joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb4fc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4bb59e
cmp dword [ebx + 0x94], 0
jne 0x4bb598
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4bb448
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4bb598
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4bb55e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4bb598
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00434eb8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4bb56d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4bb7bc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x54d28c]
cmp dword [eax + 0x170], 0
je 0x4bb921
test bl, bl
jne 0x4bb86f
cmp dword [esi + 0x9c], 0
jne 0x4bb864
mov eax, esi
call fcn.004be6ac
push eax
push 0x4bb6c8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4bb835
mov eax, dword [0x54d28c]
cmp byte [eax + 0xd3], 0
je 0x4bb835
mov eax, dword [esi + 0xd8]
call fcn.0040825c
mov edi, eax
cmp edi, 0
jl 0x4bb835
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4bb81e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4bb864
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434eb8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4bb844
inc dword [esi + 0x9c]
jmp 0x4bb921
cmp dword [esi + 0x9c], 0
jle 0x4bb921
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4bb921
cmp dword [esi + 0x44], 0
je 0x4bb8cc
mov eax, dword [0x54d28c]
cmp byte [eax + 0xd3], 0
je 0x4bb8cc
mov eax, dword [esi + 0xd8]
call fcn.0040825c
mov edi, eax
cmp edi, 0
jl 0x4bb8cc
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4bb8b5
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4bb8fb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434eb8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4bb8db
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4ae988]
call fcn.0040841c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4bc570
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4bc5db
cmp byte [ebx + 0xd3], 0
jne 0x4bc5db
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406be4
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4bc5c8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4bc5e8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406aa8
jmp 0x4bc5e8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406aa8
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4bde10
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4bde7e
mov eax, esi
call fcn.004963c0
test al, al
je 0x4bde7e
mov eax, dword [ebx + 0x84]
call fcn.00496014
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4bde7e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4bde72
push 0
mov eax, dword [ebx + 0x84]
call fcn.00496014
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0048cfb4
jmp 0x4bde7e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004bdc48
pop esi
pop ebx
ret
Function at 0x4bf58c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40c634]
call fcn.00407748
xor eax, eax
push ebp
push 0x4bf6d6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x545000], 0
jne 0x4bf5e0
mov ecx, dword [0x547414]
mov dl, 1
mov eax, dword [0x40d84c]
call fcn.0041851c
call fcn.0040590c
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.004047f8
mov eax, ebx
call fcn.004068f8
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4bf6e4
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004097b4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4bf627
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4bf67c
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4bf675
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00406d20
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00406cb8
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041284c
test eax, eax
jne 0x4bf675
mov ebx, 0x15
jmp 0x4bf681
mov ebx, 0x10
jmp 0x4bf681
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x545000]
call fcn.004bf3f8
mov eax, dword [ebp - 4]
call fcn.004bf3f8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004097cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf6dd
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00406aa0
lea eax, [ebp - 0xc]
mov edx, dword [0x40c634]
call fcn.00407820
ret
Function at 0x4c391c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x4c3934
add esp, 0xfffffff0
call fcn.00405368
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4c3a4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0040422c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x4c3a38
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004bf3f8
xor eax, eax
push ebp
push 0x4c3a25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004bf3f8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00406d20
jmp 0x4c39f6
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.004072c8
mov eax, dword [ebx + 4]
call fcn.00406e28
dec eax
jle 0x4c3a0a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x4c39e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3a2c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3a55
lea eax, [ebp - 4]
call fcn.0040672c
ret
Function at 0x4d31bc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d31ea
mov eax, ebx
call fcn.004d3c70
cmp dword [ebx + 0x40], 0
je 0x4d31e3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d325b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d324d
cmp dword [ebx + 8], 0
je 0x4d320c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d321e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d324d
cmp dword [ebx + 8], 0
je 0x4d31ff
cmp eax, 3
je 0x4d3231
dec eax
jne 0x4d31ff
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d31ff
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d31ff
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d3279
cmp dword [ebx + 0x14], 0xcc
je 0x4d3279
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d3284
pop ebx
ret
Function at 0x5330f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x533372
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0xc0], 0
jne 0x533349
mov eax, dword [edi + 0x34]
test eax, eax
je 0x53314d
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x53316d
mov eax, dword [edi + 0x38]
test eax, eax
je 0x53315d
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x53316d
mov eax, edi
call fcn.00533428
jmp 0x533349
cmp dword [edi + 0xc4], 0
jne 0x5331bc
lea eax, [ebp - 0x108]
mov edx, dword [edi + 0x34]
mov ecx, 0
call fcn.00406cfc
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00413ea4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x54d43c]
call fcn.00532ad4
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xc4], eax
cmp dword [edi + 0xc8], 0
jne 0x53320b
lea eax, [ebp - 0x10c]
mov edx, dword [edi + 0x38]
mov ecx, 0
call fcn.00406cfc
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x101]
call fcn.00413ea4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x54d43c]
call fcn.00532ad4
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xc8], eax
mov ecx, dword [edi + 0xc8]
mov edx, dword [edi + 0xc4]
mov eax, edi
call fcn.00533468
mov ebx, eax
test bl, bl
jne 0x5332fe
mov eax, dword [edi + 0x34]
test eax, eax
je 0x533234
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x53324e
mov eax, dword [edi + 0xb8]
test eax, eax
je 0x533247
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x533250
xor eax, eax
test al, al
jne 0x5332fe
mov eax, dword [edi + 0xb8]
test eax, eax
je 0x533267
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x533294
lea eax, [ebp - 0x110]
mov edx, dword [edi + 0xb8]
mov ecx, 0
call fcn.00406cfc
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x101]
call fcn.00413ea4
jmp 0x5332d6
push dword [edi + 0x34]
push 0x533390
push dword [edi + 0x38]
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00407070
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0
call fcn.00406cfc
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x101]
call fcn.00413ea4
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x5332fe
mov ecx, dword [edi + 0xc8]
mov edx, dword [edi + 0xc4]
mov eax, edi
call fcn.00533468
mov ebx, eax
test bl, bl
jne 0x53330b
mov eax, edi
call fcn.00533428
jmp 0x533349
mov eax, dword [edi + 0x58]
test eax, eax
je 0x53331a
mov dword [edi + 0xa0], eax
jmp 0x533324
mov dword [edi + 0xa0], 1
mov eax, edi
call fcn.005334ec
test al, al
je 0x533349
mov eax, edi
mov si, 0xffef
call fcn.004050c0
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.005339d0
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533379
lea eax, [ebp - 0x118]
call fcn.00406a98
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00406140
ret
Function at 0x452040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x1b8
mov dword [esp], esp
mov dword [esp + 4], 0x1b8
call fcn.00451b00
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00451b00
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10247ea
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
call sub.MFC42u.dll_AfxGetModuleState
mov edi, dword [eax + 4]
test edi, edi
je 0x102484c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
jmp 0x1024841
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x102484a
mov eax, dword [edi]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, edi
call dword [eax + 0x60]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
call esi
sub eax, ebx
cmp eax, 0xa
jb 0x102480d
pop esi
pop ebx
pop edi
leave
ret
Function at 0x1037aae
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push esi
push edi
lea edx, [ebp - 0x10]
push edx
xor edi, edi
push edi
push 0x100be20
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x1037b13
cmp word [ebp - 0x10], 3
jne 0x1037b13
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0xec]
jge 0x1037b13
imul eax, eax, 0x98
add eax, dword [esi + 0xf0]
mov eax, dword [eax + 0x78]
cmp eax, edi
je 0x1037b0e
push 1
push edi
push edi
push eax
push 0x1007874
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x1037b13
xor eax, eax
inc eax
jmp 0x1037b51
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x100bdc8
push 0x100bd50
push 0x1ae
push edi
push 0x10019a4
push edi
push 0x100bd08
push 0x3000000
call fcn.0101d7c6
pop ecx
pop ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x1037b5c
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push esi
push edi
lea edx, [ebp - 0x10]
push edx
xor edi, edi
push edi
push 0x100be20
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x1037bc1
cmp word [ebp - 0x10], 3
jne 0x1037bc1
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0xec]
jge 0x1037bc1
imul eax, eax, 0x98
add eax, dword [esi + 0xf0]
mov eax, dword [eax + 0x7c]
cmp eax, edi
je 0x1037bbc
push 1
push edi
push edi
push eax
push 0x1007874
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x1037bc1
xor eax, eax
inc eax
jmp 0x1037bff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x100be68
push 0x100bd50
push 0x1e5
push edi
push 0x10019a4
push edi
push 0x100be2c
push 0x3000000
call fcn.0101d7c6
pop ecx
pop ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x1037c0a
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push esi
push edi
lea edx, [ebp - 0x10]
push edx
xor edi, edi
push edi
push 0x100be20
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x1037c72
cmp word [ebp - 0x10], 3
jne 0x1037c72
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0xec]
jge 0x1037c72
imul eax, eax, 0x98
add eax, dword [esi + 0xf0]
mov eax, dword [eax + 0x80]
cmp eax, edi
je 0x1037c6d
push 1
push edi
push edi
push eax
push 0x1007874
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x1037c72
xor eax, eax
inc eax
jmp 0x1037cb0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x100bef0
push 0x100bd50
push 0x21c
push edi
push 0x10019a4
push edi
push 0x100beb4
push 0x3000000
call fcn.0101d7c6
pop ecx
pop ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x1042958
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x10429c4
cmp dword [ebp + 0xc], ebx
je 0x10429c4
push edi
push 0x20019
push dword [ebp + 8]
call fcn.010428cf
mov edi, eax
cmp edi, ebx
je 0x10429c3
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov dword [ebp - 8], 4
call dword [sym.imp.unbcl.dll_public:_unsigned_short_int_const____thiscall_UnBCL::String::get_CString_void_const]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10429bc
cmp dword [ebp - 0xc], 4
je 0x10429bc
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8
Function at 0x10429d1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x104dc5d
call fcn.010411e8
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.unbcl.dll_public:_void___thiscall_UnBCL::SmartPtr_class_UnBCL::String_::constructor_class_UnBCL::String__]
push 0x20019
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.010428cf
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1042ade
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.unbcl.dll_public:_unsigned_short_int_const____thiscall_UnBCL::String::get_CString_void_const]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp + 8]
call edi
cmp eax, ebx
jne 0x1042ad5
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x1042ad5
cmp dword [ebp - 0x10], 1
je 0x1042a4e
cmp dword [ebp - 0x10], 2
jne 0x1042ad5
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01040e1a
pop ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push ebx
push ebx
mov dword [ebp - 0x18], eax
call esi
push eax
push dword [ebp + 8]
call edi
push 0x10
call dword [sym.imp.unbcl.dll_public:_static_void____stdcall_UnBCL::Object::operator_new_unsigned_int_]
mov esi, eax
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x1042aa0
push dword [ebp - 0x18]
mov ecx, esi
call dword [sym.imp.unbcl.dll_public:_void___thiscall_UnBCL::String::constructor_unsigned_short_int_const__]
mov dword [esi], 0x1001f58
jmp 0x1042aa2
xor esi, esi
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call dword [sym.imp.unbcl.dll_public:_void___thiscall_UnBCL::SmartPtr_class_UnBCL::String_::constructor_class_UnBCL::String__]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call dword [sym.imp.unbcl.dll_public:_class_UnBCL::SmartPtr_class_UnBCL::String_____thiscall_UnBCL::SmartPtr_class_UnBCL::String_::operator_class_UnBCL::SmartPtr_class_UnBCL::String__const__]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call dword [sym.imp.unbcl.dll_public_virtual:_void___thiscall_UnBCL::SmartPtr_class_UnBCL::String_::destructor_void_]
push dword [ebp - 0x18]
call sub.MFC42u.dll_operatordelete
pop ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20]
call dword [sym.imp.unbcl.dll_public:_class_UnBCL::String____thiscall_UnBCL::SmartPtr_class_UnBCL::String_::Steal_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
mov esi, eax
call dword [sym.imp.unbcl.dll_public_virtual:_void___thiscall_UnBCL::SmartPtr_class_UnBCL::String_::destructor_void_]
mov eax, esi
call fcn.010412d4
ret 8
Function at 0x10005c30
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x14], 0x10
push ebx
push esi
push edi
jb 0x10005c41
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0xc], eax
call fcn.10002eb0
movsx ebx, al
call fcn.10002680
movsx ecx, al
imul ebx, ecx
mov dword [ebp - 4], ebx
call fcn.10002ee0
movsx edx, byte [0x10082ab9]
movsx eax, al
mov dword [ebp - 8], eax
lea ecx, [ebx + eax]
lea eax, [ecx + ebx*8]
movsx ecx, byte [0x10082ab8]
add eax, edx
xor edx, edx
div ecx
movsx ecx, byte [0x10082abb]
sub eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007c000]
movsd qword [ebp - 0x14], xmm0
xor eax, eax
je 0x10005cad
add byte [edi], cl
mov esi, 0x82aba05
adc byte [ebx], dh
ror byte [ebx + 0x7d8bfc75], cl
clc
movsx eax, byte [0x10082aba]
xor edx, edx
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
movd xmm1, eax
movsx eax, byte [0x10082abc]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
lea eax, [esi + esi*4]
cvtdq2pd xmm0, xmm0
lea ebx, [edi + eax*2]
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [ebp - 0x14]
movsd qword [ebp - 0x14], xmm1
movsx eax, byte [0x10082ab9]
movsx ecx, byte [0x10082ab8]
add eax, ebx
div ecx
movsx ecx, byte [0x10082abb]
sub eax, ecx
je 0x10005d3c
call fcn.10002ec0
movsx ecx, al
movsx eax, byte [0x10084c20]
imul ecx, eax
lea ecx, [ecx + ecx*8]
call fcn.10002ef0
movsx eax, al
sub ecx, eax
call fcn.10002ed0
movsx eax, al
add eax, ecx
movsx ecx, byte [0x10082abc]
add ecx, eax
jne 0x10005da8
movsx eax, byte [0x10082ab9]
lea ecx, [esi + esi*2]
add eax, edi
xor edx, edx
lea eax, [eax + ecx*2]
movsx ecx, byte [0x10082ab8]
div ecx
movsx ecx, byte [0x10082abb]
sub eax, ecx
je 0x10005da1
movsx eax, byte [0x10082ab9]
xor edx, edx
movsx ecx, byte [0x10082ab8]
add eax, ebx
div ecx
movsx ecx, byte [0x10082abb]
movsd xmm0, qword [ebp - 0x14]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x1007c000]
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
jmp 0x10005da4
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x10005dbf
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x10005dbd
test al, 0x10
jne 0x10005dbd
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret