joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc7e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x4bc99b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042463c
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00455bbc
call fcn.004a7030
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x4bc86c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.0041f43c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042463c
mov eax, dword [eax + 0xc]
pop edx
call fcn.0041f444
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0041f324
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00408f10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042463c
call fcn.004201ac
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0041f398
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0041f3d4
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0041f3d4
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0041f3d4
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0041f43c
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042463c
mov eax, dword [eax + 0xc]
pop edx
call fcn.0041f2d0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042463c
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.0041f114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc9a2
lea eax, [ebp - 4]
call fcn.00404278
ret
Function at 0x4d40e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4d40f8
mov eax, ebx
call fcn.004d393c
cmp dword [ebx + 0x68], 0
jne 0x4d4105
mov eax, ebx
call fcn.004d38d4
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.004d3754
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004d4854
cmp eax, dword [esp]
je 0x4d4173
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004d4868
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4d414f
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004d4854
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4d4168
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x4d418e
push 3
mov eax, dword [esi + 0x10]
call fcn.00449d60
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x4d419b
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.00442ce8
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00442d0c
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00442d34
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00442d58
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406308
mov eax, ebp
mov edx, dword [0x4f18a4]
mov byte [edx + 2], al
mov eax, dword [0x4f18a4]
mov byte [eax], 0
mov eax, dword [0x4f18a4]
mov byte [eax + 1], 0
mov eax, dword [0x4f18a4]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00449d60
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00449d60
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00449d60
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x4f18a4]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042463c
call fcn.004201ac
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00449d60
push eax
mov eax, dword [0x4f1888]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00449d60
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d4c0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x4f1b48]
mov eax, dword [eax]
call fcn.0046320c
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x4d4c17
pop esi
pop ebx
ret
Function at 0x4d5178
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00408b6c
test al, al
je 0x4d51ff
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00402eb8
or esi, 0x100
test esi, esi
jns 0x4d51b3
call fcn.004033e4
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4d51ff
mov dl, 1
mov eax, dword [0x41e2ac]
call fcn.00425c08
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00426014
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4d51ff
mov eax, esp
call fcn.0040dd7c
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x4e1748
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x4f2fb0
test esi, esi
jne 0x4e1762
xor eax, eax
jmp 0x4e1864
cmp dword [ebp], 0
jne 0x4e176d
call fcn.004e16d8
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4e183d
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4e1779
test edi, edi
jbe 0x4e185f
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4e1841
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, reloc.kernel32.dll_CreateProcessA
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x1007a7d
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1007aa6
push esi
call fcn.01013a3e
cmp eax, 0xf
je 0x1007aa1
cmp eax, 0x11
jne 0x1007ad4
xor eax, eax
inc eax
jmp 0x1007ad6
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1007ad4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1007aa1
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x1007b40
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7d4
mov eax, dword [0x101724c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7ce
push eax
mov word [ebp - 0x7d4], ax
lea eax, [ebp - 0x7d2]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x7d4]
push 0x3e8
push eax
call fcn.01007ae0
lea eax, [ebp - 0x7d4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100f329
leave
ret

Function at 0x10085e9
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x101724c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x428], eax
cmp eax, edi
je 0x100873e
cmp dword [ebp + 0xc], edi
je 0x100873e
xor ecx, ecx
mov word [eax], cx
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100873e
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x41c], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, edi
je 0x100873e
push ebx
call fcn.0100c178
mov edi, eax
pop ecx
test edi, edi
je 0x100873e
push edi
push ebx
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1008732
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x1002190
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1008732
mov eax, dword [ebp - 0x424]
movzx ecx, word [eax]
movzx eax, word [eax + 2]
push 0x1002170
shl ecx, 0x10
or ecx, eax
push ecx
push 0x1002140
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0100845d
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1008732
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x418], eax
jae 0x1008732
push dword [ebp - 0x420]
push eax
push dword [ebp - 0x428]
call fcn.010065a9
push edi
call fcn.0100ba30
xor eax, eax
pop ecx
inc eax
jmp 0x1008740
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f329
leave
ret 8
Function at 0x100d57d
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x10148ed
call fcn.0100f3b1
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x100d673
cmp byte [esi + 0x42], bl
je 0x100d673
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x100d5b9
xor al, al
jmp 0x100d675
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0100d54e
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
mov edi, dword [eax]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
mov eax, dword [eax]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x18]
add ebx, edi
push ebx
push eax
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x100d618
dec eax
je 0x100d61c
dec eax
dec eax
je 0x100d66f
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.01006a0d
mov al, bl
jmp 0x100d675
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
mov edi, dword [ebp - 0x30]
sub edi, dword [eax]
je 0x100d651
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
push dword [esi + 0x4c]
mov eax, dword [eax]
push edi
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100d606
cmp byte [esi + 0x42], 0
je 0x100d66f
test edi, edi
jne 0x100d5c7
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0100d1b1
jmp 0x100d5c7
mov bl, 1
jmp 0x100d608
mov al, 1
call fcn.0100f443
ret

Function at 0x100e3e4
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x10148ed
call fcn.0100f3b1
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x100e4d3
cmp byte [esi + 0x41], bl
je 0x100e4d3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x100e419
xor al, al
jmp 0x100e4d5
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0100d54e
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
mov edi, dword [eax]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
mov eax, dword [eax]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x18]
add ebx, edi
push ebx
push eax
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x100e478
dec eax
je 0x100e47c
dec eax
dec eax
je 0x100e4cf
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.01006a0d
mov al, bl
jmp 0x100e4d5
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
mov edi, dword [ebp - 0x30]
sub edi, dword [eax]
je 0x100e4b1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0100c693
push dword [esi + 0x4c]
mov eax, dword [eax]
push edi
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100e466
cmp byte [esi + 0x41], 0
je 0x100e4cf
test edi, edi
jne 0x100e427
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0100d1b1
jmp 0x100e427
mov bl, 1
jmp 0x100e468
mov al, 1
call fcn.0100f443
ret
Function at 0x1010c9c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x101724c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x2f0]
push eax
push 0x1003a9c
mov ebx, ecx
mov dword [ebp - 0x2e0], 2
call fcn.01010313
test eax, eax
je 0x1010e3f
and dword [ebp - 0x2ec], 0
push esi
mov dword [ebp - 0x2e4], 0x410
mov dword [ebp - 0x2e8], 0xa0
mov dword [ebp - 0x2dc], 0x1c
push edi
mov eax, dword [ebx + 0x664]
mov edx, dword [ebp - 0x2e8]
xor ecx, ecx
mov word [eax + edx + 0x24e4], cx
mov esi, 0x1003a90
lea edi, [ebp - 0xcc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xbe
push ecx
lea eax, [ebp - 0xc2]
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x2ec]
mov dword [ebp - 0x2f8], 0x64
push dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], 0x20c
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x2ec]
cmp eax, 0x103
je 0x1010e31
lea eax, [ebp - 0x2d8]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1010dab
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x2e4]
inc eax
push eax
lea eax, [ebp - 0x2d8]
push eax
mov eax, dword [ebx + 0x664]
lea eax, [eax + ecx + 0x464]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
test esi, esi
je 0x1010df7
movzx ecx, word [esi + 2]
sub ecx, 0x31
je 0x1010df4
dec ecx
jne 0x1010df7
push 2
pop eax
jmp 0x1010df7
xor eax, eax
inc eax
mov edx, dword [ebp - 0x2dc]
add dword [ebp - 0x2dc], 4
mov ecx, dword [ebx + 0x664]
inc dword [ebp - 0x2e0]
add dword [ebp - 0x2e8], 0x50
add dword [ebp - 0x2e4], 0x208
cmp dword [ebp - 0x2dc], 0x54
mov dword [edx + ecx], eax
jl 0x1010cfe
push dword [ebp - 0x2f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2e0]
xor ecx, ebp
add eax, 0xfffffffe
pop ebx
call fcn.0100f329
leave
ret
Function at 0x10129ef
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x101724c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x624], 0
push esi
mov esi, dword [ebp + 8]
mov eax, 0x104
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x620], ecx
cmp ecx, eax
jb 0x1012a33
mov dword [ebp - 0x620], eax
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x414], ax
cmp dword [ebp - 0x620], eax
jbe 0x1012bd6
push edi
mov edi, 0x208
push ebx
lea eax, [esi + ecx*2]
movzx edx, word [eax]
xor ebx, ebx
cmp bx, dx
je 0x1012b9c
push 0x25
pop ebx
cmp bx, dx
jne 0x1012b8f
lea edx, [ecx + 1]
mov dword [ebp - 0x630], 1
cmp edx, dword [ebp - 0x620]
jae 0x1012b8f
mov dword [ebp - 0x62c], edx
lea edx, [eax + 2]
mov dword [ebp - 0x63c], edx
mov dword [ebp - 0x634], edx
mov edx, dword [ebp - 0x634]
movzx edx, word [edx]
xor ebx, ebx
cmp bx, dx
je 0x1012b8f
push 0x25
pop ebx
cmp bx, dx
je 0x1012ade
inc dword [ebp - 0x630]
inc dword [ebp - 0x62c]
mov edx, dword [ebp - 0x62c]
add dword [ebp - 0x634], 2
cmp edx, dword [ebp - 0x620]
jb 0x1012a9c
jmp 0x1012b8f
mov edx, dword [ebp - 0x630]
lea ebx, [edx + ecx]
lea esi, [esi + ebx*2]
test esi, esi
je 0x1012b89
push dword [ebp - 0x628]
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [esi], ax
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010083e7
push 0x104
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1012b64
push 0x1005938
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010083e7
push dword [ebp - 0x63c]
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.010083e7
push 0x1005938
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010083e7
jmp 0x1012b7e
lea eax, [ebp - 0x61c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010083e7
inc dword [ebp - 0x624]
add esi, 2
mov dword [ebp - 0x628], esi
mov ecx, ebx
mov esi, dword [ebp - 0x638]
inc ecx
cmp ecx, dword [ebp - 0x620]
jb 0x1012a51
cmp dword [ebp - 0x624], 0
je 0x1012bd4
mov ebx, dword [ebp + 0xc]
lea eax, [esi + ebx*2]
cmp dword [ebp - 0x628], eax
jae 0x1012bc6
push dword [ebp - 0x628]
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.010083e7
lea eax, [ebp - 0x414]
push eax
push ebx
push esi
call fcn.010065a9
pop ebx
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
xor ecx, ebp
pop esi
call fcn.0100f329
leave
ret 8
Function at 0x1012c74
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1005988
push 0x80000002
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1012d19
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x1005970
push dword [ebp - 4]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
jne 0x1012cdb
cmp dword [ebp - 0xc], edi
jne 0x1012cdb
mov dword [ebp - 8], edi
jmp 0x1012d0e
call fcn.0101338b
test eax, eax
je 0x1012d0e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x100593c
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1012d0e
inc eax
cmp dword [ebp - 0x10], eax
jne 0x1012d0e
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov eax, dword [ebp - 8]
pop edi
leave
ret

Function at 0x101338b
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x10059fc
mov dword [ebp - 4], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x10133c6
call fcn.0101331d
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10133bd
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
leave
ret
Function at 0x1013a3e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3d0
mov eax, dword [0x101724c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1013a6b
xor eax, eax
inc eax
jmp 0x1013b47
push esi
call fcn.01014014
test eax, eax
je 0x1013a7d
push 0xc
pop eax
jmp 0x1013b47
lea eax, [ebp - 0x3cc]
push eax
push esi
call fcn.01013f8c
test eax, eax
je 0x1013aa1
xor eax, eax
cmp dword [ebp - 0x3cc], eax
setne al
add eax, 0xf
jmp 0x1013b47
push esi
call fcn.010140a2
test eax, eax
je 0x1013aaf
push 0xd
jmp 0x1013a77
push edi
push esi
call fcn.0101398e
test eax, eax
je 0x1013b02
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x1013acc
push 2
pop eax
jmp 0x1013b46
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x3c8]
push eax
push edi
call fcn.010141c0
test eax, eax
je 0x1013afe
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xe
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x1013b46
push 2
jmp 0x1013af2
push ebx
push 2
xor edi, edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
je 0x1013b82
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x3d0]
push eax
push ebx
call fcn.0101412e
test eax, eax
je 0x1013b56
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x11
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100f329
leave
ret 4
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x3c8]
push eax
push ebx
call fcn.010141c0
test eax, eax
je 0x1013b7e
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xe
jmp 0x1013b3b
push 2
jmp 0x1013b3b
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1013ba4
xor eax, eax
jmp 0x1013b45
push esi
call fcn.01013ca4
cmp eax, edi
je 0x1013bbb
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1013b45
push 2
pop edi
jmp 0x1013bb0