joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8f77300
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 9
pop ecx
xor eax, eax
push 2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 4]
pop ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x104d
push dword [ebp + 8]
mov dword [ebp - 0x28], 0xd
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x8f7737d
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f77376
test byte [eax + 0x1c], 8
je 0x8f77376
cmp byte [eax + 0x19], bl
jb 0x8f77376
push 0x8f715cc
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
xor eax, eax
jmp 0x8f77455
push dword [ebp + 8]
mov edi, dword [esi + 8]
call fcn.08f839fa
test eax, eax
je 0x8f7742a
mov eax, dword [esi + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x8f77396
sub eax, edx
sar eax, 1
lea ebx, [eax + 2]
lea eax, [ebx + ebx]
push eax
call fcn.08f83725
mov edi, eax
test edi, edi
jne 0x8f773d7
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f77376
test byte [eax + 0x1c], 8
je 0x8f77376
cmp byte [eax + 0x19], 2
jb 0x8f77376
push 0x8f715cc
push 0x2a
jmp 0x8f7736b
push dword [esi + 8]
push 0x202d
push 0x8f7160c
push ebx
push edi
call fcn.08f7fa82
add esp, 0x14
test eax, eax
jge 0x8f7742a
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7741f
test byte [ecx + 0x1c], 8
je 0x8f7741f
cmp byte [ecx + 0x19], 2
jb 0x8f7741f
push eax
push 0x8f715cc
push 0x2b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
push edi
call fcn.08f837bd
jmp 0x8f77376
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0xc]
xor ebx, ebx
push 0x1074
push dword [ebp + 8]
inc ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp edi, dword [esi + 8]
je 0x8f77453
push edi
call fcn.08f837bd
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x8f7ebfb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
mov dword [ebx + 0x24], edi
call fcn.08f8652d
test eax, eax
je 0x8f7edf4
push esi
cmp dword [0x8f8ef2c], edi
jne 0x8f7ed8c
push 0x8f71d70
call fcn.08f79ccc
mov dword [0x8f8ef2c], eax
cmp eax, edi
je 0x8f7ed8c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x8f71d64
push eax
call esi
push 0x8f71d58
push dword [0x8f8ef2c]
mov dword [0x8f8ef34], eax
call esi
push 0x8f71d4c
push dword [0x8f8ef2c]
mov dword [0x8f8ef38], eax
call esi
push 0x8f71d3c
push dword [0x8f8ef2c]
mov dword [0x8f8ef3c], eax
call esi
push 0x8f71d2c
push dword [0x8f8ef2c]
mov dword [0x8f8ef40], eax
call esi
push 0x8f71d18
push dword [0x8f8ef2c]
mov dword [0x8f8ef44], eax
call esi
push 0x8f71d04
push dword [0x8f8ef2c]
mov dword [0x8f8ef48], eax
call esi
push 0x8f71cf0
push dword [0x8f8ef2c]
mov dword [0x8f8ef4c], eax
call esi
push 0x8f71cdc
push dword [0x8f8ef2c]
mov dword [0x8f8ef50], eax
call esi
push 0x8f71cc8
push dword [0x8f8ef2c]
mov dword [0x8f8ef54], eax
call esi
push 0x8f71cb8
push dword [0x8f8ef2c]
mov dword [0x8f8ef58], eax
call esi
mov dword [0x8f8ef5c], eax
cmp dword [0x8f8ef34], edi
je 0x8f7ed74
cmp dword [0x8f8ef38], edi
je 0x8f7ed74
cmp dword [0x8f8ef3c], edi
je 0x8f7ed74
cmp dword [0x8f8ef40], edi
je 0x8f7ed74
cmp dword [0x8f8ef44], edi
je 0x8f7ed74
cmp dword [0x8f8ef48], edi
je 0x8f7ed74
cmp dword [0x8f8ef4c], edi
je 0x8f7ed74
cmp dword [0x8f8ef50], edi
je 0x8f7ed74
cmp dword [0x8f8ef54], edi
je 0x8f7ed74
cmp dword [0x8f8ef58], edi
je 0x8f7ed74
cmp eax, edi
je 0x8f7ed74
push dword [ebp + 8]
mov ecx, ebx
call fcn.08f7eb28
test eax, eax
je 0x8f7ed74
mov dword [ebp - 4], 1
jmp 0x8f7ed8c
push dword [0x8f8ef2c]
mov dword [0x8f8ef30], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x8f8ef2c], edi
push 0x20019
push edi
push 0x8f71c60
push 0x80000002
call fcn.08f861d4
mov esi, eax
cmp esi, edi
je 0x8f7edf0
mov eax, 0x8f71600
push eax
push eax
push esi
call fcn.08f86915
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x8f7edf0
push 0x2e
push ebx
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, edi
je 0x8f7edea
add eax, 2
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
cmp eax, 0xa
jb 0x8f7edea
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 1
push ebx
call fcn.08f837bd
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x8f7f096
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x8f89b23
call fcn.08f82508
mov eax, dword [ebp + 8]
mov esi, ecx
push eax
mov dword [ebp - 0x22c], esi
call fcn.08f81ac7
xor ebx, ebx
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
push 0x8f71dcc
lea edi, [esi + 0x2c]
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [esi], 0x8f71d9c
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [edi], ebx
mov dword [esi + 0x30], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x228], 0x208
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x224], eax
cmp eax, ebx
jne 0x8f7f13f
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x244]
push eax
push ebx
push 0x8f71600
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov dword [ebp - 0x224], eax
xor eax, eax
mov word [ebp - 0x14], ax
cmp dword [ebp - 0x220], ebx
je 0x8f7f153
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x224], ebx
je 0x8f7f1b3
push 0x8f71db8
push 0x105
lea eax, [ebp - 0x21c]
push eax
call fcn.08f7f027
cmp eax, ebx
jge 0x8f7f1b3
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7f2cb
test byte [ecx + 0x1c], 8
je 0x8f7f2cb
cmp byte [ecx + 0x19], 2
jb 0x8f7f2cb
push eax
push 0x8f71d8c
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
jmp 0x8f7f2cb
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
lea eax, [ebp - 0x21c]
jne 0x8f7f1cf
mov eax, 0x8f71db8
push eax
call fcn.08f79ccc
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x8f7f223
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f7f2cb
test byte [eax + 0x1c], 8
je 0x8f7f2cb
cmp byte [eax + 0x19], 2
jb 0x8f7f2cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x8f8c004]
push 0x8f71d8c
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d3f
jmp 0x8f7f2cb
push 0x8f71db0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x28], eax
cmp eax, ebx
je 0x8f7f2cb
push ebx
push ebx
push edi
lea ecx, [esi + 4]
push ecx
call eax
test eax, eax
jl 0x8f7f24e
mov dword [esi + 0x30], 1
xor eax, eax
lea edi, [ebp - 0x23c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x240], 0x14
call fcn.08f87399
cmp eax, ebx
je 0x8f7f2aa
mov ecx, dword [0x8f8c004]
cmp ecx, 0x8f8c004
je 0x8f7f2cb
test byte [ecx + 0x1c], 8
je 0x8f7f2cb
cmp byte [ecx + 0x19], 2
jb 0x8f7f2cb
push eax
push 0x8f71d8c
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
jmp 0x8f7f2cb
movzx eax, word [ebp - 0x238]
movzx ecx, word [ebp - 0x236]
shl eax, 0x10
or eax, ecx
cmp eax, 0x50000
jbe 0x8f7f2cb
mov dword [esi + 0x20], 1
mov eax, esi
call fcn.08f8259a
ret 4
Function at 0x8f8414e
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x120], esi
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f8419c
test byte [eax + 0x1c], 2
je 0x8f8419c
cmp byte [eax + 0x19], 5
jb 0x8f8419c
push 0x8f72040
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
push dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
push edi
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push ebx
push dword [ebp + 8]
call esi
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x8f841c3
xor eax, eax
jmp 0x8f8426c
cmp dword [ebp + 0x18], 0
jne 0x8f841d0
add eax, eax
jmp 0x8f8426c
test bl, 0x30
jne 0x8f8426c
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x8f8422c
mov eax, dword [0x8f8c004]
cmp eax, 0x8f8c004
je 0x8f841bc
test byte [eax + 0x1c], 2
je 0x8f841bc
cmp byte [eax + 0x19], 2
jb 0x8f841bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x8f8c004]
push 0x8f72040
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d3f
jmp 0x8f841bc
cmp dword [ebp - 0x108], 2
jne 0x8f84266
cmp dword [ebp - 0x114], 5
jb 0x8f84266
push edi
push dword [ebp + 8]
call fcn.08f83b68
test eax, eax
je 0x8f84266
push dword [ebp + 0x18]
or ebx, 0x20
push edi
push 0
push dword [ebp - 0x120]
push ebx
push dword [ebp + 8]
call esi
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret 0x14
Function at 0x8f84451
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x28], 0x10
mov eax, dword [0x8f8c004]
mov edi, 0x8f8c004
cmp eax, edi
je 0x8f8449b
test byte [eax + 0x1c], 2
je 0x8f8449b
cmp byte [eax + 0x19], 5
jb 0x8f8449b
push 0x8f72040
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
test esi, esi
jne 0x8f844a7
xor eax, eax
inc eax
jmp 0x8f8454d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x8f844ac
sub eax, edx
sar eax, 1
je 0x8f8449f
mov ecx, esi
mov eax, 0x8f72108
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x8f844e9
test dx, dx
je 0x8f844e5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x8f844e9
add eax, 4
add ecx, 4
test dx, dx
jne 0x8f844c3
xor eax, eax
jmp 0x8f844ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x8f8449f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x8f8453b
mov eax, dword [0x8f8c004]
cmp eax, edi
je 0x8f84537
test byte [eax + 0x1c], 2
je 0x8f84537
cmp byte [eax + 0x19], 2
jb 0x8f84537
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x8f8c004]
push 0x8f72040
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d3f
xor eax, eax
jmp 0x8f8454d
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.08f82466
leave
ret 4
Function at 0x8f84747
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov eax, dword [0x8f8c004]
mov edi, 0x8f8c004
cmp eax, edi
je 0x8f8477a
test byte [eax + 0x1c], 2
je 0x8f8477a
cmp byte [eax + 0x19], 5
jb 0x8f8477a
push 0x8f72040
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
push 0x25
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x8f847c9
push dword [ebp + 8]
call fcn.08f84630
test eax, eax
jne 0x8f848a9
mov eax, dword [0x8f8c004]
cmp eax, edi
je 0x8f847c2
test byte [eax + 0x1c], 2
je 0x8f847c2
cmp byte [eax + 0x19], 2
jb 0x8f847c2
push 0x8f72040
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
xor eax, eax
jmp 0x8f848a9
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x8f84820
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x8f8c004]
cmp ecx, edi
je 0x8f848a5
test byte [ecx + 0x1c], 2
je 0x8f848a5
cmp byte [ecx + 0x19], 2
jb 0x8f848a5
push eax
push 0x8f72040
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
jmp 0x8f848a5
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.08f83725
mov dword [ebp - 4], eax
test eax, eax
jne 0x8f8485a
mov eax, dword [0x8f8c004]
cmp eax, edi
je 0x8f848a5
test byte [eax + 0x1c], 2
je 0x8f848a5
cmp byte [eax + 0x19], 2
jb 0x8f848a5
push 0x8f72040
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
jmp 0x8f848a5
push ebx
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x8f8486e
cmp eax, ebx
ja 0x8f8486e
mov eax, dword [ebp - 4]
jmp 0x8f848a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x8f8c004]
cmp ecx, edi
je 0x8f8489d
test byte [ecx + 0x1c], 2
je 0x8f8489d
cmp byte [ecx + 0x19], 2
jb 0x8f8489d
push eax
push 0x8f72040
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.08f72d3f
push dword [ebp - 4]
call fcn.08f837bd
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x8f848b3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 0x218], ecx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
lea eax, [edi - 1]
cmp eax, 0x103
ja 0x8f84970
dec edi
push edi
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x8f84970
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
push dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
sub dword [ebp - 0x210], edi
call esi
add eax, dword [ebp - 0x210]
pop esi
cmp eax, dword [ebp + 0x14]
jge 0x8f84970
lea eax, [ebx + edi*2]
push eax
push dword [ebp - 0x214]
push 0x8f71878
push dword [ebp + 0x14]
push dword [ebp - 0x218]
call fcn.08f7fa82
xor ecx, ecx
add esp, 0x14
test eax, eax
setge cl
mov eax, ecx
jmp 0x8f84972
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret 0x10
Function at 0x8f84d27
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x120], 0
push ebx
push esi
push edi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x8f8c004]
mov esi, 0x8f8c004
push 2
mov edi, 0x8f72198
pop ebx
cmp eax, esi
je 0x8f84d8b
test byte [eax + 0x1c], bl
je 0x8f84d8b
cmp byte [eax + 0x19], 5
jb 0x8f84d8b
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x8f84dda
mov eax, dword [0x8f8c004]
cmp eax, esi
je 0x8f84dd3
test byte [eax + 0x1c], bl
je 0x8f84dd3
cmp byte [eax + 0x19], bl
jb 0x8f84dd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x8f8c004]
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d3f
xor eax, eax
jmp 0x8f84e87
cmp dword [ebp - 0x110], ebx
je 0x8f84e06
mov eax, dword [0x8f8c004]
cmp eax, esi
je 0x8f84dd3
test byte [eax + 0x1c], bl
je 0x8f84dd3
cmp byte [eax + 0x19], 3
jb 0x8f84dd3
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
jmp 0x8f84dd3
cmp dword [ebp - 0x11c], 5
jae 0x8f84e28
mov eax, dword [0x8f8c004]
cmp eax, esi
je 0x8f84dd3
test byte [eax + 0x1c], bl
je 0x8f84dd3
cmp byte [eax + 0x19], 3
jb 0x8f84dd3
push edi
push 0xe
jmp 0x8f84df9
mov eax, dword [ebp - 8]
test al, 0x40
je 0x8f84e41
xor eax, eax
cmp byte [ebp - 6], 1
setne al
dec eax
and eax, 0xffffffe0
add eax, 0x40
jmp 0x8f84e87
test eax, 0x200
je 0x8f84e4d
xor eax, eax
inc eax
jmp 0x8f84e87
test bl, al
je 0x8f84e55
push 8
jmp 0x8f84e86
test al, al
jns 0x8f84e5d
push 0x10
jmp 0x8f84e86
test eax, 0x400
je 0x8f84e6b
mov eax, 0x80
jmp 0x8f84e87
cmp byte [ebp - 6], 1
jne 0x8f84e75
mov eax, ebx
jmp 0x8f84e87
cmp byte [ebp - 6], 3
je 0x8f84e84
cmp byte [ebp - 6], bl
jne 0x8f84dd3
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret
Function at 0x8f85242
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x3c], bl
lea edi, [ebp - 0x3b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
xor eax, eax
push 0x80
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 3
stosd dword es:[edi], eax
push ebx
push 1
stosd dword es:[edi], eax
push 0x80000000
push ecx
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0x17], 0x41
mov byte [ebp - 0x16], 0x58
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x4f
mov byte [ebp - 0x13], 0x56
mov byte [ebp - 0x12], 0x45
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x2d
mov byte [ebp - 0xf], 0x56
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x52
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 9], 0x77
mov byte [ebp - 8], 0x87
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
stosd dword es:[edi], eax
call fcn.08f86b71
mov esi, eax
mov dword [ebp - 0x40], esi
cmp esi, 0xffffffff
jne 0x8f852f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8f72428
call fcn.08f876b8
pop ecx
pop ecx
jmp 0x8f8534e
push ebx
lea eax, [ebp - 0x44]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x8f85322
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8f723fc
call fcn.08f876b8
pop ecx
pop ecx
push esi
jmp 0x8f85348
cmp dword [ebp - 0x44], 0x24
jne 0x8f85345
push 5
pop ecx
lea edi, [ebp - 0x3c]
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x8f85345
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x8f85350
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret 4

Function at 0x8f85366
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x8f85389
xor eax, eax
jmp 0x8f853e4
push 0x40
call fcn.08f85125
test eax, eax
je 0x8f85385
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x8f724c4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x8f853cc
cmp eax, esi
ja 0x8f853cc
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 8
push eax
push edi
call dword [sym.imp.USER32.dll_WinHelpW]
xor eax, eax
jmp 0x8f853e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x8f72478
call fcn.08f876b8
pop ecx
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.08f82466
leave
ret 8
Function at 0x8f853f8
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x8f8c004]
mov esi, 0x8f8c004
mov ebx, 0x8f723ec
cmp eax, esi
je 0x8f85465
test byte [eax + 0x1c], 2
je 0x8f85465
cmp byte [eax + 0x19], 5
jb 0x8f85465
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d19
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x214], eax
test eax, eax
jge 0x8f854b6
mov eax, dword [0x8f8c004]
cmp eax, esi
je 0x8f854ad
test byte [eax + 0x1c], 2
je 0x8f854ad
cmp byte [eax + 0x19], 2
jb 0x8f854ad
push dword [ebp - 0x214]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d3f
movzx eax, word [ebp - 0x214]
jmp 0x8f854f6
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.08f7f027
mov edi, eax
test edi, edi
jge 0x8f854ff
mov eax, dword [0x8f8c004]
cmp eax, esi
je 0x8f854f3
test byte [eax + 0x1c], 2
je 0x8f854f3
cmp byte [eax + 0x19], 2
jb 0x8f854f3
movzx ecx, di
push ecx
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.08f72d3f
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x8f85509
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret 0xc
Function at 0x8f85525
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x8f8c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor ebx, ebx
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
xor eax, eax
mov dword [ebp - 0x630], 0x20a
cmp edi, ebx
je 0x8f85731
push 1
push 1
push 0x8f72388
push 0x80000001
mov word [edi], ax
call fcn.08f861d4
mov esi, eax
cmp esi, ebx
je 0x8f8572f
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x8f72458
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x8f71628
test ebx, ebx
je 0x8f85610
cmp ebx, 2
jne 0x8f8572f
mov dword [ebp - 0x628], 0x8f72594
jmp 0x8f8566f
cmp dword [ebp - 0x62c], 1
je 0x8f85626
cmp dword [ebp - 0x62c], 2
jne 0x8f8572f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x628], ecx
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x8f8566f
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x8f8566f
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.08f845d6
test eax, eax
jl 0x8f85725
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 5
call fcn.08f853f8
test eax, eax
jne 0x8f8569e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8f72558
call fcn.08f876b8
pop ecx
pop ecx
jmp 0x8f8572f
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.08f7f027
xor ebx, ebx
cmp eax, ebx
jl 0x8f85725
mov eax, dword [ebp - 0x628]
cmp word [eax], 0x5c
je 0x8f856ce
push esi
push dword [ebp + 0xc]
push edi
call fcn.08f845d6
cmp eax, ebx
jl 0x8f85725
push dword [ebp - 0x628]
push dword [ebp + 0xc]
push edi
call fcn.08f845d6
cmp eax, ebx
jl 0x8f85725
lea eax, [ebp - 0x624]
push eax
push 0x8f72524
push ebx
push ebx
push 0x8005
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, ebx
jl 0x8f85725
push 0x93d
push 0x8f724e0
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebx
jl 0x8f85725
push edi
call fcn.08f84a6f
xor eax, eax
inc eax
jmp 0x8f85731
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.08f82466
leave
ret 8