joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e7502
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
push esi
mov esi, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ecx
push edi
test ecx, ecx
jne 0x100e7545
push 0x1002f6d4
mov edx, 0x1b6
mov ecx, 0x10009bfc
call fcn.100e970f
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x10], edx
mov edi, edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
test eax, eax
je 0x100e75c4
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push edx
push eax
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x100e75ab
cmp esi, 3
je 0x100e75ab
test esi, esi
je 0x100e75a4
jle 0x100e7586
movzx esi, si
or esi, 0x80070000
mov ebx, dword [ebp - 0x14]
push ebx
push 0x10009c20
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100e76c8
mov esi, dword [ebp - 0x10]
xor edx, edx
jmp 0x100e75c7
mov ebx, dword [ebp - 0x14]
test esi, esi
jle 0x100e76c8
movzx esi, si
or esi, 0x80070000
jmp 0x100e76c8
mov dword [ebp - 0x10], esi
lea eax, [ebp - 8]
push eax
push edx
lea eax, [ebp - 0xc]
push eax
push edx
push ebx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x100e75ea
mov esi, 0x80070002
jmp 0x100e76c5
test esi, esi
je 0x100e7604
jle 0x100e75f9
movzx esi, si
or esi, 0x80070000
push ebx
push 0x1002f628
jmp 0x100e76b5
cmp dword [ebp - 0xc], 7
je 0x100e7629
push 0x1002f6e0
push 1
mov esi, 0x8007000d
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100e76c5
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 0x18]
shr ebx, 1
add ebx, 2
mov edx, ebx
call fcn.100a70d5
mov esi, eax
test esi, esi
jns 0x100e765b
push dword [ebp - 0x1c]
push 0x1002f69c
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 0x18]
jmp 0x100e76c2
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
je 0x100e75e0
test esi, esi
je 0x100e7699
jle 0x100e768f
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x1c]
push 0x10009c5c
jmp 0x100e76b5
mov ecx, dword [ebp - 0x20]
xor eax, eax
push ebx
push edi
mov dword [edi + ebx*2 - 4], eax
call fcn.100e24a2
mov esi, eax
test esi, esi
jns 0x100e76c5
push edi
push 0x100287f4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100e76db
cmp dword [ebp - 0x10], 0
je 0x100e76db
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x100e76e9
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
Function at 0x100e7795
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
push esi
push edi
mov edi, edx
test eax, eax
jne 0x100e77d2
push 0x1002f91c
mov edx, 0x471
mov ecx, 0x10009bfc
call fcn.100e970f
xor esi, esi
mov dword [ebp - 8], esi
test edi, edi
je 0x100e7865
test byte [ebp + 8], 2
lea eax, [ebp - 8]
mov edx, edi
je 0x100e7817
push esi
push eax
push ecx
push 2
push esi
push ecx
push ecx
mov ecx, ebx
call fcn.100afc63
test eax, eax
je 0x100e7860
jg 0x100e7803
mov esi, eax
jmp 0x100e780c
movzx esi, ax
or esi, 0x80070000
push edi
push 0x1002f784
jmp 0x100e78a8
push eax
push 2
push esi
mov ecx, ebx
call fcn.100afca4
test byte [ebp + 8], 1
je 0x100e7845
cmp eax, 2
je 0x100e7832
cmp eax, 3
jne 0x100e7845
test eax, eax
jg 0x100e783a
mov esi, eax
jmp 0x100e78b8
movzx esi, ax
or esi, 0x80070000
jmp 0x100e78b8
test eax, eax
je 0x100e7860
jg 0x100e784f
mov esi, eax
jmp 0x100e7858
movzx esi, ax
or esi, 0x80070000
push edi
push 0x1002f7a0
jmp 0x100e78a8
mov ebx, dword [ebp - 8]
jmp 0x100e7868
mov dword [ebp - 8], ebx
push dword [ebp + 0x14]
push dword [ebp - 0x10]
push 3
push esi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test byte [ebp + 8], 1
je 0x100e788d
cmp eax, 2
jne 0x100e788d
mov esi, 0x80070002
jmp 0x100e78b8
test eax, eax
je 0x100e78b8
jg 0x100e7897
mov esi, eax
jmp 0x100e78a0
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0xc]
push 0x1002f7b8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
test edi, edi
je 0x100e78cb
cmp dword [ebp - 8], 0
je 0x100e78cb
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0x10
Function at 0x100e7afc
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
push esi
push edi
mov edi, edx
test eax, eax
jne 0x100e7b39
push 0x1002f91c
mov edx, 0x427
mov ecx, 0x10009bfc
call fcn.100e970f
xor esi, esi
mov dword [ebp - 8], esi
test edi, edi
je 0x100e7bcc
test byte [ebp + 8], 2
lea eax, [ebp - 8]
mov edx, edi
je 0x100e7b7e
push esi
push eax
push ecx
push 2
push esi
push ecx
push ecx
mov ecx, ebx
call fcn.100afc63
test eax, eax
je 0x100e7bc7
jg 0x100e7b6a
mov esi, eax
jmp 0x100e7b73
movzx esi, ax
or esi, 0x80070000
push edi
push 0x1002f784
jmp 0x100e7c0e
push eax
push 2
push esi
mov ecx, ebx
call fcn.100afca4
test byte [ebp + 8], 1
je 0x100e7bac
cmp eax, 2
je 0x100e7b99
cmp eax, 3
jne 0x100e7bac
test eax, eax
jg 0x100e7ba1
mov esi, eax
jmp 0x100e7c1e
movzx esi, ax
or esi, 0x80070000
jmp 0x100e7c1e
test eax, eax
je 0x100e7bc7
jg 0x100e7bb6
mov esi, eax
jmp 0x100e7bbf
movzx esi, ax
or esi, 0x80070000
push edi
push 0x1002f7a0
jmp 0x100e7c0e
mov ebx, dword [ebp - 8]
jmp 0x100e7bcf
mov dword [ebp - 8], ebx
push 8
push dword [ebp - 0x10]
push 0xb
push esi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test byte [ebp + 8], 1
je 0x100e7bf3
cmp eax, 2
jne 0x100e7bf3
mov esi, 0x80070002
jmp 0x100e7c1e
test eax, eax
je 0x100e7c1e
jg 0x100e7bfd
mov esi, eax
jmp 0x100e7c06
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0xc]
push 0x1002f7b8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
test edi, edi
je 0x100e7c31
cmp dword [ebp - 8], 0
je 0x100e7c31
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
Function at 0x100e7c44
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push edi
mov edi, edx
test eax, eax
jne 0x100e7c81
push 0x1002f77c
mov edx, 0x2fd
mov ecx, 0x10009bfc
call fcn.100e970f
xor ecx, ecx
test byte [ebp + 8], 8
push ecx
pop edx
setne dl
mov dword [ebp - 0x18], ecx
inc edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], edx
test edi, edi
je 0x100e7d26
test byte [ebp + 8], 2
lea eax, [ebp - 8]
mov edx, edi
je 0x100e7cd4
push ecx
push eax
push ecx
push 2
push ecx
push ecx
push ecx
mov ecx, ebx
call fcn.100afc63
mov esi, eax
test esi, esi
je 0x100e7d1e
jle 0x100e7cc9
movzx esi, si
or esi, 0x80070000
push edi
push 0x1002f784
jmp 0x100e7d89
push eax
push 2
push ecx
mov ecx, ebx
call fcn.100afca4
test byte [ebp + 8], 1
mov esi, eax
je 0x100e7d07
cmp esi, 2
je 0x100e7cf1
cmp esi, 3
jne 0x100e7d07
test esi, esi
jle 0x100e7d99
movzx esi, si
or esi, 0x80070000
jmp 0x100e7d99
test esi, esi
je 0x100e7d1e
jle 0x100e7d16
movzx esi, si
or esi, 0x80070000
push edi
push 0x1002f7a0
jmp 0x100e7d89
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
jmp 0x100e7d29
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 0xc]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x18]
jne 0x100e7d2f
sub ecx, esi
xor eax, eax
sar ecx, 1
mov esi, eax
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0xc]
xor eax, eax
push edx
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test byte [ebp + 8], 1
je 0x100e7d6e
cmp eax, 2
jne 0x100e7d6e
mov esi, 0x80070002
jmp 0x100e7d99
test eax, eax
je 0x100e7d99
jg 0x100e7d78
mov esi, eax
jmp 0x100e7d81
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0x10]
push 0x1002f7b8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
test edi, edi
je 0x100e7dac
cmp dword [ebp - 8], 0
je 0x100e7dac
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc

Function at 0x100e7fd5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x404]
call fcn.100b7c14
test eax, eax
js 0x100e804c
cmp byte [ebp + 0xc], 0
je 0x100e803f
mov ecx, esi
call fcn.100b7585
push eax
push esi
lea eax, [ebp - 0x404]
push eax
push 0x10009860
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.100e8961
add esp, 0x18
test eax, eax
js 0x100e804c
lea eax, [ebp - 0x804]
jmp 0x100e8045
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100b88c0
leave
ret
Function at 0x100e8627
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x220], eax
xor edx, edx
mov dword [ebp - 0x218], ebx
mov dword [eax], edx
mov edi, edx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], edx
push eax
push 8
push edx
push 0x10030b88
push ecx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x210], 0xff
mov dword [ebp - 0x214], edx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
and ebx, 1
jne 0x100e869e
cmp esi, 2
jne 0x100e869e
mov esi, 0x80070002
jmp 0x100e875a
test esi, esi
je 0x100e86cc
jle 0x100e86ad
movzx esi, si
or esi, 0x80070000
push 0x10030b88
push 0x10030c10
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100e875a
xor ecx, ecx
lea eax, [ebp - 0x210]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
jmp 0x100e872c
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x214]
push eax
push 0x10030c28
push 1
lea edx, [ebp - 0x204]
call fcn.100b53d5
mov esi, eax
test esi, esi
jns 0x100e87a7
inc edi
mov dword [ebp - 0x210], 0xff
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x100e86e3
mov esi, 0x80070490
test ebx, ebx
jne 0x100e875a
push 0x10030c78
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [ebp - 0x214]
call fcn.100b61be
cmp dword [ebp - 0x208], 0
je 0x100e8780
push dword [ebp - 0x208]
call fcn.100b8161
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x20c], 0
je 0x100e8794
push dword [ebp - 0x20c]
call fcn.100b8161
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 8
test byte [ebp - 0x218], 0x20
je 0x100e8813
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x208], 0
je 0x100e87c1
int3
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0x20006
push 4
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x100e885d
jg 0x100e87f9
mov esi, eax
jmp 0x100e8802
movzx esi, ax
or esi, 0x80070000
lea eax, [ebp - 0x204]
push eax
push 0x10030c4c
jmp 0x100e86b7
cmp dword [ebp - 0x208], 0
je 0x100e881d
int3
lea eax, [ebp - 0x208]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x100e885d
jg 0x100e8848
mov esi, eax
jmp 0x100e8851
movzx esi, ax
or esi, 0x80070000
lea eax, [ebp - 0x204]
push eax
jmp 0x100e86b2
mov ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x208]
and dword [ebp - 0x208], 0
mov dword [ecx], eax
jmp 0x100e875a
Function at 0x100e970f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101dca20], 0
mov eax, dword [ebp + 8]
jne 0x100e97d9
mov dword [0x101dca20], 1
test eax, eax
je 0x100e9760
push eax
push edx
push ecx
push 0x10009d14
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.100e8961
add esp, 0x18
jmp 0x100e977b
push edx
push ecx
push 0x10009d34
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.100e8961
add esp, 0x14
test eax, eax
js 0x100e97ab
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
lea eax, [ebp - 0x404]
push eax
push 0x10009d50
push 0
push 0
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100e97cc
push 0x10009d5c
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
push 0x10009d7c
push 0
push 0
push 0x4000000
call fcn.100ab973
add esp, 0x10
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_DebugBreak]
and dword [0x101dca20], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b88c0
leave
ret 4
Function at 0x100eafe5
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
mov edi, 0x10000000
test esi, esi
jne 0x100eb000
mov esi, edi
not esi
push esi
push edi
mov edx, esi
mov ecx, edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
push esi
push edi
push 0x40
pop edx
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov eax, 0x5a4d
cmp word [0x10000000], ax
jne 0x100eb252
mov eax, dword [0x1000003c]
cmp eax, esi
jae 0x100eb252
push esi
lea ecx, [eax + 0x10000000]
mov edx, pe_nt_image_headers32
push edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
cmp dword [ecx], 0x4550
jne 0x100eb252
movzx eax, word [ecx + 0x14]
cmp eax, esi
jae 0x100eb252
add ecx, 0x18
mov edi, 0x10b
movzx edx, word [ecx]
cmp dx, di
jne 0x100eb0b0
cmp eax, 0x60
jb 0x100eb252
push esi
mov edi, 0x10000000
mov edx, 0xe0
push edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov eax, dword [ecx + 0x5c]
add ecx, 0x70
jmp 0x100eb0e6
mov edi, 0x20b
cmp dx, di
jne 0x100eb252
cmp eax, 0x70
jb 0x100eb252
push esi
mov edi, 0x10000000
mov edx, 0xf0
push edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov eax, dword [ecx + 0x6c]
sub ecx, 0xffffff80
cmp eax, 2
jbe 0x100eb252
mov eax, dword [ecx]
mov dword [ebp - 8], eax
test eax, eax
je 0x100eb252
mov edx, dword [ecx + 4]
test edx, edx
je 0x100eb252
lea ecx, [eax + 0x10000000]
test ecx, ecx
je 0x100eb252
push esi
push edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
push 0x10
pop eax
cmp edx, eax
jb 0x100eb252
movzx edi, word [ecx + 0xe]
test edi, edi
je 0x100eb252
movzx eax, word [ecx + 0xc]
lea ecx, [ecx + eax*8]
mov eax, ebx
add ecx, 0x10
mov dword [ebp - 4], eax
test edi, edi
je 0x100eb17c
push esi
push 0x10000000
push 8
pop edx
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov eax, dword [ebp - 4]
push 0x10
pop edx
cmp word [ecx], dx
je 0x100eb17f
add ecx, 8
inc eax
mov dword [ebp - 4], eax
cmp eax, edi
jb 0x100eb14e
jmp 0x100eb17f
push 0x10
pop edx
cmp eax, edi
je 0x100eb252
mov edi, dword [ecx + 4]
test edi, edi
jns 0x100eb22a
mov ecx, dword [ebp - 8]
and edi, 0x7fffffff
push esi
push 0x10000000
lea eax, [ecx + 0x10000000]
add edi, eax
mov ecx, edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
cmp word [edi + 0xe], bx
jne 0x100eb1c8
cmp word [edi + 0xc], bx
je 0x100eb252
push esi
push 0x10000000
push 8
lea ecx, [edi + 0x10]
pop edx
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov edi, dword [ecx + 4]
test edi, edi
jns 0x100eb22a
mov ecx, dword [ebp - 8]
and edi, 0x7fffffff
push esi
push 0x10000000
push 0x10
lea eax, [ecx + 0x10000000]
add edi, eax
pop edx
mov ecx, edi
call fcn.100eaed9
test eax, eax
je 0x100eb252
cmp word [edi + 0xe], bx
jne 0x100eb215
cmp word [edi + 0xc], bx
je 0x100eb252
push esi
push 0x10000000
push 8
lea ecx, [edi + 0x10]
pop edx
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov edi, dword [ebp - 8]
mov ecx, dword [ecx + 4]
push esi
push 0x10000000
lea eax, [edi + 0x10000000]
push 0x10
add ecx, eax
pop edx
call fcn.100eaed9
test eax, eax
je 0x100eb252
mov eax, dword [ecx]
lea ebx, [eax + 0x10000000]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x100eb60e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor ebx, ebx
mov edi, edx
push ecx
mov esi, ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100eb63c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100eb649
movzx esi, si
or esi, 0x80070000
jmp 0x100eb649
test al, 0x10
jne 0x100eb647
mov esi, 0x8007010b
jmp 0x100eb649
mov bl, 1
test edi, edi
je 0x100eb64f
mov dword [edi], esi
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x100eb655
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
xor esi, esi
mov dword [ebp - 0x148], edx
lea eax, [ebp - 0x48]
mov ebx, ecx
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push pe_nt_image_headers32
lea eax, [ebp - 0x140]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x18
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [ebp - 0x144], eax
cmp eax, 0xffffffff
jne 0x100eb6f3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100eb6d1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100eb6d8
mov esi, 0x80004005
push ebx
push 0x10031270
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100eb858
push esi
lea ecx, [ebp - 8]
push ecx
push 0x40
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x100eb742
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100eb720
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100eb727
mov esi, 0x80004005
push ebx
push 0x10031288
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100eb84c
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
je 0x100eb75f
push ebx
push 0x100312b0
mov edi, 0x8007000b
push 1
mov esi, edi
push edi
jmp 0x100eb730
mov edi, dword [ebp - 0x144]
push esi
push esi
push dword [ebp - 0xc]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100eb79c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100eb78d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100eb794
mov esi, 0x80004005
push ebx
push 0x100312d8
jmp 0x100eb72d
push esi
lea eax, [ebp - 8]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x100eb7e1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100eb7cf
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100eb7d6
mov esi, 0x80004005
push ebx
push 0x10031304
jmp 0x100eb72d
cmp dword [ebp - 0x140], 0x4550
je 0x100eb7f8
push ebx
push 0x1003132c
jmp 0x100eb753
movzx ecx, word [ebp - 0xe4]
mov eax, ecx
sub eax, 1
je 0x100eb83c
sub eax, 1
je 0x100eb83c
sub eax, 1
je 0x100eb83c
dec eax
sub eax, 1
je 0x100eb81c
dec eax
sub eax, 1
jne 0x100eb83c
push ebx
push ecx
push 0x10031354
push 1
mov edi, 0x8007000b
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x18
mov esi, edi
jmp 0x100eb84c
mov ecx, dword [ebp - 0x148]
mov ax, word [ebp - 0x13c]
mov word [ecx], ax
push dword [ebp - 0x144]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
Function at 0x100eba34
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov edi, ecx
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edx
push eax
xor esi, esi
push edi
push 1
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoSizeExW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x100ebaab
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100eba89
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100eba90
mov esi, 0x80004005
push edi
push 0x100311ec
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ebb7d
push ebx
push eax
push esi
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x100ebada
push edi
push 0x10031214
push 1
mov esi, 0x8007000e
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ebb7c
push ebx
push dword [ebp - 0x14]
push dword [ebp - 8]
push edi
push 3
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoExW]
test eax, eax
jne 0x100ebb24
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100ebb05
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100ebb0c
mov esi, 0x80004005
push edi
push 0x100311ec
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ebb75
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10008980
push ebx
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
jne 0x100ebb62
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100ebb53
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100ebb5a
mov esi, 0x80004005
push edi
push 0x10031244
jmp 0x100ebb12
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_GlobalFree]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100b88c0
leave
ret 4