joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030554
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x18
mov eax, 0x1000fe5c
call fcn.1000f189
mov ebx, ecx
call fcn.10030a6b
test eax, eax
js 0x100306bd
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10012a30
lea edx, [ebx + 4]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.100303f6
mov esi, eax
test esi, esi
js 0x1003064e
mov esi, dword [ebx]
lea eax, [ebp - 0x18]
mov edi, esp
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [esi + 0xc]
push eax
call dword [0x100422bc]
mov ecx, ebx
call dword [esi + 0xc]
cmp edi, esp
je 0x100305bc
mov ecx, 4
int 0x29
test eax, eax
je 0x10030649
lea eax, [ebx + 0xc]
mov ecx, ebx
push eax
lea edi, [ebx + 4]
push edi
call fcn.10030232
mov esi, eax
test esi, esi
js 0x1003064e
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebx + 0x18], eax
cmp eax, 0xffffffff
jne 0x100305fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100305fc
xor esi, esi
mov dword [ebp - 0x14], esi
jmp 0x10030605
mov dword [ebp - 0x14], 1
xor esi, esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebx + 0x14], eax
cmp eax, 0xffffffff
jne 0x10030624
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10030624
mov ecx, esi
jmp 0x10030627
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x18], 0xffffffff
jne 0x1003064e
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x10030689
sub eax, 1
je 0x10030679
dec eax
sub eax, 1
je 0x10030658
test ecx, ecx
jne 0x10030649
cmp dword [ebp - 0x14], ecx
jne 0x1003064e
mov esi, 0xc8008000
lea ecx, [ebp - 0x24]
call fcn.1000daa0
jmp 0x100306bb
cmp dword [ebx + 0x14], 0xffffffff
je 0x1003066f
test byte [ebx + 0x14], 0x10
jne 0x1003066f
mov ecx, ebx
call fcn.100303b5
mov esi, eax
jmp 0x1003064e
mov ecx, ebx
push edi
call fcn.100302d6
jmp 0x1003066b
cmp dword [ebx + 0x14], 0xffffffff
je 0x10030649
test byte [ebx + 0x14], 0x10
mov ecx, ebx
je 0x10030666
jmp 0x10030671
push edi
mov ecx, ebx
call fcn.100302d6
test byte [ebx + 0x14], 0x10
mov esi, eax
je 0x1003064e
cmp dword [ebx + 0x14], 0xffffffff
je 0x1003064e
mov edx, dword [edi]
mov ecx, dword [ebx + 0xc]
call fcn.100307a7
jmp 0x1003066b
mov eax, esi
call fcn.1000f0ee
ret 8
Function at 0x100307a7
Capabilities:
Create directory
Set file attributes

Disassembly:
push 0x4c
mov eax, 0x1000fe7f
call fcn.1000f1bf
mov edi, edx
mov ebx, ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0x1000b8e4
mov esi, 0xc000003a
call fcn.10012a30
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.10012c5d
push 0
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100308dd
test edi, edi
je 0x100308d9
push 0
push 0x2000000
push 3
push 0
push 3
push 3
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100308d9
xor eax, eax
mov esi, 0x80
mov word [ebp - 0x4c], ax
xor edi, edi
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1003083d
mov esi, dword [ebp - 0x48]
mov edi, esi
shr edi, 0xe
and edi, 1
xor ecx, ecx
lea eax, [ebp - 0x50]
push ecx
push eax
push 2
lea eax, [ebp - 0x4c]
push eax
push ecx
push ecx
push 0x9003c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10030860
mov word [ebp - 0x4c], ax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x2000000
push 3
push 0
push 3
push 3
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100308a8
xor ecx, ecx
lea eax, [ebp - 0x50]
push ecx
push eax
push ecx
push ecx
push 2
lea eax, [ebp - 0x4c]
push eax
push 0x9c040
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and esi, 0x2027
jne 0x100308b5
mov esi, 0x80
push esi
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test edi, edi
je 0x100308ce
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_EncryptFileW]
jmp 0x100308d9
push 0
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
xor esi, esi
jmp 0x100308ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100308ef
mov esi, 0xc0000035
lea ecx, [ebp - 0x58]
call fcn.1000daa0
jmp 0x10030909
mov eax, esi
call fcn.1000f111
ret
Function at 0x10031736
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov dword [ebp - 8], ecx
mov esi, ecx
mov dword [ebp - 4], ecx
cmp dword [ebx + 0x38], ecx
je 0x100317e2
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push ecx
push dword [ebx + 0x38]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
cmp eax, 2
je 0x100317e2
test eax, eax
je 0x10031778
mov esi, 0xc0000001
jmp 0x100317de
mov ecx, dword [ebp - 4]
push edi
call fcn.10014d5b
mov edi, eax
test edi, edi
jne 0x1003178e
mov esi, 0xc0000017
jmp 0x100317dd
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebx + 0x38]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x100317af
mov esi, 0xc0000001
jmp 0x100317cd
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push 0
push 0
push dword [ebx + 0x54]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x100317a8
inc dword [0x100415d4]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
jmp 0x100317e4
xor eax, eax
pop esi
pop ebx
leave
ret 4

Function at 0x10032292
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebx], esi
mov dword [ebp - 4], esi
mov eax, dword [edi + 0x54]
test eax, eax
jne 0x100322d8
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
lea ecx, [edi + 0x58]
call fcn.100368f1
test eax, eax
je 0x100322cb
mov eax, 0xc8008000
jmp 0x10032304
mov eax, dword [ebp - 4]
mov dword [edi + 0x54], eax
mov dword [edi + 0x50], 1
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x100322f8
mov dword [ebx], 1
inc dword [0x100415d0]
jmp 0x10032302
cmp eax, 2
je 0x10032302
mov esi, 0xc0000001
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003626b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x10010365
call fcn.1000f189
mov esi, ecx
mov eax, dword [0x10041044]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 1
call fcn.10035fbc
cmp dword [esi], 1
jne 0x100362b6
mov edi, dword [esi + 0x24]
cmp edi, dword [esi + 0x64]
ja 0x100362ae
mov edi, dword [esi + 0x64]
mov eax, dword [esi + 0x60]
add eax, dword [esi + 0x20]
jmp 0x100362c7
mov edi, dword [esi + 0x34]
cmp edi, dword [esi + 0x74]
ja 0x100362c1
mov edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x2c]
push eax
lea ecx, [esi + 0x84]
call fcn.1001bf05
test eax, eax
je 0x100363cc
inc edi
mov byte [ebp - 4], 2
push edi
lea ecx, [ebp - 0x38]
call fcn.1001319b
lea ecx, [edi + edi]
mov dword [ebp - 4], 1
mov edx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], edx
mov edi, ebx
mov dword [ebp - 0x24], ebx
cmp edi, 2
jge 0x100363ee
mov eax, edi
shl eax, 6
cmp dword [esi], 1
mov dword [ebp - 0x28], eax
jne 0x1003631c
mov ebx, dword [eax + esi + 0x20]
jmp 0x10036320
mov ebx, dword [eax + esi + 0x2c]
mov dword [ebp - 0x18], ebx
xor ebx, ebx
cmp ebx, dword [ebp - 0x18]
jae 0x100363e5
cmp dword [esi], 1
mov eax, dword [eax + esi + 8]
jne 0x1003634c
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegEnumKeyExW]
jmp 0x10036362
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegEnumValueW]
test eax, eax
je 0x1003636d
mov edi, 0xc0000001
jmp 0x100363d1
mov ecx, dword [ebp - 0x20]
push ecx
mov byte [ebp - 4], 4
call fcn.10013835
push eax
lea ecx, [ebp - 0x30]
call fcn.10012d50
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.10035eb8
test eax, eax
jne 0x100363b7
mov eax, edi
mov ecx, esi
shl eax, 6
push ebx
push dword [eax + esi + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.10035df5
mov edi, eax
test edi, edi
js 0x100363d1
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
inc ebx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
jmp 0x10036325
mov edi, 0xc0000017
lea ecx, [ebp - 0x30]
call fcn.1000daa0
lea ecx, [ebp - 0x38]
call fcn.1000daa0
mov eax, edi
jmp 0x1003641d
inc edi
mov dword [ebp - 0x24], edi
jmp 0x10036300
lea ecx, [ebp - 0x30]
call fcn.1000daa0
lea ecx, [ebp - 0x38]
call fcn.1000daa0
xor eax, eax
jmp 0x1003641d
call fcn.1000f0ee
ret
Function at 0x10036fbd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [ecx]
mov eax, dword [eax + 0xc]
add eax, 0x14
test esi, esi
jne 0x10036fd2
mov esi, dword [eax]
cmp esi, eax
jne 0x10036fdd
mov eax, 0x103
pop esi
ret
test edx, edx
je 0x10036ff8
mov eax, dword [esi + 0x10]
mov dword [edx], eax
mov eax, dword [esi + 0x18]
mov dword [edx + 4], eax
lea eax, [esi + 0x24]
mov dword [edx + 8], eax
lea eax, [esi + 0x1c]
mov dword [edx + 0xc], eax
mov eax, dword [esi]
mov dword [ecx], eax
xor eax, eax
pop esi
ret

Function at 0x1003706f
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x138]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x30]
mov edx, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
add ecx, 0x14
mov eax, dword [ecx]
jmp 0x100370a7
cmp eax, ecx
je 0x100370ab
lea edi, [eax - 8]
cmp dword [edi + 0x18], edx
je 0x100370ad
mov eax, dword [eax]
test eax, eax
jne 0x10037099
xor edi, edi
test edi, edi
je 0x1003713d
mov eax, dword [esi + 0x150]
cmp eax, 0x200
jae 0x1003713d
shl eax, 5
mov dword [eax + esi + 0x158], edx
mov eax, dword [esi + 0x150]
mov ecx, dword [edi + 0x20]
add ecx, edx
shl eax, 5
mov dword [eax + esi + 0x15c], ecx
mov ecx, dword [esi + 0x150]
mov eax, dword [edi + 0x1c]
add ecx, 0xb
shl ecx, 5
mov dword [ecx + esi], eax
mov ecx, esi
push dword [edi + 0x30]
call fcn.1003744d
mov ecx, dword [esi + 0x150]
shl ecx, 5
mov dword [ecx + esi + 0x168], eax
mov dword [ecx + esi + 0x16c], edx
mov eax, dword [esi + 0x150]
shl eax, 5
mov byte [eax + esi + 0x170], 0
inc dword [esi + 0x150]
lock inc dword [0x10041d44]
mov dword [edi + 0x1c], 0x10037cd0
mov byte [esi + 0x40], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100381f1
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x1004162c
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10041d1c]
mov ecx, 0x100067dc
push edi
push ebx
push 0x1000c020
push 9
push ecx
xor esi, esi
call sym.IEShims.dll_IEShims_Uninitialize
add esp, 0x14
jmp 0x10038234
cmp dword [eax], ebx
jne 0x10038231
cmp dword [eax + 4], edi
je 0x1003823a
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x10038228
jmp 0x1003823d
mov esi, dword [eax + 8]
push esi
push 0x1000c058
push 9
push ecx
call sym.IEShims.dll_IEShims_Uninitialize
add esp, 0x10
test esi, esi
jne 0x10038261
cmp dword [ebp + 8], esi
je 0x10038261
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
int3
push 0x1004162c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1003b2a1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x1003b2b8
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003b2b8
test al, 0x10
jne 0x1003b2b8
mov al, 1
ret
xor al, al
ret
Function at 0x1003bac9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 8], 4
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
cmp dword [ebx + 0x78], esi
jne 0x1003bbc2
lea ecx, [ebx + 0x54]
call fcn.1003cea1
test eax, eax
je 0x1003bbc2
cmp dword [ebx + 0x78], esi
jne 0x1003bbba
mov eax, dword [ebx]
mov edi, esp
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100422bc]
mov ecx, ebx
call esi
cmp edi, esp
je 0x1003bb22
mov ecx, 4
int 0x29
mov dword [ebx + 0x70], eax
lea eax, [ebp - 4]
push eax
xor eax, eax
cmp byte [ebx + 0x7c], al
setne al
dec eax
and eax, 0xfffffe00
add eax, 0x20219
push eax
push 0
push 0x1000c548
push 0x80000002
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003bbba
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
push 0
mov edi, esp
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100422bc]
mov ecx, ebx
call esi
cmp edi, esp
je 0x1003bb7f
mov ecx, 4
int 0x29
push eax
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1003bbb1
cmp dword [ebp - 0xc], 4
jne 0x1003bbb1
mov eax, dword [ebp - 0x10]
mov ecx, eax
and ecx, 0xf
cmp ecx, 4
ja 0x1003bbb1
mov dword [ebx + 0x70], ecx
xor ecx, ecx
inc ecx
shr eax, 0x13
and eax, ecx
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x74], eax
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegCloseKey]
lea ecx, [ebx + 0x54]
call fcn.1003d0e4
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x70]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1003bbd6
mov eax, dword [ebx + 0x74]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x1003c576
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x214]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push edx
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], 0x208
push edx
lea edx, [ebp - 0x210]
xor edi, edi
push edx
push edi
push eax
push ecx
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1003c634
cmp dword [ebp - 0x210], 1
push 2
pop edx
je 0x1003c5df
cmp dword [ebp - 0x210], edx
je 0x1003c5df
push 5
jmp 0x1003c602
mov esi, dword [ebp - 0x214]
xor ecx, ecx
shr esi, 1
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.10014d5b
mov edi, eax
test edi, edi
jne 0x1003c605
push 8
pop esi
jmp 0x1003c634
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
lea edx, [esi + 1]
call fcn.1003b442
mov esi, eax
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x1003c627
movzx esi, si
test esi, esi
je 0x1003c634
push edi
call fcn.10014d79
pop ecx
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, esi
mov dword [ebx], edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000e130
leave
ret 0xc

Function at 0x1003c6d3
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0x10041bf0], esi
jne 0x1003c796
push 0x1000c63c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10041bf0], eax
test eax, eax
je 0x1003c781
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003c71d
push dword [0x10041bf0]
call dword [sym.imp.iertutil.dll_Ordinal_50]
mov esi, eax
test esi, esi
js 0x1003c76c
push 0xffffffffffffffff
push dword [0x10041bf0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1003c74d
cmp eax, 0x80
je 0x1003c74d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003c76a
movzx esi, si
or esi, 0x80070000
jmp 0x1003c768
sub esp, 0x10
mov ecx, 0x10041bf4
call fcn.1003d216
push dword [0x10041bf0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
jns 0x1003c796
push dword [0x10041bf0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x10041bf0], 0
jmp 0x1003c796
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003c796
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
ret
Function at 0x1003cd73
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x218], ecx
push 0x38
pop ecx
mov dword [ebp - 0x214], edi
call fcn.10014d5b
xor ebx, ebx
test eax, eax
je 0x1003cdb3
mov ecx, eax
call fcn.1003b6df
mov esi, eax
jmp 0x1003cdb5
mov esi, ebx
test esi, esi
je 0x1003ce90
mov dword [esi + 0x24], 4
mov eax, dword [edi]
mov dword [esi + 0x18], eax
cmp dword [edi + 4], ebx
je 0x1003ce41
push dword [edi + 4]
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrDupW]
mov dword [esi + 4], eax
test eax, eax
je 0x1003ce2d
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x1003ce27
cmp edi, 0x104
ja 0x1003ce27
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrDupW]
mov dword [esi], eax
test eax, eax
je 0x1003ce27
push 0x5c
pop ecx
cmp cx, word [eax + edi*2 - 2]
jne 0x1003ce25
xor ecx, ecx
mov word [eax + edi*2 - 2], cx
mov bl, 1
mov edi, dword [ebp - 0x214]
cmp dword [edi + 0x10], 0
je 0x1003ce63
push dword [edi + 0x10]
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrDupW]
mov dword [esi + 0x10], eax
jmp 0x1003ce63
push dword [edi + 8]
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrDupW]
mov dword [esi + 8], eax
cmp dword [edi + 0x10], ebx
je 0x1003ce5e
push dword [edi + 0x10]
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrDupW]
mov dword [esi + 0x10], eax
cmp dword [esi + 8], ebx
jne 0x1003ce67
test bl, bl
je 0x1003ce7b
mov eax, dword [ebp - 0x218]
push esi
add eax, 4
push eax
call fcn.1003b8bd
test eax, eax
jne 0x1003ce90
mov ecx, esi
call fcn.1003ba77
mov ecx, esi
call fcn.1003ba77
push esi
call fcn.10014d79
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e130
leave
ret 8
Function at 0x1003d485
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x834]
push esi
push eax
xor esi, esi
mov dword [ebp - 0x838], ebx
push ecx
mov dword [ebp - 0x834], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x834], esi
je 0x1003d64f
push dword [ebp - 0x834]
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x83c], eax
test eax, eax
je 0x1003d64f
push edi
push ecx
mov edx, ebx
mov ecx, eax
call fcn.1003d676
test eax, eax
je 0x1003d62b
xor eax, eax
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82c]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1003d62b
mov eax, dword [0x1000ccd0]
lea edi, [ebp - 0x82c]
movzx ecx, word [ebp - 0x82c]
mov ebx, esi
mov dword [ebp - 0xc], eax
mov ax, word [0x1000ccd4]
mov word [ebp - 8], ax
mov dword [ebp - 0x830], edi
push 0x104
lea eax, [ebp - 0x41c]
mov word [ebp - 0xc], cx
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1003d606
lea edi, [ebp - 0x41c]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x1003d56f
sub edi, ecx
sar edi, 1
cmp edi, 0x104
jae 0x1003d600
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x838]
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
add ebx, 1
je 0x1003d600
lea eax, [ebp - 0xc]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x214]
call fcn.1003b442
mov ecx, dword [ebp - 0x838]
lea eax, [ecx + edi*2]
push eax
lea ecx, [ebp - 0x214]
call fcn.1003d06b
mov edi, dword [ebp - 0x838]
lea eax, [ebp - 0x214]
push 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x1003d600
lea eax, [ebp - 0x214]
mov edx, 0x104
push eax
mov ecx, edi
call fcn.1003b442
mov edi, dword [ebp - 0x830]
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x1003d606
mov dword [ebp - 0x830], edi
test ebx, ebx
jne 0x1003d640
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x1003d544
jmp 0x1003d640
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003d640
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x1003d664
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003d664
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e130
leave
ret 8
Function at 0x1003d69c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x4e
push eax
lea eax, [ebp - 0x58]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1000cd64
push dword [ecx]
mov dword [ebp - 0x264], ebx
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
push 2
mov esi, eax
pop edi
sub esi, edi
neg esi
sbb esi, esi
and esi, 0x80004005
test eax, eax
jne 0x1003d81e
push 0x1000cd30
mov edx, 0x104
lea ecx, [ebp - 0x260]
call fcn.1003b442
mov esi, eax
test esi, esi
js 0x1003d81e
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x260]
call fcn.1003d06b
mov esi, eax
test esi, esi
js 0x1003d81e
lea eax, [ebp - 0x264]
mov esi, 0x80004005
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x260]
push eax
push 0x80000000
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003d816
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], ebx
push eax
push ebx
push ebx
push ebx
push 0x1000cd70
push dword [ebp - 0x264]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
push ebx
push ebx
push ebx
push ebx
test eax, eax
jne 0x1003d7ef
push 0x1000cd7c
push dword [ebp - 0x264]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1003d808
mov ecx, dword [ebp - 0x268]
call fcn.10014d5b
mov edi, eax
test edi, edi
je 0x1003d808
lea eax, [ebp - 0x268]
push eax
push edi
push ebx
push ebx
push 0x1000cd70
push dword [ebp - 0x264]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1003d7de
push 0x1000cd40
push edi
call sub.msvcrt.dll__wcsicmp
neg eax
pop ecx
sbb eax, eax
pop ecx
and esi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003d808
push 0x1000cda0
push dword [ebp - 0x264]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
sub eax, edi
neg eax
sbb eax, eax
and esi, eax
push dword [ebp - 0x264]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegCloseKey]
jmp 0x1003d81e
sub eax, edi
neg eax
sbb eax, eax
and esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e130
leave
ret