e59b
add edi, edi
push edi
push ebx
xor eax, eax
push 7
push eax
mov word [edi + ebx - 2], ax
mov eax, dword [esi + 0x94]
push 0x40e72c
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call fcn.00402d9c
mov eax, dword [esi + 0x94]
xor ebx, ebx
xor edi, edi
pop ecx
cmp dword [eax + 0x104], ebx
jbe 0x40e632
add eax, 0xe4
push ebx
mov ecx, eax
call fcn.004028b8
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea edi, [edi + eax + 1]
mov eax, dword [esi + 0x94]
inc ebx
cmp ebx, dword [eax + 0x104]
jb 0x40e60a
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402dad
xor ebx, ebx
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x41f850
lea eax, [edi + edi]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x94]
and dword [ebp - 4], ebx
add esp, 0xc
cmp dword [eax + 0x104], ebx
jbe 0x40e6f1
push dword [ebp - 4]
add eax, 0xe4
mov ecx, eax
call fcn.004028b8
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0xc], eax
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, edi
ja 0x40e6dd
mov ecx, dword [esi + 0x94]
push dword [ebp - 4]
add ecx, 0xe4
call fcn.004028b8
mov eax, dword [eax]
push dword [ebp - 0xc]
push eax
mov eax, edi
sub eax, ebx
push eax
mov eax, dword [ebp - 8]
lea eax, [eax + ebx*2]
push eax
call fcn.0040e4fe
test eax, eax
jl 0x41f870
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
xor eax, eax
mov word [ecx + ebx*2], ax
inc ebx
inc dword [ebp - 4]
mov eax, dword [esi + 0x94]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x104]
jb 0x40e67a
push dword [ebp - 0x14]
mov eax, dword [esi + 0x94]
push dword [ebp - 8]
mov eax, dword [eax + 0x20]
push 7
push 0
mov edi, 0x40cca0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov ebx, eax
call fcn.00402d9c
pop ecx
test ebx, ebx
jne 0x41f88b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0x8c]
push 0x41f9d0
push 1
call fcn.004015a0
add esp, 0x10
mov eax, 0x8007000e
jmp 0x40e726
push eax
push dword [esi + 0x8c]
push 0x41f950
push 1
call fcn.004015a0
add esp, 0x10
jmp 0x40e6f1
jle 0x41f899
and ebx, 0xffff
or ebx, 0x80070000
push ebx
push edi
push dword [esi + 0x8c]
push 0x41f8b8
push 1
call fcn.004015a0
add esp, 0x14
mov eax, ebx
jmp 0x40e726
Function at 0x40ea4f
Capabilities:
Check if file exists
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push dword [esi + 0x8c]
push 0x40ec54
push 8
call fcn.004015a0
xor edi, edi
add esp, 0xc
cmp dword [esi + 0xa0], edi
je 0x426527
mov eax, dword [esi + 0x94]
cmp dword [eax + 0x1c], edi
je 0x426546
push dword [eax + 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426565
push ebx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, eax
cmp ebx, edi
jl 0x4265ba
push 0x28
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov eax, dword [esi + 0x94]
mov eax, dword [eax + 0x1c]
push edi
lea ecx, [ebp - 0x54]
push ecx
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040dcb0
mov ebx, eax
test ebx, ebx
jl 0x4265d5
push 0x40d7c0
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040e3a9
mov edi, eax
test edi, edi
jl 0x4265e3
lea eax, [ebp - 0x25c]
lea edi, [esi + 0x98]
push eax
mov ecx, edi
call fcn.0040585c
push dword [edi]
push dword [esi + 0x8c]
push 0x40ec10
push 4
call fcn.004015a0
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax]
add esp, 0x10
push eax
call dword [ecx + 0x58]
mov ecx, dword [edi]
mov eax, dword [esi + 0xa0]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x4c]
mov ebx, eax
test ebx, ebx
jl 0x426600
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov ebx, eax
test ebx, ebx
jl 0x42660e
push dword [edi]
mov ecx, esi
call fcn.0040e945
push dword [esi + 0x8c]
push 0x40ebb8
push 8
call fcn.004015a0
add esp, 0xc
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401580
leave
ret
push dword [esi + 0x8c]
push 0x4269a8
push 1
call fcn.004015a0
add esp, 0xc
mov eax, 0x80040275
jmp 0x40eba4
push dword [esi + 0x8c]
push 0x426950
push 1
call fcn.004015a0
add esp, 0xc
mov eax, 0x8007064a
jmp 0x40eba4
mov eax, dword [esi + 0x94]
mov eax, dword [eax + 0x1c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40eaab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x426592
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [esi + 0x94]
push edi
push dword [eax + 0x1c]
push dword [esi + 0x8c]
push 0x4268b0
push 1
call fcn.004015a0
add esp, 0x14
mov eax, edi
jmp 0x40eba4
push ebx
push dword [esi + 0x8c]
push 0x426828
push 1
call fcn.004015a0
add esp, 0x10
jmp 0x40eba1
push ebx
push dword [esi + 0x8c]
push 0x4267a8
jmp 0x4265c6
push edi
push dword [esi + 0x8c]
push 0x426718
push 1
call fcn.004015a0
add esp, 0x10
mov eax, edi
jmp 0x40eba3
push ebx
push dword [esi + 0x8c]
push 0x426698
jmp 0x4265c6
push ebx
push dword [esi + 0x8c]
push 0x426620
jmp 0x4265c6
Function at 0x41061f
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x47d7d0
call fcn.0040af09
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x41a22e
cmp dword [ebp + 8], esi
je 0x41a238
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41a269
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.00402dad
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x4106e4
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [edi], eax
cmp eax, esi
je 0x4106dd
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x41a252
xor ebx, ebx
push dword [ebp - 0x14]
call fcn.00402d9c
pop ecx
mov eax, ebx
call fcn.00402881
ret 8
mov ebx, 0x8007000e
jmp 0x4106ca
mov ebx, 0x8007000e
jmp 0x4106d3
mov eax, 0x80004003
jmp 0x4106d5
mov eax, 0x80070057
jmp 0x4106d5
call fcn.0043c390
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x4106ca
push eax
call fcn.0043c3aa
mov ebx, eax
jmp 0x4106d3
Function at 0x4106f0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
inc ebx
xor edi, edi
cmp dword [esi + 0xa8], 0xffffffff
jne 0x4107b8
push edi
push edi
push 0x2001f
push edi
push edi
push 0x410868
push 0x80000002
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [esi + 0xa8], edi
call fcn.0040538f
cmp eax, edi
jne 0x42cfa1
lea eax, [ebp - 4]
push eax
push 0x414984
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00403110
cmp eax, edi
jne 0x42cf0b
cmp dword [ebp - 4], edi
je 0x41076c
cmp dword [ebp - 4], 4
jb 0x42cf00
cmp dword [esi + 0xa8], ebx
je 0x4107b0
lea eax, [ebp - 0xc]
push eax
mov edi, 0x414964
push edi
lea ecx, [ebp - 0x18]
call fcn.00414615
test eax, eax
jne 0x42cf6e
mov ecx, dword [esi + 0xb4]
mov eax, dword [esi + 0xb0]
cmp dword [ebp - 8], ecx
ja 0x4107ae
jb 0x42cf1f
cmp dword [ebp - 0xc], eax
jb 0x42cf1f
xor edi, edi
lea ecx, [ebp - 0x18]
call fcn.004030f0
cmp dword [esi + 0xa8], ebx
je 0x42cf41
xor eax, eax
cmp dword [esi + 0xa8], ebx
sete al
mov esi, eax
mov eax, 0x41085c
cmp esi, edi
jne 0x4107df
mov eax, 0x410850
push eax
push 0x4107f8
push 4
call fcn.004015a0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov dword [esi + 0xa8], ebx
jmp 0x41076c
push eax
push 0x42d1e8
push ebx
call fcn.004015a0
add esp, 0xc
jmp 0x41076c
push dword [ebp - 8]
mov dword [esi + 0xa8], ebx
push dword [ebp - 0xc]
push ecx
push eax
push 0x42d0c8
push 8
call fcn.004015a0
add esp, 0x18
jmp 0x4107ae
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [esi + 0xb8]
sbb edx, dword [esi + 0xbc]
mov dword [ebp - 8], edx
jne 0x42cf63
cmp eax, 0x927c0
jbe 0x4107c4
mov dword [esi + 0xa8], edi
jmp 0x4107c4
cmp eax, 0xd
je 0x42cf7e
cmp eax, 0xea
jne 0x4107ae
push 0x42d048
push 8
mov dword [esi + 0xa8], ebx
call fcn.004015a0
pop ecx
pop ecx
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4107ae
push eax
push 0x42cfb8
push ebx
call fcn.004015a0
add esp, 0xc
jmp 0x4107b0