joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x41ace0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x9c], eax
push edi
mov edi, ecx
cmp esi, 0xd
jae 0x4023f0
or eax, 0xffffffff
jmp 0x40257d
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x4023a4
push eax
xor ebx, ebx
mov dword [ebp - 0x90], 0x4023b2
push ecx
mov edx, edi
mov dword [ebp - 0x68], ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], ebx
call fcn.0040511e
xor eax, eax
mov dword [ebp - 0x58], ebx
inc eax
mov dword [ebp - 0x34], ebx
add edi, 5
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
sub esi, 0xd
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x50], ebx
mov eax, dword [edi]
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x80], esi
call fcn.00410ea9
add esp, 0xc
mov dword [ebp - 0x84], ebx
mov edi, eax
lea eax, [ebp - 0x84]
mov edx, edi
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x7c]
add eax, 8
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00404fbf
add esp, 0x14
mov esi, eax
lea eax, [ebp - 0x94]
push dword [ebp - 0x6c]
push eax
call dword [ebp - 0x90]
push dword [ebp - 0x68]
lea eax, [ebp - 0x94]
mov dword [ebp - 0x6c], ebx
push eax
call dword [ebp - 0x90]
add esp, 0x10
mov dword [ebp - 0x68], ebx
test esi, esi
je 0x4024bf
or ebx, 0xffffffff
jmp 0x402574
mov edx, dword [edi]
lea ecx, [edi + 4]
mov eax, dword [ecx]
push 4
pop esi
add ecx, esi
mov dword [ebp - 0x98], eax
push edx
mov dword [ebp - 0x80], edx
mov eax, dword [ecx]
add ecx, esi
mov dword [ebp - 0x88], eax
mov eax, dword [ecx]
add ecx, esi
mov dword [ebp - 0x8c], eax
mov ebx, dword [ecx]
add ecx, esi
mov dword [ebp - 0x84], ecx
call fcn.00410ea9
mov edx, dword [ebp - 0x88]
mov esi, eax
pop ecx
push dword [ebp - 0x80]
mov ecx, dword [ebp - 0x8c]
push esi
push ebx
mov ebx, dword [ebp - 0x98]
lea eax, [ecx + edx]
add eax, ebx
add eax, dword [ebp - 0x84]
push eax
push ecx
mov ecx, dword [ebp - 0x84]
lea eax, [edx + ebx]
add eax, ecx
push eax
push edx
lea eax, [ebx + ecx]
mov edx, ebx
push eax
call fcn.00405192
add esp, 0x20
xor ebx, ebx
test eax, eax
je 0x402543
inc ebx
jmp 0x40256d
push ebx
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x80]
push esi
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40256a
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xa0], eax
je 0x40256d
or ebx, 0xffffffff
push esi
call fcn.00410f5e
pop ecx
push edi
call fcn.00410f5e
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004089e0
mov esp, ebp
pop ebp
ret
Function at 0x40343a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov ecx, dword [ecx]
push ebx
push esi
push edi
sub ecx, 0x10
mov dword [ebp - 8], edx
call fcn.00402e9e
push 0x44
xor ebx, ebx
push ebx
lea esi, [eax + 0x10]
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], esi
push eax
call fcn.004094e0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
or dword [ebp - 0x30], 0x81
xor eax, eax
inc eax
mov word [ebp - 0x2c], ax
cmp dword [esi - 4], eax
jle 0x40349b
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.00403003
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4034c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4034fc
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4034e9
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne bl
jmp 0x4034ec
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
call edi
lea ecx, [esi - 0x10]
call fcn.00401260
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403532
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.004035cf
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4035c5
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x4035be
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x4035b5
push 6
pop ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4035b5
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x4035c7
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004035cf
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403764
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
cmp esi, 0x40
jae 0x403774
xor eax, eax
jmp 0x4037c9
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403770
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x403770
cmp dword [edx + ecx], 0x4550
jne 0x403770
movzx eax, word [edx + ecx + 4]
push edi
mov edi, 0x14c
cmp ax, di
je 0x4037b1
mov edi, 0x8664
cmp ax, di
je 0x4037c6
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x4037c6
add ecx, 0xc
cmp esi, ecx
jae 0x4037c8
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4037ce
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40228
call fcn.0040c820
mov eax, dword [0x41ace0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40220]
push edi
xor ebx, ebx
mov dword [ebp - 0x40210], 1
push ebx
push eax
mov edi, ecx
lea eax, [ebp - 0x4020c]
push 0x200
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4039e3
cmp dword [ebp - 0x40220], 0x200
jne 0x4039e3
push 4
lea eax, [ebp - 0x4010b]
push 0x418924
push eax
call fcn.0040b05c
add esp, 0xc
test eax, eax
jne 0x40384f
inc eax
mov byte [esi], al
jmp 0x4039e5
push 5
lea eax, [ebp - 0x4010b]
push str.ustar
push eax
call fcn.0040b05c
add esp, 0xc
test eax, eax
jne 0x4039e3
mov ecx, dword [edi + 4]
sub ecx, 0x10
call fcn.00402e9e
add eax, 0x10
lea ecx, [ebp - 0x40214]
push 0x418978
mov dword [ebp - 0x40214], eax
call fcn.004039f8
lea eax, [ebp - 0x4020c]
push eax
lea ecx, [ebp - 0x40214]
call fcn.004039f8
mov esi, dword [ebp - 0x40214]
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40224], eax
cmp eax, 0xffffffff
je 0x4039d7
push 8
lea eax, [ebp - 0x40190]
push ebx
push eax
call fcn.004112f8
add esp, 0xc
mov dword [ebp - 0x40218], eax
push 1
push ebx
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x40218]
mov edx, ecx
neg edx
add eax, ecx
and edx, 0x1ff
add edx, eax
mov dword [ebp - 0x40228], edx
test ecx, ecx
je 0x403984
mov eax, 0x40000
mov dword [ebp - 0x4021c], eax
cmp ecx, eax
jae 0x403927
mov eax, ecx
mov dword [ebp - 0x4021c], ecx
push ebx
lea ecx, [ebp - 0x40220]
push ecx
push eax
lea eax, [ebp - 0x4000c]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40397e
push ebx
lea eax, [ebp - 0x40220]
push eax
push dword [ebp - 0x4021c]
lea eax, [ebp - 0x4000c]
push eax
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40397e
mov ecx, dword [ebp - 0x40218]
sub ecx, dword [ebp - 0x4021c]
mov dword [ebp - 0x40218], ecx
jne 0x403910
jmp 0x403984
mov byte [ebp - 0x40210], bl
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x40210], bl
je 0x4039bb
cmp byte [edi + 8], bl
je 0x4039ac
lea eax, [ebp - 0x40214]
push eax
lea ecx, [edi + 0xc]
call fcn.00402909
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4039bb
push esi
push dword [edi + 0x1c]
call eax
pop ecx
pop ecx
mov eax, dword [ebp - 0x40228]
cmp eax, 0xffffffff
je 0x4039d1
push ebx
push ebx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov bl, byte [ebp - 0x40210]
lea ecx, [esi - 0x10]
call fcn.00401260
mov al, bl
jmp 0x4039e5
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004089e0
mov esp, ebp
pop ebp
ret 4
Function at 0x4087fa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41ace0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004067f2
mov dword [ebp - 0x14], eax
cmp dword [0x41bc80], esi
jne 0x4088ed
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40887a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4089cd
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4089cd
push 0x4153dc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4089cd
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41bc80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41bc84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41bc88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41bc90], eax
test eax, eax
je 0x4088ea
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41bc8c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x408912
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x408905
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x408927
push 4
pop eax
jmp 0x4089cf
cmp dword [ebp - 0x14], esi
je 0x408927
push dword [0x41bc80]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40890c
mov eax, dword [0x41bc8c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x408985
cmp dword [0x41bc90], edi
je 0x408985
push eax
call ebx
push dword [0x41bc90]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x408985
test eax, eax
je 0x408985
call ecx
test eax, eax
je 0x40897a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40897a
test byte [ebp - 8], 1
jne 0x408985
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4089b5
mov eax, dword [0x41bc84]
cmp eax, edi
je 0x4089b2
push eax
call ebx
test eax, eax
je 0x4089b2
call eax
mov esi, eax
test esi, esi
je 0x4089b2
mov eax, dword [0x41bc88]
cmp eax, edi
je 0x4089b2
push eax
call ebx
test eax, eax
je 0x4089b2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41bc80]
call ebx
test eax, eax
je 0x4089cd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4089cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004089e0
mov esp, ebp
pop ebp
ret
Function at 0x2e007bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 8], eax
call fcn.2e013859
mov edi, eax
test edi, edi
jl 0x2e007c66
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.2e013859
mov edi, eax
test edi, edi
jne 0x2e007c60
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor ebx, ebx
inc ebx
mov edi, dword [ebp - 4]
movzx eax, word [edi]
push 0x2f
pop ecx
cmp cx, ax
je 0x2e007c1f
push 0x2d
pop ecx
cmp cx, ax
jne 0x2e007c83
add edi, 2
push edi
push 0x2e0018d4
call esi
test eax, eax
jne 0x2e007c33
mov eax, dword [ebp + 0x10]
jmp 0x2e007c42
push edi
push 0x2e0018b4
call esi
test eax, eax
jne 0x2e007c7b
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.2e013859
mov edi, eax
test edi, edi
je 0x2e007c09
test edi, edi
jl 0x2e007c64
xor edi, edi
pop esi
pop ebx
cmp dword [ebp - 4], 0
je 0x2e007c74
push dword [ebp - 4]
call fcn.2e0110b3
mov eax, edi
pop edi
leave
ret 0x10
push edi
push 0x2e001890
call esi
mov edi, 0x80070057
jmp 0x2e007c64
Function at 0x2e00c50b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 8], esi
cmp dword [edi + 0x44], esi
je 0x2e00c528
xor ebx, ebx
inc ebx
jmp 0x2e00c70e
cmp dword [ebp + 8], esi
jne 0x2e00c576
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x40]
mov ebx, eax
cmp ebx, esi
jl 0x2e00c70e
lea eax, [ebp + 8]
push eax
push 2
push esi
push dword [edi + 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jle 0x2e00c565
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x2e00c70e
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x48]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x2e001ec0
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c5a3
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
mov eax, dword [edi + 0x50]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x2e001eac
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c5d5
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
lea eax, [edi + 0x74]
push eax
push 4
push 0
push 0x2e001e8c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c601
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
lea eax, [edi + 0x70]
push eax
push 4
push 0
push 0x2e001e6c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c62d
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
lea eax, [edi + 0x6c]
push eax
push 4
push 0
push 0x2e001f38
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c659
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
lea eax, [edi + 0x5c]
push eax
push 4
push 0
push 0x2e001f20
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c685
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
lea eax, [edi + 0x60]
push eax
push 4
push 0
push 0x2e001f04
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c6ad
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
lea eax, [edi + 0x64]
push eax
push 4
push 0
push 0x2e001eec
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c6d5
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c6ff
push 4
add edi, 0x68
push edi
push 4
push 0
push 0x2e001ecc
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c6fd
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x2e00c70e
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x2e00f473
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1170
call fcn.2e0142c9
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x116c], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov esi, 0x1154
push esi
mov dword [ebp - 0x1170], eax
lea eax, [ebp - 0x1158]
push ebx
push eax
mov dword [ebp - 0x1164], ebx
mov dword [edi], ebx
call fcn.2e0140ad
push 0xffffffffffffffff
push dword [ebp - 0x1160]
lea eax, [ebp - 0x1150]
push 0x80
push eax
mov dword [ebp - 0x1158], esi
mov dword [ebp - 0x1154], 7
call fcn.2e014127
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x1c
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 0x1050]
push eax
push ebx
push ebx
push 0x2e002114
push dword [ebp - 0x1168]
mov dword [ebp - 0x1160], 0x1048
call esi
cmp eax, ebx
mov dword [ebp - 0x115c], eax
jle 0x2e00f544
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0x115c], ebx
jl 0x2e00f5d7
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x2e00180c
push dword [ebp - 0x1168]
mov dword [ebp - 0x1160], 4
call esi
cmp eax, ebx
mov dword [ebp - 0x115c], eax
jle 0x2e00f58e
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0x115c], ebx
jl 0x2e00f5d7
lea eax, [ebp - 0x1164]
push eax
push dword [ebp - 0x1170]
lea eax, [ebp - 0x1158]
push eax
push dword [ebp - 0x116c]
call fcn.2e00f3fe
cmp eax, ebx
mov dword [ebp - 0x115c], eax
jl 0x2e00f5d7
mov eax, dword [ebp - 0x1164]
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x1164], eax
mov dword [ebp - 0x115c], ebx
jmp 0x2e00f5dd
mov eax, dword [ebp - 0x1164]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x2e00f5f4
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x115c]
xor ecx, ebp
call fcn.2e013f7c
leave
ret 0x14
Function at 0x2e00fbab
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x250]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, 0xffffffff
jne 0x2e00fbcf
mov dword [ebp - 4], 1
jmp 0x2e00fcb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
cmp dword [ebp + 8], edi
je 0x2e00fcb1
cmp dword [esi + 0x14], edi
jne 0x2e00fcb1
push ebx
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x250], eax
cmp eax, 0xffffffff
jne 0x2e00fc31
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x2e00fc2c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x2e00fcb0
mov ecx, dword [esi + 0x244]
mov eax, dword [esi + 0x240]
push edi
push edi
push ecx
push eax
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x2e00fc6c
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x2e00fc67
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x2e00fcb0
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x2e00fc97
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x2e00fc92
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x2e00fcb0
mov edx, dword [esi + 0x244]
mov ecx, dword [esi + 0x240]
mov eax, dword [esi + 0x20]
mov edi, dword [eax]
push edx
push ecx
push edx
push ecx
push eax
call dword [edi + 0x50]
pop ebx
mov eax, dword [esi + 0x250]
cmp eax, 0xffffffff
je 0x2e00fcca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x2e010810
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push esi
push edi
push 0x44
pop edi
push 1
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0xff
call fcn.2e01f0de
mov dword [ebp - 4], eax
test eax, eax
jne 0x2e010842
mov esi, 0x8007000e
jmp 0x2e010938
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.2e010a8d
mov esi, eax
test esi, esi
jl 0x2e010938
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x2e01092a
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x2e010916
cmp dword [ebp - 0x10], edi
jbe 0x2e0108c3
push 1
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.2e01f100
mov edi, eax
test edi, edi
jne 0x2e0108c0
call ebx
mov esi, eax
test esi, esi
jle 0x2e0108be
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x2e010937
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc], 0xff
jbe 0x2e0108de
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.2e010a8d
mov esi, eax
test esi, esi
jl 0x2e010937
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x2e01092a
call ebx
mov esi, eax
test esi, esi
jle 0x2e010928
and esi, 0xffff
or esi, 0x80070000
jmp 0x2e010926
test eax, eax
jle 0x2e010924
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x2e010937
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], ecx
mov dword [ebp - 4], esi
pop ebx
cmp dword [ebp - 8], 0
je 0x2e010946
push dword [ebp - 8]
call fcn.2e0110b3
cmp dword [ebp - 4], 0
je 0x2e010954
push dword [ebp - 4]
call fcn.2e01f125
pop edi
mov eax, esi
pop esi
leave
ret 0xc