joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f257
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100643cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002f38e
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002f36e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x6032
mov dword [ebp - 0x30], 0x10009c48
cmp dword [ebp - 0x20], 0x608b
jle 0x1002f321
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and dword [ebp - 0x14], 0
jmp 0x1002f2df
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x438a
jge 0x1002f321
and dword [ebp - 0x18], 0
jmp 0x1002f2f5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x521f
jge 0x1002f31f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x1002f2ee
jmp 0x1002f2d8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5d1d
jge 0x1002f346
mov edx, dword [ebp - 0x30]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1002f362
or dword [ebp - 4], 0xffffffff
jmp 0x1002f36c
jmp 0x1002f38c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f38c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1002f3b4
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push 0x62db
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0
push 0x789a
call fcn.10033899
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003381d
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10033853
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x5d60
push 0x409
push 1
push dword [ebp - 0xc]
call fcn.10033899
add esp, 0x14
jmp 0x10033895
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10033871
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x10033895
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.1001a954
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10034da6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10034e2f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10034e17
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x10034e2d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10034ea3
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10034e7a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10034e78
push 0
push 0x1788
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x10034ea3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov esi, dword [eax]
push 2
mov ecx, dword [ebp - 0x5c]
call fcn.1001a954
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10035d86
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10035dd4
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10035dca
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10035dc8
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x10035dd2
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10035dfa
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push 0x4ebb
push dword [ebp - 0x14]
push 0
push 0x6025
push dword [ebp - 0x18]
call fcn.1004766e
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003f405
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003f442
push 0x64f5
push 0x4fc8
push 0x7e99
push 0x4088
push 0x6249
push 0x569e
push 1
push 0x195b
call fcn.1003f4be
add esp, 0x20
jmp 0x1003f4ba
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003f4ab
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003f48c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1003f4a9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001a954
mov dword [eax], 0xfffffffd
jmp 0x1003f481
jmp 0x1003f4ba
push 0x270a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret
Function at 0x10042561
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064777
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10042612
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100425c2
push 0xb95
push 0x239c
push 0x2cd
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1004260d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100425f0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x1004260d
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1001a954
mov dword [eax], 0x9e672ca3
jmp 0x100425e5
jmp 0x1004272a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x24], 0x51a6
mov dword [ebp - 0x44], 0x1000b1c0
cmp dword [ebp - 0x24], 0x54e3
jle 0x100426c1
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
and dword [ebp - 0x18], 0
jmp 0x10042648
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19c3
jge 0x100426c1
and dword [ebp - 0x1c], 0
jmp 0x1004265e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x12e7
jge 0x100426bf
and dword [ebp - 0x20], 0
jmp 0x10042674
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1216
jge 0x100426bd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x74]
call fcn.1001a65b
jmp 0x1004266d
jmp 0x10042657
jmp 0x10042641
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5043
jge 0x100426dd
push dword [ebp - 0x44]
call fcn.1004e4c6
pop ecx
jmp 0x100426f9
or dword [ebp - 4], 0xffffffff
jmp 0x10042703
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
push 0x46a6
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 1
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call fcn.1002de62
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047a3f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10047a70
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x18ca
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10047ad7
add esp, 0x10
jmp 0x10047ad3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10047ab5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10047ab3
push 0
push 0x1788
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x10047ad3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10047ad3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov esp, ebp
pop ebp
ret
Function at 0x10047e4e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064879
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10047fe1
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x492a
mov dword [ebp - 0x30], 0x1000ba80
cmp dword [ebp - 0x28], 0x4940
jle 0x10047f5e
and dword [ebp - 0x24], 0
jmp 0x10047eaa
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5de6
jge 0x10047f47
and dword [ebp - 0x18], 0
jmp 0x10047ec4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7191
jge 0x10047f42
and dword [ebp - 0x1c], 0
jmp 0x10047eda
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x618c
jge 0x10047f3d
and dword [ebp - 0x20], 0
jmp 0x10047ef0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2fd1
jge 0x10047f3b
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar eax, cl
and eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1001a65b
jmp 0x10047ee9
jmp 0x10047ed3
jmp 0x10047ebd
jmp 0x10047ea3
push 0x2157
push 0
push 0x182a
push 0xca5
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4594
jge 0x10047f7a
push dword [ebp - 0x30]
call fcn.1004e4c6
pop ecx
jmp 0x10047f96
or dword [ebp - 4], 0xffffffff
jmp 0x10047fa0
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10047fc9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 1
mov eax, dword [ebp - 0x40]
push dword [eax]
push 0
call fcn.100404a6
add esp, 0xc
jmp 0x10047fdf
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10047fdf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10047ffd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
call fcn.100454d0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005f905
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006a750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10051a98
mov dword [ebp - 0x14], eax
cmp dword [0x1060e51c], esi
jne 0x1005f9f8
push 0x800
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005f985
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005fad8
push esi
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005fad8
push 0x10007524
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005fad8
push eax
call ebx
push 0x10007530
push edi
mov dword [0x1060e51c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007540
push edi
mov dword [0x1060e520], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007554
push edi
mov dword [0x1060e524], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060e52c], eax
test eax, eax
je 0x1005f9f5
push 0x10007570
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060e528], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005fa1d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005fa10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005fa32
push 4
pop eax
jmp 0x1005fada
cmp dword [ebp - 0x14], esi
je 0x1005fa32
push dword [0x1060e51c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005fa17
mov eax, dword [0x1060e528]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005fa90
cmp dword [0x1060e52c], edi
je 0x1005fa90
push eax
call ebx
push dword [0x1060e52c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005fa90
test eax, eax
je 0x1005fa90
call ecx
test eax, eax
je 0x1005fa85
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005fa85
test byte [ebp - 8], 1
jne 0x1005fa90
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005fac0
mov eax, dword [0x1060e520]
cmp eax, edi
je 0x1005fabd
push eax
call ebx
test eax, eax
je 0x1005fabd
call eax
mov esi, eax
test esi, esi
je 0x1005fabd
mov eax, dword [0x1060e524]
cmp eax, edi
je 0x1005fabd
push eax
call ebx
test eax, eax
je 0x1005fabd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060e51c]
call ebx
test eax, eax
je 0x1005fad8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005fada
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004efab
mov esp, ebp
pop ebp
ret
Function at 0x402fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402ff9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403034
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403030
lea ebx, [ebx]
cmp esi, edx
jae 0x403034
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x403020
cmp esi, edx
jb 0x40303b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4072f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556058
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b3680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00409770
mov dword [ebp - 4], 0
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x4c], 0
mov byte [esi + 0x46], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x5c4048]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4075e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5561b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b3680]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x5b3680]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x407775
cmp byte [ebx + 0x46], 0
je 0x407775
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
jne 0x40764b
xor al, al
jmp 0x407777
mov ecx, 0xf
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4076dd
dec eax
je 0x4076e1
sub eax, 2
je 0x40773f
xor bl, bl
jmp 0x407741
mov byte [ebx + 0x46], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x407720
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0052b6e4
add esp, 0x10
cmp esi, eax
jne 0x4076d9
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebx + 0x46], 0
je 0x40773f
test esi, esi
jne 0x4076a2
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00406fc0
jmp 0x40769a
mov bl, 1
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x40775c
push dword [esp + 0x18]
call fcn.005295dd
add esp, 4
mov dword [esp + 0x2c], 0xf
mov al, bl
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jmp 0x407777
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005295e2
mov esp, ebp
pop ebp
ret
Function at 0x413d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5574f3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5b3680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 8
call fcn.00529b2d
mov edx, eax
add esp, 4
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 1
test edx, edx
je 0x413ded
mov dword [edx], reloc.OLEAUT32.dll_SysReAllocString
mov dword [edx + 4], 0
jmp 0x413def
xor edx, edx
mov byte [ebp - 4], 0
lea eax, [edx + 4]
push 0
push eax
push 0
push 3
push 0
push 0
push 0
push 0x581e80
mov dword [ebp - 0x10], edx
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x413e48
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 4
push eax
lea eax, [esi + 0x24]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push 0
push 0x582044
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x413e53
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x413eb8
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0xdf4]
push eax
call fcn.00414790
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0xdfc]
push eax
call fcn.00414940
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0xe04]
push eax
call fcn.00414af0
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [esi + 0xe0c]
push eax
call fcn.00414ca0
lea eax, [esi + 0x958]
push eax
call fcn.00413f00
lea eax, [esi + 0x960]
push eax
call fcn.00413f00
mov edi, 1
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x413ee4
mov eax, dword [esi + 4]
test eax, eax
je 0x413edb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 4], 0
push esi
call fcn.005295dd
add esp, 4
mov eax, edi
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8