joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101bd60
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
inc dword [0x102f7ac]
push esi
mov esi, ecx
mov dword [0x102f7a8], ebx
mov eax, 0x102f7b8
cmp dword [eax], ebx
je 0x101bdf0
add eax, 4
cmp eax, 0x102f7d0
jl 0x101bd6e
push edi
xor eax, eax
mov edi, 0x102f79c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, esi
stosd dword es:[edi], eax
call fcn.0101af7a
mov ecx, esi
mov dword [0x102e4d8], eax
call fcn.0101b400
mov ecx, esi
call fcn.0101b7ac
push 0x10000000
push ebx
push ebx
push ebx
push 0x1005dc0
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, ebx
mov dword [0x102f7b4], eax
pop edi
jne 0x101bdf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x4fb1
push 2
call fcn.0100dcc2
push eax
call fcn.0100d552
add esp, 0x10
cmp esi, ebx
jle 0x101bdec
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
jmp 0x101be3a
mov ebx, 0x8007000e
jmp 0x101be3a
push 0x101b298
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
jne 0x101be2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x14b
push 0x10058f0
mov esi, eax
call fcn.0100c9d4
push esi
push 0x1005d94
call fcn.0100cb4a
pop ecx
pop ecx
jmp 0x101bddc
push dword [0x102f7b0]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x101beb9
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 0x24], 1
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
jne 0x101bee4
mov dword [ebp - 8], 0x800000
mov ecx, 0x1bb
jmp 0x101beea
push 0x50
mov dword [ebp - 8], edi
pop ecx
push esi
push edi
push 3
push edi
push edi
lea eax, [esi + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push ecx
push eax
push dword [0x102f7b4]
call dword [sym.imp.WININET.dll_InternetConnectW]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, edi
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c033
push ebx
push 0x494
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005e40
call fcn.0100cb2d
pop ecx
pop ecx
push esi
push dword [ebp - 8]
lea ebx, [esi + 0x14]
push edi
push edi
push edi
push 0x1001938
push 0x1005e34
push dword [esi + 0x10]
mov dword [esi + 0x1c], ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, edi
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c032
push 0x4a0
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005e18
call fcn.0100cb2d
pop ecx
pop ecx
push edi
push edi
push edi
push edi
push dword [ebx]
mov dword [esi + 0x1c], edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push dword [ebp + 8]
mov ecx, esi
push edi
push eax
call fcn.0101bb79
test eax, eax
je 0x101c032
push 0x4aa
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005dfc
call fcn.0100cb2d
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push dword [ebx]
mov dword [ebp - 0xc], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x101c020
mov eax, dword [ebp - 4]
push 0x64
xor edx, edx
pop ecx
div ecx
cmp eax, 2
je 0x101c014
cmp eax, 3
je 0x101c014
push dword [ebp + 8]
push dword [ebp - 4]
push edi
jmp 0x101c02b
push dword [ebp + 8]
mov ecx, esi
call fcn.0101bc54
jmp 0x101c032
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0101c24c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x101c03e
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x102e77c]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [0x102e4d8], ebx
mov ecx, 0x93
lea edi, [ebp - 0x250]
mov dword [ebp - 0x254], ebx
rep stosd dword es:[edi], eax
je 0x101c11d
cmp dword [esi + 4], ebx
je 0x101c126
xor ecx, ecx
mov eax, dword [esi]
push esi
push ecx
push 1
push ebx
push ebx
push 0x15
lea edi, [esi + 0x10]
push eax
mov dword [esi + 0x1c], edi
push dword [0x102f7b4]
call dword [sym.imp.WININET.dll_InternetConnectW]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, ebx
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c10e
push 0x4e4
push 0x10058f0
call fcn.0100c9d4
push dword [esi]
push 0x1005e5c
call fcn.0100cb2d
pop ecx
pop ecx
push ebx
lea eax, [esi + 0x14]
push ebx
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push dword [edi]
call dword [sym.imp.WININET.dll_FtpFindFirstFileW]
push dword [ebp + 8]
xor ecx, ecx
cmp eax, ebx
setne cl
push eax
push ecx
mov ecx, esi
call fcn.0101bb79
test eax, eax
je 0x101c10e
push dword [ebp + 8]
mov ecx, esi
call fcn.0101bc54
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102222e
leave
ret 4
cmp dword [esi + 4], ebx
je 0x101c082
mov ecx, 0x8000000
jmp 0x101c084

Function at 0x101c90e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push 5
pop eax
cmp dword [ecx + 0x34], eax
je 0x101c9bb
mov dword [ecx + 0x34], eax
mov ecx, dword [0x102f7d0]
call fcn.0101f0c5
test eax, eax
jne 0x101c9de
and dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
inc edi
push edi
push 0
push 0x1001808
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c99b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1006160
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c98e
cmp dword [ebp - 0xc], 4
jne 0x101c98c
cmp dword [ebp - 0x10], eax
jne 0x101c98e
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x101c9a6
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x15
jmp 0x101c9af
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x1d
mov eax, dword [ebp + 8]
mov dword [eax], 1
pop edi
jmp 0x101c9e4
mov ecx, dword [0x102f7d0]
call fcn.0101f0c5
test eax, eax
jne 0x101c9de
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x16
jmp 0x101c9e4
mov eax, dword [ebp + 8]
and dword [eax], 0
xor eax, eax
leave
ret 8
Function at 0x101d21c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1028b05
call fcn.01022df8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0x1006024
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [0x102f7d0], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x34], 0x19
call fcn.0100dcc2
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10200f3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1028e62
call fcn.01022df8
sub esp, 0x224
mov eax, dword [0x102e77c]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x1001938
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], ebx
call sub.MFC42u.DLL_CString::CString_3
xor esi, esi
inc esi
xor edi, edi
cmp dword [ebp + 0xc], 0x2ee0
mov dword [ebp - 4], esi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x228], 0x1300
jb 0x1020202
cmp dword [ebp + 0xc], 0x2f8e
ja 0x1020202
lea ecx, [ebp - 0x220]
call sub.MFC42u.DLL_CString::CString_2
push 0x104
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10201b9
push 0xdd
push 0x100861c
call fcn.0100c9d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005c94
call fcn.0100cb4a
pop ecx
pop ecx
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
jmp 0x1020235
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push 0x1005c74
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
push 2
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, ebx
je 0x10201f3
mov dword [ebp - 0x228], 0x1b00
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0x400
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1020235
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x224]
call sub.MFC42u.DLL_CString::operator_1
cmp dword [ebp - 0x21c], ebx
je 0x1020249
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x224]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x22c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0102222e
leave
ret 8

Function at 0x1020901
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102e77c]
push esi
push edi
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
mov edi, 0x100861c
jne 0x1020950
push 0x22d
push edi
call fcn.0100c9d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008790
call fcn.0100cb4a
pop ecx
pop ecx
push 0x100877c
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101e8b4
mov esi, eax
test esi, esi
je 0x1020980
push 0x235
push edi
call fcn.0100c9d4
push esi
push 0x1008738
call fcn.0100cb4a
pop ecx
pop ecx
push 1
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0102222e
leave
ret
Function at 0x10218c3
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, 0x10290dd
call fcn.01022df8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], ebx
call dword [eax + 4]
push eax
mov dword [ebp - 0x18], eax
push 0x1008a88
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42u.DLL_operator_2
push dword [eax]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.010211a1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
cmp dword [ebp - 0x18], ebx
mov edi, 0x80004005
jne 0x1021918
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 4]
cmp dword [eax - 8], ebx
jne 0x102192c
mov dword [ebp - 0x10], 0x80070057
jmp 0x10219d5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1021996
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
dec eax
dec eax
je 0x102197c
dec eax
je 0x1021966
push 0x100
push 0x1008a54
call fcn.0100c9d4
push dword [ebp - 0x20]
push 0x1008a30
call fcn.0100cb4a
pop ecx
jmp 0x10219d1
push 0xee
push 0x1008a54
call fcn.0100c9d4
push 0x10089fc
jmp 0x10219cc
push 0xf7
push 0x1008a54
call fcn.0100c9d4
push 0x10089c4
call fcn.0100cb2d
pop ecx
cmp dword [ebp - 0x10], ebx
jne 0x10219d5
mov esi, dword [esi + 4]
push ebx
push 0x80
push 2
push ebx
push ebx
push 2
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10219f3
push 0x116
push 0x1008a54
call fcn.0100c9d4
push 0x1008980
call fcn.0100cb4a
pop ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
cmp ecx, ebx
pop ebx
je 0x10219e4
call fcn.010217e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
cmp dword [ebp - 0x18], ebx
je 0x10219d2
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1021a03
mov edi, dword [eax]
jmp 0x1021a05
xor edi, edi
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.010211fa
shl eax, 1
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10219d5
Function at 0x1022b99
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1008f40
call fcn.01022fa4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1022bd4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1022bd4
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1022bec
cmp eax, 0x20b
je 0x1022bd9
mov dword [ebp - 0x1c], edi
jmp 0x1022c00
cmp dword [ecx + 0x84], 0xe
jbe 0x1022bd4
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1022bfa
cmp dword [ecx + 0x74], 0xe
jbe 0x1022bd4
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x102f814], 0xffffffff
or dword [0x102f818], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x102f7e4]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102f7e0]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x102f810], eax
call fcn.01023080
cmp dword [0x102e780], edi
jne 0x1022c5d
push fcn.01023080
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01023069
push 0x102e054
push 0x102e050
call sub.msvcrt.dll__initterm
mov eax, dword [0x102f7dc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x102f7d8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x102e04c
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1022cc3
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x1022d7d
mov dword [ebp - 0x20], esi
cmp word [esi], 0x22
jne 0x1022d11
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1022cdf
cmp ax, 0x22
jne 0x1022ccc
cmp word [esi], 0x22
jne 0x1022cea
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1022cf8
cmp ax, 0x20
jbe 0x1022ce5
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x54], 1
je 0x1022d1e
movzx eax, word [ebp - 0x50]
jmp 0x1022d21
cmp word [esi], 0x20
jbe 0x1022cea
add esi, ebx
mov dword [ebp - 0x20], esi
jmp 0x1022d11
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0102771f
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], edi
jne 0x1022d42
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1022d77
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01022fdf
ret
Function at 0x1023213
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1023236
mov ebx, 0x80070057
jmp 0x10232be
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1008fd8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x1023264
and eax, edi
or eax, esi
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10232ad
cmp dword [ebp - 4], eax
jne 0x1023278
mov ebx, 0x80004005
jmp 0x10232bc
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push eax
push 0x1008fbc
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x102329f
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jl 0x10232ad
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x10232bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x10232ca
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x2c]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
movzx eax, word [ebp - 0xa]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
movzx eax, word [ebp - 0xc]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1009040
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x1023340
and eax, edi
or eax, esi
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x102337c
cmp dword [ebp - 4], eax
jne 0x1023354
mov ebx, 0x80004005
jmp 0x102338b
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 8], 4
push eax
push eax
push 0x1009034
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x102337a
and eax, edi
or eax, esi
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x102338b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x10235eb
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x1029186
call fcn.01022df8
sub esp, 0x25c
mov eax, dword [0x102e77c]
push ebx
push esi
mov dword [ebp - 0x10], eax
push edi
mov esi, ecx
and dword [ebp - 4], 0
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x268], esp
push eax
call sub.MFC42u.DLL_CString::CString_4
lea eax, [ebp - 0x264]
push eax
mov ecx, esi
call fcn.01023551
mov eax, dword [ebp - 0x264]
cmp dword [eax - 8], 0
mov byte [ebp - 4], 1
jle 0x102364c
push 0x1008cec
lea ecx, [ebp - 0x264]
call fcn.010229d6
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10236d8
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
call sub.MFC42u.DLL_operator_1
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
lea ecx, [ebp - 0x268]
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x10236c3
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
call sub.MFC42u.DLL_operator_1
push dword [eax]
call esi
lea ecx, [ebp - 0x268]
call sub.MFC42u.DLL_CString::CString
lea eax, [ebp - 0x260]
push eax
push ebx
call edi
test eax, eax
jne 0x102369a
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0102222e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1023ded
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x102926c
call fcn.01022df8
sub esp, 0x18
push esi
xor esi, esi
push edi
push 0x1001938
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
call sub.MFC42u.DLL_CString::CString_3
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x1023e2b
mov dword [ebp - 0x10], 0x80070057
jmp 0x1023f67
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push 0x1009318
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov edi, 0xffff
jle 0x1023e55
and eax, edi
or eax, 0x80070000
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x1023f67
cmp dword [ebp - 0x14], esi
jne 0x1023e71
mov dword [ebp - 0x10], 0x80004005
jmp 0x1023f75
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x1009308
push ebx
push dword [ebp - 0x14]
call esi
cmp eax, 2
je 0x1023f64
test eax, eax
jle 0x1023ea1
and eax, edi
or eax, 0x80070000
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x1023f64
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x1023f64
push 1
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
add eax, 2
push eax
call fcn.01023c1d
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x1023f64
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push 0
push 0
push ebx
push dword [ebp - 0x14]
call esi
test eax, eax
jle 0x1023ef8
and eax, edi
or eax, 0x80070000
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x1023f64
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::operator_1
push 0
push 0x2e
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Replace_1
cmp eax, 1
jge 0x1023f22
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp - 0x10], 0
jl 0x1023f64
push dword [ebp - 0x18]
mov esi, dword [sym.imp.msvcrt.dll__wtol]
call esi
mov ebx, dword [ebp + 8]
pop ecx
shl eax, 0x10
push 0
lea ecx, [ebp - 0x18]
mov dword [ebx], eax
call sub.MFC42u.DLL_CString::Find_2
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Mid_1
push dword [eax]
call esi
pop ecx
and eax, edi
or dword [ebx], eax
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
xor esi, esi
pop ebx
cmp dword [ebp - 0x14], esi
je 0x1023f75
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x14], esi
call fcn.01023d2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4