joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100af6e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x100b0f7
mov dword [ebp - 4], edi
call fcn.0100abc1
push edi
push 0x80
push 2
push edi
push 7
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100b0f7
call fcn.0100adc1
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp - 8]
push eax
push 0x66
push str.Windows_EUDC_Editor_Bitmap_File__Uni_Code_
push dword [ebp + 8]
call ebx
test eax, eax
je 0x100b0ee
cmp dword [ebp - 8], 0x66
jne 0x100b0ee
lea ecx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0100ae3f
test eax, eax
jne 0x100b0df
mov esi, dword [ebp - 0xc]
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x100b0df
cmp dword [ebp - 8], esi
jne 0x100b0df
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea esi, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0100ae9f
test eax, eax
jne 0x100b0df
mov esi, dword [ebp - 0xc]
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x100b0df
cmp dword [ebp - 8], esi
jne 0x100b0df
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
push 6
pop eax
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100b0df
push 0
mov edi, eax
lea eax, [ebp - 8]
push eax
push 6
push dword [ebp - 4]
mov esi, 0x102c298
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call ebx
test eax, eax
je 0x100b0dd
cmp dword [ebp - 8], 6
jne 0x100b0dd
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
call fcn.0100af1f
mov esi, dword [ebp - 0xc]
push 0
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x100b0dd
cmp dword [ebp - 8], esi
jne 0x100b0dd
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100b0fa
xor edi, edi
cmp dword [ebp - 4], edi
je 0x100b0ee
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1010f6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
test ebx, ebx
je 0x1011133
push 0
lea ecx, [ebp - 0x108]
push ecx
mov esi, 0x100
push esi
lea ecx, [ebp - 0x104]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1011133
cmp dword [ebp - 0x108], esi
jne 0x1011133
push edi
push esi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x104]
call fcn.01010f2b
mov word [ebx], ax
mov eax, dword [ebp - 0x102]
mov dword [ebx + 2], eax
mov eax, dword [ebp - 0xfe]
mov dword [ebx + 6], eax
mov al, byte [ebp - 0xfa]
mov byte [ebx + 0xa], al
mov al, byte [ebp - 0xf9]
lea ecx, [ebp - 0xf8]
mov byte [ebx + 0xb], al
call fcn.01010f48
lea ecx, [ebp - 0xf4]
mov dword [ebx + 0xc], eax
call fcn.01010f2b
lea ecx, [ebp - 0xf2]
mov word [ebx + 0x10], ax
call fcn.01010f2b
lea ecx, [ebp - 0xf0]
mov word [ebx + 0x12], ax
call fcn.01010f48
mov dword [ebx + 0x14], eax
mov al, byte [ebp - 0xec]
lea ecx, [ebp - 0xeb]
mov byte [ebx + 0x18], al
call fcn.01010f2b
lea ecx, [ebp - 0xc4]
mov word [ebx + 0x19], ax
call fcn.01010f2b
lea ecx, [ebp - 0xc2]
mov word [ebx + 0x40], ax
call fcn.01010f2b
lea edi, [ebx + 0x46]
lea esi, [ebp - 0xbe]
movsd dword es:[edi], dword [esi]
mov word [ebx + 0x42], ax
mov al, byte [ebp - 0xc0]
movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x44], al
mov al, byte [ebp - 0xbf]
lea ecx, [ebp - 0xb2]
mov byte [ebx + 0x45], al
movsd dword es:[edi], dword [esi]
call fcn.01010f48
lea ecx, [ebp - 0xae]
mov dword [ebx + 0x52], eax
call fcn.01010f2b
lea ecx, [ebp - 0xac]
mov word [ebx + 0x56], ax
call fcn.01010f2b
lea ecx, [ebp - 0xaa]
mov word [ebx + 0x58], ax
call fcn.01010f2b
lea ecx, [ebp - 0xa8]
mov word [ebx + 0x5a], ax
call fcn.01010f2b
lea ecx, [ebp - 0xa6]
mov word [ebx + 0x5c], ax
call fcn.01010f2b
lea ecx, [ebp - 0xa4]
mov word [ebx + 0x5e], ax
call fcn.01010f2b
mov word [ebx + 0x60], ax
mov al, byte [ebp - 0xa2]
lea ecx, [ebp - 0xa1]
mov byte [ebx + 0x62], al
call fcn.01010f2b
mov word [ebx + 0x63], ax
mov al, byte [ebp - 0x9f]
lea ecx, [ebp - 0x9e]
mov byte [ebx + 0x65], al
call fcn.01010f48
mov dword [ebx + 0x66], eax
lea ecx, [ebp - 0x9a]
call fcn.01010f48
mov dword [ebx + 0x6a], eax
xor eax, eax
pop edi
jmp 0x1011136
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01026cc5
leave
ret 4
Function at 0x1011499
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], esi
jne 0x10114b4
or eax, 0xffffffff
jmp 0x1011667
mov eax, dword [ebp + 0xc]
push edi
mov edi, 0xe000
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
cmp eax, edi
jb 0x10114db
cmp dword [ebp + 0x10], esi
jle 0x10114db
add eax, 0xffff2001
cmp dword [ebp + 0x10], eax
mov dword [0x102d9c0], eax
jle 0x10114e3
or eax, 0xffffffff
jmp 0x1011666
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
shl eax, 2
push eax
call ebx
pop ecx
mov dword [0x102d9c4], eax
cmp eax, esi
je 0x1011698
push esi
push esi
mov esi, 0x100
push esi
push dword [0x102c380]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, esi
jne 0x101166c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x102d9b4]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
imul eax, dword [0x102d9b0]
push 4
push eax
call fcn.0100b371
test eax, eax
jl 0x101166c
push dword [ebp - 0x10]
call ebx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x101166c
mov esi, dword [0x102d9c4]
cmp dword [ebp + 0xc], edi
jb 0x1011575
mov eax, edi
or dword [esi + eax*4 - 0x38000], 0xffffffff
inc edi
movzx eax, di
cmp eax, dword [ebp + 0xc]
jbe 0x1011564
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
jle 0x1011616
mov esi, dword [ebp - 0x10]
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 4]
push dword [0x102c380]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101166c
cmp dword [ebp - 0x18], esi
jne 0x101166c
mov ecx, dword [ebp - 4]
add ecx, 2
call fcn.01010f2b
push 2
pop ecx
mov edi, 0x100232c
mov esi, 0x102d9a8
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
movzx eax, ax
jne 0x10115dc
mov ecx, 0x8001
cmp word [0x102d9a4], cx
je 0x10115e2
push eax
call fcn.0100ad29
mov esi, dword [0x102d9c4]
movzx ecx, ax
movzx eax, cx
cmp eax, dword [ebp + 0xc]
ja 0x1011607
mov edx, 0xe000
cmp cx, dx
jb 0x1011607
mov ecx, dword [ebp - 8]
mov dword [esi + eax*4 - 0x38000], ecx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x1011583
push dword [ebp - 4]
mov edi, dword [sym.imp.msvcrt.dll_free]
call edi
mov eax, dword [ebp + 0x10]
shl eax, 2
push eax
call ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1011678
mov ecx, eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [eax], ecx
cmp dword [0x102d9c0], edi
jle 0x1011663
mov eax, dword [esi + edi*4]
test eax, eax
jle 0x101165a
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp + 0x10]
jge 0x101165a
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0x14], edx
inc edi
cmp edi, dword [0x102d9c0]
jl 0x1011644
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0xc
mov esi, dword [0x102d9c4]
mov edi, dword [sym.imp.msvcrt.dll_free]
test esi, esi
je 0x1011680
push esi
call edi
pop ecx
cmp dword [ebp - 0xc], 0
je 0x101168c
push dword [ebp - 0xc]
call edi
pop ecx
cmp dword [ebp - 4], 0
je 0x1011698
push dword [ebp - 4]
call edi
pop ecx
or eax, 0xffffffff
jmp 0x1011665
Function at 0x1011a32
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x102dc10], 0
je 0x1011a71
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x3e8
jb 0x1011a47
push 0
call sub.GDI32.dll_EnableEUDC
push 0x102da08
push 0x102d9c8
call fcn.0101ead5
push 1
call sub.GDI32.dll_EnableEUDC
pop edi
pop esi
ret
Function at 0x101e862
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 2
push 0
mov edi, 0x102f540
push edi
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101e89b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x101e89e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x101e94a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x101e9b3
test esi, esi
je 0x101e9b3
mov ebx, 0x104
cmp dword [ebp + 0x10], ebx
jl 0x101e9b3
push 0x20
push 0xef42
lea eax, [ebp - 0x84]
push eax
call fcn.010245ad
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
lea eax, [ebp - 0x44]
jne 0x101e9c6
push 0x1004818
push 0x20
push eax
call fcn.01008286
test eax, eax
jge 0x101e9cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01026cc5
leave
ret 0xc
push 0x20
push eax
push edi
call fcn.0101e8cc
lea eax, [ebp - 0x290]
push eax
push 0x20019
push 0
push 0x102f540
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101e9b3
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x298]
push eax
push 0
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x290]
mov dword [ebp - 0x294], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x290]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x101e9b3
cmp word [ebp - 0x28c], di
je 0x101e9b3
mov edi, dword [ebp + 0x10]
push edi
push esi
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [esi + 2], 0x3a
jne 0x101ea70
push 0x1002830
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x101eac8
push esi
push ebx
lea eax, [ebp - 0x28c]
push eax
call fcn.01008286
test eax, eax
jl 0x101e9b3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x101e9b3
cmp eax, edi
jge 0x101e9b3
push 0x1001d88
push edi
push esi
call fcn.010082c0
test eax, eax
jl 0x101e9b3
lea eax, [ebp - 0x28c]
push eax
push edi
push esi
call fcn.010082c0
test eax, eax
jl 0x101e9b3
xor eax, eax
inc eax
jmp 0x101e9b5
Function at 0x101ead5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x101eb34
test ebx, ebx
je 0x101eb34
push 0x20
push 0xef42
lea eax, [ebp - 0x84]
push eax
call fcn.010245ad
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
lea eax, [ebp - 0x44]
jne 0x101eb47
push 0x1004818
push 0x20
push eax
call fcn.01008286
test eax, eax
jge 0x101eb50
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01026cc5
leave
ret 8
push 0x20
push eax
push esi
call fcn.0101e8cc
lea eax, [ebp - 0x290]
push eax
push 0x2001b
push 0
push 0x102f540
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101eb34
push ebx
call fcn.0101e716
mov edi, eax
lea eax, [ebp - 0x28c]
test edi, edi
je 0x101ec1a
push 0x1004844
mov esi, 0x104
push esi
push eax
call fcn.01008286
test eax, eax
jl 0x101eb34
cmp word [edi], 0x5c
je 0x101ebbd
push 0x1002830
push esi
lea eax, [ebp - 0x28c]
push eax
call fcn.010082c0
test eax, eax
jl 0x101eb34
push edi
push esi
lea eax, [ebp - 0x28c]
push eax
call fcn.010082c0
test eax, eax
jl 0x101eb34
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28c]
push eax
push 1
push 0
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x290]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x290]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x101eb36
push ebx
push 0x104
push eax
call fcn.01008286
jmp 0x101ebcb

Function at 0x101ec2d
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x101ec51
xor eax, eax
jmp 0x101ecd9
push 0x20
push 0xef42
lea eax, [ebp - 0x84]
push eax
call fcn.010245ad
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
lea eax, [ebp - 0x44]
jne 0x101ec8c
push 0x1004818
push 0x20
push eax
call fcn.01008286
test eax, eax
jge 0x101ec95
jmp 0x101ec4a
push 0x20
push eax
push esi
call fcn.0101e8cc
lea eax, [ebp - 0x88]
push eax
push 2
push 0
push 0x102f540
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101ec4a
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x88]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01026cc5
leave
ret 4
Function at 0x101edc3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 8], ebx
je 0x101ee6e
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x101ee6e
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edi + edi]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push ebx
push dword [0x102cb64]
mov dword [ebp + 0xc], ebx
push 0x80000002
mov dword [ebp + 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101ee36
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101ee36
cmp word [esi], bx
setne al
mov dword [ebp + 0x10], eax
jmp 0x101ee5a
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0101e77a
test eax, eax
je 0x101ee5a
push dword [ebp + 8]
push edi
push esi
call fcn.01008286
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp + 0x10], ecx
pop edi
cmp dword [ebp + 0xc], ebx
je 0x101ee69
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x10]
jmp 0x101ee70
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x101ee7b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x168], eax
cmp ecx, esi
je 0x101efcb
cmp eax, esi
je 0x101efcb
push ecx
push dword [ebp + 0x10]
xor edx, edx
push eax
mov word [eax], dx
call fcn.01008286
test eax, eax
jl 0x101efcb
lea eax, [ebp - 0x150]
push eax
push 1
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontSubstitutes
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101efcb
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x164]
push eax
push esi
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x14c]
push eax
push esi
push dword [ebp - 0x150]
mov dword [ebp - 0x15c], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x154], 0x52
mov dword [ebp - 0x158], 0xa4
call esi
mov edi, 0x103
jmp 0x101efb9
test eax, eax
jne 0x101efbf
push 0x2c
lea eax, [ebp - 0x14c]
push eax
call fcn.0101e8a7
push dword [ebp - 0x160]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x101efdd
inc dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x15c]
mov dword [ebp - 0x154], 0x52
push dword [ebp - 0x150]
mov dword [ebp - 0x158], 0xa4
call esi
cmp eax, edi
jne 0x101ef43
jmp 0x101f004
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01026cc5
leave
ret 0xc
push 0x2c
lea eax, [ebp - 0xa8]
push eax
call fcn.0101e8a7
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x168]
call fcn.01008286
test eax, eax
jl 0x101efcb
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x101efcd
Function at 0x1020c5e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
cmp eax, ecx
je 0x1020d5b
cmp dword [ebp + 0xc], 0xffffffff
je 0x1020d5b
cmp dword [ebp + 0x10], ecx
je 0x1020d5b
cmp dword [ebp + 0x18], ecx
je 0x1020d5b
mov edx, dword [ebp + 0x14]
and edx, 0x80000003
jns 0x1020ca1
dec edx
or edx, 0xfffffffc
inc edx
jne 0x1020d5b
mov eax, dword [eax]
mov edi, ebx
and edi, 0x80000003
mov dword [ebp - 0x10], eax
jns 0x1020cbb
dec edi
or edi, 0xfffffffc
inc edi
je 0x1020cc4
push 4
pop eax
sub eax, edi
mov edi, eax
cmp ebx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
jle 0x1020d4f
jmp 0x1020cd5
xor ecx, ecx
mov esi, dword [ebp + 0x14]
cmp ebx, esi
jg 0x1020ce9
mov esi, ebx
cmp edi, ecx
je 0x1020ce9
mov dword [ebp - 0xc], 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetFontData]
cmp eax, esi
jne 0x1020d5b
cmp dword [ebp - 0xc], 0
je 0x1020d19
mov eax, dword [ebp + 0x10]
push edi
add eax, ebx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
add esi, edi
cmp esi, dword [ebp + 0x14]
jg 0x1020d5b
push esi
push dword [ebp + 0x10]
call fcn.01020bbd
add dword [ebp - 8], eax
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1020d5b
cmp dword [ebp - 0x14], esi
jne 0x1020d5b
add dword [ebp - 4], esi
sub ebx, esi
test ebx, ebx
jg 0x1020cd3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor eax, eax
jmp 0x1020d5e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x1020dec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0x1020e9e
xor ebx, ebx
cmp edi, ebx
je 0x1020e9e
cmp dword [edi + 0xc], ebx
jne 0x1020e16
xor eax, eax
jmp 0x1020ea1
push 0x4000
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1020e9e
push ebx
push ebx
push dword [edi + 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [edi + 8]
jne 0x1020e94
mov esi, dword [edi + 0xc]
mov dword [ebp - 0xc], ebx
jmp 0x1020e7b
mov eax, 0x4000
cmp esi, eax
jg 0x1020e4f
mov eax, esi
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1020e94
cmp dword [ebp - 8], ebx
je 0x1020e94
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.01020bbd
add dword [ebp - 0xc], eax
sub esi, dword [ebp - 8]
cmp esi, ebx
jg 0x1020e44
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
mov dword [edi + 4], eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x1020e0f
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 4
Function at 0x1020eac
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xffffffff
push esi
je 0x1020f12
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1020f12
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 0xc]
push eax
push 0xc
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1020f12
cmp dword [ebp + 0xc], 0xc
jne 0x1020f12
lea eax, [esi + 4]
push eax
call fcn.01020b18
lea eax, [esi + 6]
push eax
call fcn.01020b18
lea eax, [esi + 8]
push eax
call fcn.01020b18
add esi, 0xa
push esi
call fcn.01020b18
xor eax, eax
jmp 0x1020f15
or eax, 0xffffffff
pop esi
pop ebp
ret 8

Function at 0x1020f1f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
or eax, 0xffffffff
push esi
mov esi, dword [ebp + 0xc]
cmp ebx, eax
je 0x1020fa3
test esi, esi
je 0x1020fa3
push edi
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc]
push eax
movsd dword es:[edi], dword [esi]
call fcn.01020b75
lea eax, [ebp - 0xa]
push eax
call fcn.01020b75
lea eax, [ebp - 8]
push eax
call fcn.01020b75
lea eax, [ebp - 6]
push eax
call fcn.01020b75
xor esi, esi
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
test eax, eax
jne 0x1020fa0
push esi
lea eax, [ebp - 0x14]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1020fa0
cmp dword [ebp - 0x14], 0xc
jne 0x1020fa0
xor eax, eax
jmp 0x1020fa3
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01026cc5
leave
ret 8

Function at 0x1020fb8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffff
push esi
push edi
je 0x1021032
cmp dword [ebp + 0xc], 0
je 0x1021032
push 0
push 0
push 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xc
jne 0x1021032
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
mov esi, edi
shl esi, 4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1021032
cmp dword [ebp - 4], esi
jne 0x1021032
test edi, edi
jle 0x102102e
mov esi, dword [ebp + 0xc]
add esi, 8
lea eax, [esi - 4]
push eax
dec edi
call fcn.01020b45
push esi
call fcn.01020b45
lea eax, [esi + 4]
push eax
call fcn.01020b45
add esi, 0x10
test edi, edi
jg 0x102100e
xor eax, eax
jmp 0x1021035
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc