joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a758
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002a900
lea eax, [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1002a8ec
mov dword [ebp - 8], 1
mov dword [ebp - 0x14], 0x9c3997b0
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0xc], 0x4f4cc511
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], 0xb0ce
mov dword [ebp - 0x3c], 0xe548e01a
mov dword [ebp - 0x50], 0x771b7056
cmp dword [ebp - 8], 0
je 0x1002a87a
imul eax, dword [ebp - 8], 0x1c77
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
je 0x1002a7db
mov dword [ebp - 0x48], 1
jmp 0x1002a7df
and dword [ebp - 0x48], 0
mov eax, 0x68f6
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
jg 0x1002a7fa
mov dword [ebp - 0x4c], 1
jmp 0x1002a7fe
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jg 0x1002a80f
mov dword [ebp - 0x1c], 1
jmp 0x1002a813
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x637b3047
je 0x1002a82b
mov dword [ebp - 0x24], 1
jmp 0x1002a82f
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
je 0x1002a841
cmp dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x14], eax
jle 0x1002a852
mov dword [ebp - 0x28], 1
jmp 0x1002a856
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0xfffffff8
jb 0x1002a865
mov dword [ebp - 0x2c], 1
jmp 0x1002a869
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2c], eax
jle 0x1002a87a
mov dword [ebp - 0x30], 1
jmp 0x1002a87e
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x30], eax
jl 0x1002a88f
mov dword [ebp - 0x34], 1
jmp 0x1002a893
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jne 0x1002a8ab
mov dword [ebp - 0x38], 1
jmp 0x1002a8af
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jg 0x1002a8c9
mov dword [ebp - 0x40], 1
jmp 0x1002a8cd
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002a8ea
push 0
push 1
call fcn.1002a758
pop ecx
pop ecx
jmp 0x1002a8fe
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1002a908
push 1
call fcn.1002a747
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002e331
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002e362
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
push 0x9dc
call fcn.1003259d
add esp, 0x10
jmp 0x1002e3ba
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002e398
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002e396
push 0x681
push 0x64a
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x1002e3ba
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002e3ba
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret

Function at 0x1002f4a2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002f52c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002f519
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002f4fa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1002f517
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10025d6c
mov dword [eax], 0x7a00
jmp 0x1002f4ef
jmp 0x1002f52a
push 0x2366
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1002f54a
push 0x2e2f
push 0x2010
push 0x32cc
push 0
push 0x45db
call fcn.1002da21
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003145c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003147e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call fcn.100329f7
pop ecx
pop ecx
jmp 0x100314f5
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100314e8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x100314de
mov dword [ebp - 0x20], 0x546158d3
lea eax, [ebp - 0x20]
push eax
push 0
push 0x7594
push 0x4b05
push dword [ebp - 0x24]
call fcn.1002d91a
add esp, 0x14
jmp 0x100314e6
push 0
call fcn.1002d256
pop ecx
jmp 0x100314f5
push 0x14a0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x10031e7b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031f16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10031ef6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10031ed7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x10031ef4
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10025d6c
mov dword [eax], 0x10c93b4e
jmp 0x10031ecc
jmp 0x10031f14
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10031f14
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10031f2a
push 0x5cf6
push 0x7cd9
push 1
call fcn.1002e4ca
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10031f54
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031f93
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10031f7a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10031f91
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x168c
push 0
call fcn.100320c2
add esp, 0xc
jmp 0x10031fc1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.1002da21
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003d078
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077af4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003d14a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003d0fd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax + 0x18]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov dword [ecx + 0x18], eax
jmp 0x1003d145
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1003d12b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x1003d145
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1003d120
jmp 0x1003d216
mov dword [ebp - 0x24], 0x758c
mov dword [ebp - 0x54], 0x100092b0
cmp dword [ebp - 0x24], 0x76a5
jle 0x1003d1c2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
and dword [ebp - 0x18], 0
jmp 0x1003d180
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1c68
jge 0x1003d1c2
and dword [ebp - 0x1c], 0
jmp 0x1003d196
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e0f
jge 0x1003d1c0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0x106205d8
call fcn.10025bd9
jmp 0x1003d18f
jmp 0x1003d179
push 0x35c4
push 0
push 0x441d
call fcn.1003b69a
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x74e9
jge 0x1003d1f0
mov edx, dword [ebp - 0x54]
mov ecx, 0x106205d8
call fcn.100294ba
jmp 0x1003d20c
or dword [ebp - 4], 0xffffffff
jmp 0x1003d216
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003fbcf
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077c2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003fcda
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003fcc1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1003fc4a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x1b
jne 0x1003fcbf
push 1
lea ecx, [ebp - 0x4c]
call fcn.10025cee
and dword [ebp - 4], 0
push 0x2253
push 1
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1003fa93
add esp, 0x14
push 0
lea ecx, [ebp - 0x4c]
call fcn.10025d6c
push 0
lea ecx, [ebp - 0x4c]
call fcn.10025d6c
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4c]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1003fcb1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10025d50
jmp 0x1003fc3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10025d50
jmp 0x1003fc3f
jmp 0x1003fcd8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x1003fd16
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1003fcfe
push 0x681
push 0x64a
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x1003fd16
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1003fd16
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10040d5d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10040de3
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10040dd4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10040db5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10040dd2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x10040daa
jmp 0x10040de1
push 0x14a0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10040e12
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push 0x35df
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 1
mov edx, dword [ebp - 0x28]
mov ecx, 0x3a17
call fcn.1003f906
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10041a0c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10041a5b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x3e63
push 0xbe5
push 0x1b1d
push 0x7dd6
push dword [ebp - 8]
push 0x18eb
push 0
push 0x4bb0
push 0x2e6b
call fcn.10041dc9
add esp, 0x28
jmp 0x10041a9d
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10041a91
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10041a8f
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x10041a9d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret

Function at 0x10042301
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042325
push 0x6059
push 0x75e4
push 1
call fcn.10042385
add esp, 0xc
jmp 0x10042381
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042359
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10042357
push 0x729
push 0x1872
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x10042381
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10042381
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x1004291c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100429b3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004298b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10042989
push 1
push 0x1aba
push 0x3b97
push 0x2355
push 1
push 0x26c8
push 0x3412
push 0x8d5
push 0x56b4
push 0x266b
push 0x7d5a
call fcn.1004148d
add esp, 0x2c
jmp 0x100429ae
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100429ae
push 0x14a0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10042a73
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10042a28
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10042a09
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10042a26
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x100429fe
jmp 0x10042a73
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10042a56
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 4
jge 0x10042a73
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.10025d6c
mov dword [eax], 0xcd50997
jmp 0x10042a4b
mov esp, ebp
pop ebp
ret
Function at 0x10044a9a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10044b8b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10044b77
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10044b75
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10044b29
mov ecx, dword [ebp - 4]
call fcn.10057b05
movzx eax, al
test eax, eax
jne 0x10044b75
push dword [ebp - 4]
push 0x3ae1
push 0x7723
push 0x3bf7
push dword [ebp - 8]
push 0x709f
push 0
push 1
push 1
push 0x4bc3
push dword [ebp - 0x34]
push 0x154c
push 0x6ee
call fcn.10042482
add esp, 0x34
push 0
push 0x45a7
push dword [ebp - 0xc]
call fcn.10053aa4
add esp, 0xc
jmp 0x10044b89
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10044ba7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.10041b97
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100541d7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x4eda
mov dword [ebp - 0x24], 0x10009b78
cmp dword [ebp - 0x20], 0x50d5
jle 0x1005427e
and dword [ebp - 0x14], 0
jmp 0x1005421d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6f1c
jge 0x10054278
and dword [ebp - 0x18], 0
jmp 0x10054233
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1d46
jge 0x10054276
and dword [ebp - 0x1c], 0
jmp 0x10054249
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5215
jge 0x10054274
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0x106205d8
call fcn.10025bd9
jmp 0x10054242
jmp 0x1005422c
jmp 0x10054216
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x7091
push 1
push 0x134b
push dword [ebp + 8]
push dword [ebp + 0xc]
push 1
push 0x2022
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.10053d05
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4e47
jge 0x100542bf
mov edx, dword [ebp - 0x24]
mov ecx, 0x106205d8
call fcn.100294ba
jmp 0x100542db
or dword [ebp - 4], 0xffffffff
jmp 0x100542e5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret