joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c710
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x1001c00b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100571b0]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x1005a3c8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.1000ecc5
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x1000c8fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000c7ae
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.1000e5e0
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.1000c400
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x1000c815
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x10054a20
push eax
call fcn.1000e937
add esp, 0xc
cmp eax, 1
jne 0x1000c815
mov eax, dword [ebp - 0x14]
mov dword [0x1005a3c8], eax
jmp 0x1000c8e5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x1000c82f
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x1000c843
push ebx
push esi
call fcn.1000cb60
jmp 0x1000c845
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x1005a3c8], eax
test eax, eax
jne 0x1000c867
push 0x10055818
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.1000e0ab
push eax
lea edx, [ebp + 0x84]
push 0x10054a20
push edx
mov edi, 1
call fcn.1000ed98
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.1000c540
test eax, eax
jne 0x1000c8de
push 0x10055818
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.1000e0ab
call fcn.1000c5e0
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x1005a3c8]
test esi, esi
je 0x1000c8cf
call fcn.1000cc40
mov dword [0x1005a3c8], 0
jmp 0x1000c8d6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1000c8dc
ret
mov eax, dword [0x1005a3c8]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x1000c8fd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1005a3c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.1000d1af
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x1000c930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001bf80
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100571b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x1005a3c8]
xor edi, edi
cmp ecx, edi
jne 0x1000c97b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x1000c988
mov dword [ebp - 0x14], edi
jmp 0x1000c9a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x1000ca36
mov ecx, dword [0x1005a3c8]
mov eax, dword [ecx]
cmp eax, edi
je 0x1000c967
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000c967
mov ebx, 0x1005a3c8
mov dword [ebp - 4], edi
call fcn.1000ca50
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x1000c9de
push 0x10055818
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.1000e0ab
mov ecx, dword [0x1005a3c8]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1000c9f8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x1000ca22
push 0x10055818
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.1000e0ab
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1000ca19
call fcn.1000cd60
mov eax, 0x1000ca1f
ret
mov eax, dword [0x1005a3c8]
mov eax, dword [eax]
test eax, eax
je 0x1000ca34
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ca50
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x1000ca7d
xor ecx, ecx
jmp 0x1000ca89
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x1000cb3d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x1000cab0
mov dword [esp + 0xc], esi
jmp 0x1000cb10
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x1000cb09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000cafc
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x1000cb10
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000cb10
push 0x10054a28
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000cb10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x1000cb33
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x1000caa2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x1000cb51
mov ecx, dword [ebx]
add ecx, 8
call fcn.1000cc90
test eax, eax
je 0x1000cb51
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x1000cb60
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x1001bfdb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100571b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.1000e5e0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x1000cbf8
push 0x10055818
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.1000e0ab
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x1000d1af
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100571b0]
jne 0x1000d1b9
repz ret
jmp fcn.1000f51d
Function at 0x1001864d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000f7ca
and dword [ebp - 4], 0
cmp dword [0x10059280], 0
mov ebx, eax
jne 0x100186fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100187af
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100187af
push eax
call fcn.1000f758
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10059280], eax
call esi
push eax
call fcn.1000f758
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10059284], eax
call esi
push eax
call fcn.1000f758
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10059288], eax
call esi
push eax
call fcn.1000f758
pop ecx
mov dword [0x10059290], eax
test eax, eax
je 0x100186fe
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000f758
pop ecx
mov dword [0x1005928c], eax
mov eax, dword [0x1005928c]
cmp eax, ebx
je 0x10018756
cmp dword [0x10059290], ebx
je 0x10018756
push eax
call fcn.1000f7d3
push dword [0x10059290]
mov esi, eax
call fcn.1000f7d3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10018756
test edi, edi
je 0x10018756
call esi
test eax, eax
je 0x1001874d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001874d
test byte [ebp - 0xc], 1
jne 0x10018756
or dword [ebp + 0x10], 0x200000
jmp 0x1001878f
mov eax, dword [0x10059284]
cmp eax, ebx
je 0x1001878f
push eax
call fcn.1000f7d3
pop ecx
test eax, eax
je 0x1001878f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001878f
mov eax, dword [0x10059288]
cmp eax, ebx
je 0x1001878f
push eax
call fcn.1000f7d3
pop ecx
test eax, eax
je 0x1001878f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10059280]
call fcn.1000f7d3
pop ecx
test eax, eax
je 0x100187af
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100187b1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1033848
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.010337c9
test eax, eax
jne 0x10339c1
push eax
lea ecx, [ebp - 0x418]
push ecx
push eax
push 0x2001f
push eax
push eax
push eax
push 0x1001c88
push 0x80000002
mov dword [ebp - 0x418], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10339c1
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.0105a9b1
test eax, eax
je 0x10339b4
push esi
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01055efe
mov dword [ebp - 0x420], eax
push ebx
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x41c], edx
call fcn.0105a553
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, 0x1001c80
test eax, eax
je 0x103392d
lea eax, [ebp - 0x20c]
push eax
call fcn.01055efe
cmp edx, dword [ebp - 0x41c]
ja 0x1033941
jb 0x1033908
cmp eax, dword [ebp - 0x420]
jae 0x1033941
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1033911
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
jmp 0x1033930
push 4
push edi
push 1
push 0
push 0x1001c58
push dword [ebp - 0x418]
call esi
cmp dword [0x1073a18], 0
jne 0x10339b2
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01059118
test eax, eax
je 0x103399e
lea eax, [ebp - 0x20c]
push eax
call fcn.01055efe
cmp edx, dword [ebp - 0x41c]
ja 0x10339b2
jb 0x1033979
cmp eax, dword [ebp - 0x420]
jae 0x10339b2
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1033982
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
jmp 0x10339a1
push 4
push edi
push 1
push 0
push 0x1001c38
push dword [ebp - 0x418]
call esi
pop edi
pop esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01047480
leave
ret

Function at 0x1033b38
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push 0x1001c88
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033ba8
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1001d08
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
invalid
test eax, eax
jne 0x1033b9f
cmp dword [ebp - 8], 0xc00d2afc
sete al
Function at 0x1034154
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x10341bb
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
mov dword [ebp - 4], esi
push esi
cmp dword [ebp + 0xc], esi
je 0x103417c
push 0x1001eb8
jmp 0x1034181
push 0x1001e48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x10341bb
cmp dword [ebp - 4], esi
je 0x10341bb
push 2
push 0x1001e44
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10341b2
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x10341c7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x210], esi
cmp ebx, esi
je 0x10342d8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
push 0x1001f80
push 0x80000002
call edi
test eax, eax
jne 0x10342a1
and dword [ebp - 0x214], esi
lea eax, [ebp - 0x214]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x210]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1034299
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x1001f58
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034291
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
push dword [ebp - 0x214]
call edi
push dword [ebp - 0x210]
call edi
mov ecx, 0x100173c
mov eax, ebx
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10342cf
test dx, dx
je 0x10342cb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10342cf
add eax, 4
add ecx, 4
test dx, dx
jne 0x10342a9
xor eax, eax
jmp 0x10342d4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10342ed
push 0
push 0x1001e18
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 4
Function at 0x1041af8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 8]
push eax
push 1
xor edi, edi
push edi
push 0x1004a68
push 0x80000001
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1041b8a
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x1004a2c
push dword [ebp - 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x1041b57
cmp dword [ebp - 4], 1
jne 0x1041b57
and dword [0x1074298], 0xfffffffe
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x10049e8
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call esi
pop esi
pop ebx
test eax, eax
jne 0x1041b81
cmp dword [ebp - 4], 1
jne 0x1041b81
and dword [0x1074298], 0xfffffffd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
leave
ret

Function at 0x1042741
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
mov dword [ebp - 0x420], esi
call fcn.01066666
push esi
push esi
push esi
push 6
call fcn.01058973
test eax, eax
invalid
invalid
Function at 0x1042ffc
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x104
push esi
mov dword [ebp - 0x240], eax
push 1
lea eax, [ebp - 0x234]
push eax
xor edi, edi
call fcn.01058c4e
test eax, eax
je 0x10432de
lea eax, [ebp - 0x234]
push eax
call fcn.01055e5e
push 0x100429c
push esi
lea eax, [ebp - 0x234]
push eax
call fcn.010358a6
test eax, eax
jl 0x10432de
lea eax, [ebp - 0x234]
push eax
call fcn.010561eb
test eax, eax
je 0x10432de
push esi
lea eax, [ebp - 0x234]
push eax
push eax
call fcn.010582f3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov dword [ebp - 0x23c], esi
cmp esi, edi
je 0x10432c9
mov dword [ebp - 0x238], esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10430a2
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
test ebx, ebx
je 0x104316d
push esi
push edi
push ebx
call fcn.01035831
test eax, eax
jl 0x1043166
push ebx
call dword [sym.imp.msvcrt.dll__wcslwr]
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [esp], 0x1004c78
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x1043117
push 0x22
add eax, 0x1a
pop ecx
cmp cx, word [eax]
jne 0x104310e
inc eax
inc eax
sub eax, ebx
sar eax, 1
lea eax, [esi + eax*2]
jmp 0x1043157
push 0x1004c64
push ebx
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x104315f
add esi, 0x12
push 0x100429c
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x104314a
mov ecx, dword [ebp - 0x23c]
sub eax, ebx
add eax, 0x18
sar eax, 1
lea eax, [ecx + eax*2]
jmp 0x1043157
mov eax, dword [ebp - 0x23c]
sub esi, ebx
sar esi, 1
lea eax, [eax + esi*2]
mov dword [ebp - 0x238], eax
jmp 0x1043166
and dword [ebp - 0x238], 0
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov ebx, dword [ebp - 0x240]
push 5
pop ecx
mov esi, 0x1004c4c
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
test ebx, ebx
je 0x1043220
cmp word [ebx], 0
je 0x1043220
mov esi, 0x1004c3c
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c]
movsw word es:[edi], word [esi]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10431a7
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [ebp - 0x2c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10431bd
sub eax, ecx
sar eax, 1
mov ecx, eax
invalid
Function at 0x10451d2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp edi, ebx
jne 0x10451ec
xor eax, eax
jmp 0x1045228
push 0x3c
lea eax, [ebp - 0x3c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
pop ebx
leave

Function at 0x10456b0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x1074308], esi
jne 0x1045722
push 0x105
lea eax, [ebp - 0x210]
push eax
mov dword [0x1074308], 1
call fcn.01058169
test eax, eax
je 0x1045722
lea eax, [ebp - 0x210]
push eax
call fcn.010561eb
test eax, eax
je 0x1045722
push 0xa
lea eax, [ebp - 0x210]
push esi
cmp dword [ebp + 8], esi
je 0x1045714
push 0x1004f78
jmp 0x1045719
push 0x1004f5c
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 4
Function at 0x1048fb4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x24c4
call fcn.01047500
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, 0x80004005
test eax, eax
je 0x1048fe7
push eax
lea eax, [esi + 0x14]
push eax
call fcn.0105849d
add esi, 0x14
cmp dword [esi], 0
mov dword [ebp - 0x24c4], esi
je 0x1048ffc
xor eax, eax
jmp 0x10492c2
push edi
mov edi, 0x105
push edi
lea eax, [ebp - 0x41c]
push eax
call fcn.0105a9b1
test eax, eax
je 0x10492bf
xor ebx, ebx
xor eax, eax
push 0x10067f4
mov dword [ebp - 0x24b4], ebx
mov dword [ebp - 0x24c0], ebx
mov word [ebp - 0x24ac], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x104906d
push 0x824
lea eax, [ebp - 0x24ac]
push eax
call fcn.01047d2c
xor ecx, ecx
test al, al
setne cl
lea ecx, [ecx + ecx + 0x1269]
push ecx
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp ax, word [ebp - 0x24ac]
je 0x104908d
lea eax, [ebp - 0x24ac]
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x10490a6
push 0x1006088
mov esi, 0x1048
push esi
lea eax, [ebp - 0x24ac]
push eax
call fcn.0103586b
jmp 0x10490ab
mov esi, 0x1048
lea eax, [ebp - 0x24c0]
push eax
call fcn.01057c17
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
movzx eax, word [ebp - 0x24c0]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x24ac]
push eax
push 0x10067a8
lea eax, [ebp - 0x1464]
push esi
push eax
call fcn.01035968
add esp, 0x1c
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp eax, 0xffffffff
je 0x1049124
push eax
push 0x1006790
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.0103592d
add esp, 0x10
test eax, eax
jl 0x1049124
lea eax, [ebp - 0x210]
push eax
push esi
lea eax, [ebp - 0x1464]
push eax
invalid

Function at 0x104a09e
Capabilities:
Delete registry value
Set registry value

Disassembly:
cmp dword [ecx + 0x40], 0
je 0x104a0b4
call fcn.01048fa3
test eax, eax
je 0x104a0b4
mov ecx, eax
jmp fcn.01048ba8
ret