joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a0794
Capabilities:
Set registry value

Disassembly:
push 0x16c
mov eax, 0x2e9812
call fcn.002c1285
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x58]
mov esi, dword [ebp + 0xc]
push edi
call fcn.0029f391
and dword [ebp - 4], 0
cmp dword [ebp - 0x48], 0
je 0x2a07f0
push 1
lea eax, [ebp - 0x58]
push eax
push ebx
lea ecx, [ebp - 0x94]
call fcn.0029f4e0
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.002a0794
lea ecx, [ebp - 0x94]
call fcn.0029f649
jmp 0x2a0884
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a07fa
mov edx, dword [esi]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x2a0804
mov ecx, dword [edi]
mov eax, dword [esi + 0x10]
inc eax
push eax
push edx
push 1
push 0
push ecx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xd4], eax
test eax, eax
jne 0x2a089c
push eax
call fcn.00298a5b
mov ecx, eax
call fcn.00298cc4
test al, al
je 0x2a0884
push edi
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.0029f9e2
push 0
push esi
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.0029f226
add esp, 0x10
push eax
push str.Registry::setString
push 0x193
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_Registry.cpp
push 0
mov byte [ebp - 4], 8
call fcn.00298a5b
mov ecx, eax
call fcn.00298cd0
lea ecx, [ebp - 0x28]
call fcn.00288398
lea ecx, [ebp - 0x70]
call fcn.00288398
lea ecx, [ebp - 0x40]
call fcn.00288398
lea ecx, [ebp - 0x58]
call fcn.00288398
call fcn.002c1234
ret 8
push str.set_string_value
lea ecx, [ebp - 0x28]
call fcn.00282f12
lea ecx, [ebp - 0xd0]
call fcn.00282f63
push eax
push edi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
mov ecx, ebx
push eax
call fcn.0029fa12
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 4
call fcn.002998a2
push str.System_error
push dword [ebp - 0xd4]
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 5
push dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0xe0]
push eax
call fcn.002ad244
mov esi, eax
push 0x190
push str.Registry::setString
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.00283093
push eax
lea eax, [ebp - 0xb8]
push esi
push eax
call fcn.0029a69e
add esp, 0xc
lea eax, [ebp - 0xb8]
push 0x30bc80
push eax
call fcn.002c300d
int3
Function at 0x2a8116
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x10c
mov eax, 0x2ea9b9
call fcn.002c1285
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
call fcn.002a805f
mov ebx, eax
test ebx, ebx
je 0x2a8203
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [esi + 0x38]
call edi
test eax, eax
jne 0x2a81b9
push str.cannot_load_resource
lea ecx, [ebp - 0x28]
call fcn.00282f12
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.002a807d
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
call fcn.002998a2
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x80]
call fcn.002ad244
mov esi, eax
push 0x46
push str.Resource::getPtr
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x74]
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_Resources.cpp
jmp 0x2a826d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x34], 6
mov edi, eax
jne 0x2a81ea
mov edx, dword [esi + 0x18]
mov ecx, edi
and edx, 0xf
jbe 0x2a81e0
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub edx, 1
jne 0x2a81d2
movzx eax, word [ecx]
lea edi, [ecx + 2]
add eax, eax
jmp 0x2a81f4
push ebx
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, edi
call fcn.002c1234
ret 4
push str.cannot_find_resource
lea ecx, [ebp - 0x28]
call fcn.00282f12
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.002a807d
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.002998a2
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x74]
call fcn.002ad244
mov esi, eax
push 0x41
push str.Resource::getPtr
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x80]
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_Resources.cpp
call fcn.00283093
push eax
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.0029a69e
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x30bc80
push eax
call fcn.002c300d
int3
Function at 0x2a8e91
Capabilities:
Check http status code

Disassembly:
push 0x80
mov eax, 0x2eab34
call fcn.002c1285
mov edi, ecx
push 0xffffffffffffffff
push 0x13
call fcn.002aa958
mov esi, eax
cmp esi, 0xc8
je 0x2a8f5b
cmp esi, 0xce
je 0x2a8f5b
cmp esi, 0x193
jne 0x2a8f1a
push 0x2efb0e
lea ecx, [ebp - 0x28]
call fcn.00282f12
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
push 0x14
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.002aacba
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00288398
push 0
push str.Export_Denied
lea ecx, [ebp - 0x40]
call fcn.0029cb3b
cmp eax, 0xffffffff
jne 0x2a8f61
or dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
call fcn.002835ff
push esi
lea ecx, [ebp - 0x8c]
call fcn.002a8b5f
mov esi, eax
push 0x2ce
push str.HttpConnection::Response::checkStatus
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_NetUtils.cpp
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 4
call fcn.00283093
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.002a85c4
add esp, 0xc
push 0x30e4a4
jmp 0x2a8f9c
call fcn.002c1234
ret
lea ecx, [ebp - 0x8c]
call fcn.002a8b21
mov esi, eax
push 0x2cb
push str.HttpConnection::Response::checkStatus
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_NetUtils.cpp
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.00283093
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.002a85ad
add esp, 0xc
push 0x30e504
lea eax, [ebp - 0x6c]
push eax
call fcn.002c300d
int3
Function at 0x2a9bfa
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x314334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x58]
push edi
mov edi, dword [ebp + 8]
push 0x3c
pop ebx
push ebx
push 0
push eax
call fcn.002c2bc0
mov dword [ebp - 0x58], ebx
add esp, 0xc
xor ebx, ebx
inc ebx
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x44], ebx
jb 0x2a9c36
mov edi, dword [edi]
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x2a9c4d
xor al, al
jmp 0x2a9c8b
mov eax, dword [ebp - 0x4c]
push 3
pop ecx
sub eax, ecx
je 0x2a9c64
sub eax, 1
je 0x2a9c60
mov dword [esi], ebx
jmp 0x2a9c6a
mov dword [esi], ecx
jmp 0x2a9c6a
mov dword [esi], 2
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x48]
call fcn.00282f3f
push eax
lea ecx, [esi + 4]
call fcn.0028c3e5
lea ecx, [ebp - 0x1c]
call fcn.00288398
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.002c1212
leave
ret
Function at 0x2ab316
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x6c
mov eax, 0x2eb1bb
call fcn.002c1285
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x58]
and dword [ebp - 0x58], 0
push edx
push dword [ebp + 0xc]
push eax
push dword [ecx + 0x10]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x2ab349
mov eax, dword [ebp - 0x58]
call fcn.002c1234
ret 8
push str.InternetReadFile_failed
lea ecx, [ebp - 0x28]
call fcn.00282f12
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2c9
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.002a8be1
mov esi, eax
push 0x2eb
push str.HttpConnection::Response::readContent
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_NetUtils.cpp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00283093
push eax
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.002a85db
add esp, 0xc
lea eax, [ebp - 0x54]
push 0x30e388
push eax
call fcn.002c300d
int3

Function at 0x2ab93d
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x2eb2a9
call fcn.002c1252
xor eax, eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
push esi
call fcn.002aba31
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push esi
call fcn.002aba31
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
push ecx
push esi
call fcn.002aba31
push 0x409
push esi
call fcn.002aba31
add esp, 0x10
mov eax, esi
call fcn.002c1220
ret
Function at 0x2acad5
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x2eb4e5
call fcn.002c1285
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00287f6a
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], ebx
jb 0x2acb1e
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x2acbe4
lea ecx, [ebp - 0x35]
push ecx
push eax
mov ecx, edi
call fcn.00296934
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x2acb4b
mov ecx, dword [esi]
push dword [edi]
push eax
push dword [ebp - 0x3c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x2acbda
push 0x487
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.00283093
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push sub.VERSION.dll_GetFileVersionInfoA
push 0x2f2a78
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00282ef6
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.00283205
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.00282760
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0028adeb
mov ecx, eax
call fcn.00282760
push eax
lea ecx, [ebp - 0x50]
call fcn.002ad244
mov byte [ebp - 4], 9
jmp 0x2acc5e
mov eax, esi
call fcn.002c1234
ret 4
push 0x47e
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.00283093
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push sub.VERSION.dll_GetFileVersionInfoSizeA
push 0x2f2a78
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00282ef6
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.00283205
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.00282760
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0028adeb
mov ecx, eax
call fcn.00282760
push eax
lea ecx, [ebp - 0x5c]
call fcn.002ad244
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0029a69e
add esp, 0xc
lea eax, [ebp - 0x34]
push 0x30bc80
push eax
call fcn.002c300d
int3

Function at 0x2ad0ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0x10
jb 0x2ad0fb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x2ad10e
test al, 0x10
je 0x2ad10e
mov al, 1
ret
xor al, al
ret
Function at 0x2ad111
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0x10
jb 0x2ad11d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret
Function at 0x2afe53
Capabilities:
Check mutex on windows

Disassembly:
push 0xa0
mov eax, 0x2ebe6d
call fcn.002c1252
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2aff13
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x2aff0b
push 1
call fcn.00298a5b
mov ecx, eax
call fcn.00298cc4
test al, al
je 0x2aff0b
push 1
lea ecx, [ebp - 0xac]
call fcn.00282e2f
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 1
push str.finish_waiting_for_mutex:
push eax
call fcn.00282775
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0xac]
call fcn.0028c44b
lea eax, [ebp - 0xac]
push eax
push str.msi::waitForInstallationCompletion
push 0x1c8
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_MsiUtils.cpp
push 1
call fcn.00298a5b
mov ecx, eax
call fcn.0028f32d
lea ecx, [ebp - 0xac]
call fcn.00283921
cmp edi, 0x102
je 0x2aff15
mov bl, 1
push esi
mov dword [ebp - 4], 3
call fcn.002ad7c4
pop ecx
mov al, bl
call fcn.002c1220
ret
Function at 0x2b287e
Capabilities:
Write file on windows

Disassembly:
push 0xd4
mov eax, 0x2ec687
call fcn.002c1285
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xe0]
xor ebx, ebx
call fcn.002b9370
push dword [esi + 4]
lea eax, [ebp - 0xe0]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], 1
mov dword [ebp - 0x2c], eax
call fcn.002b7ec7
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00288e47
push edi
mov byte [ebp - 4], 1
call fcn.002b8d74
pop ecx
cmp dword [ebp - 0x18], ebx
jne 0x2b28ef
mov esi, 0x2f19bc
push esi
call fcn.002c6bc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00288475
push 0x2fb450
push 0x2f6310
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.002b9042
add esp, 0x10
mov cl, byte [eax + 4]
mov edx, dword [eax]
mov byte [eax + 4], bl
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x34], cl
cmp byte [ebp - 0x3c], 0
mov byte [ebp - 4], 3
je 0x2b292d
push dword [ebp - 0x40]
mov byte [ebp - 0x3c], bl
call fcn.002e5e11
mov edx, dword [ebp - 0x38]
pop ecx
mov byte [ebp - 4], 2
test edx, edx
jne 0x2b29a8
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.002b8d32
pop ecx
pop ecx
mov bl, byte [eax + 4]
mov esi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], bl
cmp byte [ebp - 0x2c], 0
mov byte [ebp - 4], 5
je 0x2b2967
push dword [ebp - 0x30]
mov byte [ebp - 0x2c], 0
call fcn.002e5e05
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x132
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
push esi
call fcn.002cdc8f
add esp, 0xc
push eax
call fcn.002b2539
add esp, 0xc
mov byte [ebp - 4], 6
test bl, bl
je 0x2b2a21
push esi
call fcn.002e5e05
jmp 0x2b2a20
lea eax, [ebp - 0x38]
push eax
push 0x2f6314
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.002b9077
add esp, 0x10
mov bl, byte [eax + 4]
mov esi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], bl
cmp byte [ebp - 0x2c], 0
mov byte [ebp - 4], 9
je 0x2b29e4
push dword [ebp - 0x30]
mov byte [ebp - 0x2c], 0
call fcn.002e5e11
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
mov byte [ebp - 4], 8
push eax
call fcn.002cb704
push dword [ebp - 0x34]
push 0x132
push eax
push 1
call fcn.002b24ec
add esp, 0x20
mov byte [ebp - 4], 0xa
test bl, bl
je 0x2b2a21
push esi
call fcn.002e5e11
pop ecx
cmp byte [ebp - 0x34], 0
mov byte [ebp - 4], 0xb
je 0x2b2a38
push dword [ebp - 0x38]
mov byte [ebp - 0x34], 0
call fcn.002e5e11
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00288398
lea ecx, [ebp - 0xd8]
call fcn.00283921
call fcn.002c1234
ret 4

Function at 0x2b86fa
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
add eax, 0x18
cmp dword [eax + 0x14], 8
jb 0x2b8709
mov eax, dword [eax]
push eax
call fcn.002d272a
pop ecx
ret
Function at 0x2b982d
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x2ed6e0
call fcn.002c1252
push 0x2f6d84
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
call fcn.002b8ffd
add esp, 0xc
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [ebp - 0xd], cl
mov byte [eax + 4], bl
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], cl
xor esi, esi
inc esi
mov dword [ebp - 4], esi
cmp byte [ebp - 0x1c], bl
je 0x2b9877
push dword [ebp - 0x20]
mov byte [ebp - 0x1c], bl
call fcn.002e5e11
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xe]
mov byte [ebp - 4], 2
push eax
push 0x100001
lea ecx, [ebp - 0x24]
call fcn.00296934
push edi
push 0x100000
push esi
mov esi, dword [ebp - 0x24]
push esi
call fcn.002cb07d
mov ebx, eax
add esp, 0x10
cmp ebx, 0x100000
ja 0x2b9948
push edi
call fcn.002d3273
pop ecx
test eax, eax
je 0x2b98cb
push 0x133
jmp 0x2b994d
push edi
call fcn.002d3247
pop ecx
test eax, eax
jne 0x2b98dd
push 0x13b
jmp 0x2b994d
push ebx
push esi
call fcn.002ba0b4
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xe]
push eax
lea eax, [esi + ebx]
push eax
push esi
call fcn.00296905
test esi, esi
je 0x2b992b
mov eax, dword [ebp - 0x1c]
sub eax, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x2b9922
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00287e86
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
pop ecx
pop ecx
push eax
push esi
call fcn.002c0da8
pop ecx
pop ecx
cmp byte [ebp - 0xd], 0
mov dword [ebp - 4], 3
je 0x2b993f
push edi
call fcn.002e5e11
pop ecx
mov eax, dword [ebp + 8]
call fcn.002c1220
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.002904a2
push 0x30a1c8
lea eax, [ebp - 0x38]
push eax
call fcn.002c300d
int3

Function at 0x2ba0ef
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x2ed853
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, dword [0x314334]
xor eax, ebp
mov dword [ebp + 0x238], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x244]
lea eax, [ebp + 0x30]
push eax
xor edi, edi
mov dword [ebp - 0x10], esi
push edi
push edi
push 0x2c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [ebp - 0x10]
push 0xc8
push eax
push edi
call fcn.002b24ec
add esp, 0x10
lea eax, [ebp + 0x30]
lea ecx, [ebp]
push eax
call fcn.002981e7
push dword [0x3142d0]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.002add48
push eax
push esi
mov byte [ebp - 4], 1
call fcn.002b8711
add esp, 0x14
lea ecx, [ebp + 0x18]
call fcn.002883be
lea ecx, [ebp]
call fcn.002883be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.002c1212
add ebp, 0x23c
leave
ret
Function at 0x2bd048
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, 0x7fffffff
push edi
mov edi, dword [esp + 0x24]
test edi, edi
jl 0x2bd0cc
jg 0x2bd075
test esi, esi
je 0x2bd0cc
test edi, edi
jg 0x2bd075
jl 0x2bd071
cmp esi, ebp
jae 0x2bd075
mov eax, esi
jmp 0x2bd077
mov eax, ebp
and dword [esp + 0x1c], 0
cmp dword [esp + 0x14], 0xffffffff
je 0x2bd0bd
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x2bd0a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x2bd0c7
jmp 0x2bd0bd
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x2bd0b8
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x2bd05d
cmp eax, 0xffffffff
jne 0x2bd0c7
call fcn.002c65e9
cmp dword [eax], 4
je 0x2bd05d
or eax, 0xffffffff
jmp 0x2bd0ce
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x2bf104
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x2f7df0]
sub edx, 1
jne 0x2bf10b
ret

Function at 0x2c1d45
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x2c1d84
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x2c1d84
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x2c1d84
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x2c1d84
cmp dword [ecx + 0x74], 0xe
jbe 0x2c1d84
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x2da2e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.002da15a

Function at 0x2e00a8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.002dfd25

Function at 0x2e5f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x2e5f6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x2e5f6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1002f60
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x10137f5
call fcn.010136d0
sub esp, 0x224
mov eax, dword [0x10171b0]
push esi
push edi
push 0xfa1
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
cmp eax, edi
je 0x1002fd7
cmp dword [esi], edi
jne 0x10030db
push 0x34
call fcn.010121c1
pop ecx
mov dword [ebp - 0x22c], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x1002fb8
push 3
mov ecx, eax
call fcn.01009f06
jmp 0x1002fba
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi], eax
je 0x1002fd7
push eax
call fcn.01009f2a
test eax, eax
jge 0x1002fde
push dword [esi]
call fcn.0100b047
mov dword [esi], edi
xor eax, eax
jmp 0x10030de
push 0x20019
call sym.mobsync.dll_RegGetHandlerTopLevelKey
cmp eax, edi
mov dword [ebp - 0x22c], eax
je 0x1003079
push ebx
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x228]
push ecx
push edi
mov dword [ebp - 0x230], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
jmp 0x1003064
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x100304a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call fcn.01009f58
test eax, eax
jne 0x100304a
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
push dword [esi]
call fcn.0100ac06
inc dword [ebp - 0x230]
push ebx
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x1003014
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
pop ebx
lea eax, [ebp + 8]
push eax
push 3
push dword [esi]
call fcn.0100abc8
jmp 0x10030aa
push edi
push edi
push 0x100
push edi
push dword [ebp + 8]
push dword [esi]
call fcn.0100aca0
lea eax, [ebp + 8]
push eax
push 3
push dword [ebp + 8]
push dword [esi]
call fcn.0100a217
test eax, eax
je 0x1003088
lea eax, [ebp + 8]
push eax
push 5
push dword [esi]
call fcn.0100abc8
jmp 0x10030d7
push dword [ebp + 8]
push dword [esi]
call fcn.0100b069
lea eax, [ebp + 8]
push eax
push 5
push dword [ebp + 8]
push dword [esi]
call fcn.0100a217
test eax, eax
je 0x10030bd
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.010120e7
leave
ret 8