joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003523
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x650
mov eax, dword [0x1009020]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x608], eax
movzx eax, word [ebp + 0xc]
push edi
lea ebx, [eax + eax]
push ebx
push 0x40
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x60c], 1
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x610], eax
jne 0x1003578
xor eax, eax
jmp 0x100376d
push edi
push edi
push 0x22
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call esi
push edi
lea eax, [ebp - 0x634]
push eax
push ebx
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.KERNEL32.dll_ReadFile]
dec ebx
push ebx
push dword [ebp - 0x608]
call fcn.01006ac8
movzx eax, word [ebp + 0xc]
cmp eax, edi
mov dword [ebp - 0x608], edi
jbe 0x100375b
mov ebx, dword [ebp - 0x608]
push ebx
call fcn.01006771
mov eax, dword [ebp - 0x610]
mov word [ebp - 0x204], di
mov word [ebp - 0x604], di
mov word [ebp - 0x404], di
mov word [ebp - 0x62c], di
mov ax, word [eax + ebx*2]
cmp ax, di
je 0x10036c5
cmp ax, word [ebp + 0x10]
ja 0x100366b
mov ebx, dword [ebp - 0x614]
push edi
movzx eax, ax
push edi
push eax
push ebx
call esi
push edi
lea eax, [ebp - 0x618]
push eax
push 0x18
lea eax, [ebp - 0x630]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x618], 0x18
jne 0x100366b
push dword [ebp + 0x10]
lea eax, [ebp - 0x630]
push eax
call fcn.0100324d
test eax, eax
je 0x100366b
movzx eax, word [ebp - 0x61e]
push edi
push edi
push eax
push ebx
call esi
push ebx
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.010067d8
cmp word [ebp - 0x204], di
jne 0x1003673
mov dword [ebp - 0x60c], edi
jmp 0x10036c5
movzx eax, word [ebp - 0x61c]
push edi
push edi
push eax
push ebx
call esi
push ebx
push 0x100
lea eax, [ebp - 0x604]
push eax
call fcn.010067d8
cmp word [ebp - 0x61a], 0xffff
je 0x10036be
movzx eax, word [ebp - 0x61a]
push edi
push edi
push eax
push ebx
call esi
push ebx
push 0x100
lea eax, [ebp - 0x404]
push eax
call fcn.010067d8
jmp 0x10036c5
mov word [ebp - 0x404], di
lea eax, [ebp - 0x650]
push eax
call fcn.010034f3
cmp word [ebp - 0x204], di
je 0x100372c
push edi
push edi
lea eax, [ebp - 0x204]
push eax
call fcn.010030ac
mov ebx, dword [sym.imp.COMCTL32.dll_Str_SetPtrW]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x650]
push eax
call ebx
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x648]
push eax
call ebx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x644]
push eax
call ebx
mov ax, word [ebp - 0x62c]
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0x608]
push dword [0x1009270]
call dword [sym.imp.COMCTL32.dll_DSA_InsertItem]
movzx eax, word [ebp + 0xc]
inc dword [ebp - 0x608]
cmp dword [ebp - 0x608], eax
jb 0x10035bf
push dword [ebp - 0x610]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x60c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100815d
leave
ret 0x14
Function at 0x1003b15
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x1009020]
and dword [ebp - 0x66c], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x414]
push eax
call fcn.0100237d
test eax, eax
je 0x1003c9c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, 0x400
mov ebx, 0x1001940
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x668], eax
je 0x1003baa
lea ecx, [ebp - 0x414]
push ecx
mov ecx, esi
shr ecx, 1
push ecx
push eax
push 0x1001974
push 0
push ebx
call edi
lea ecx, [esi - 5]
cmp eax, ecx
jb 0x1003bb1
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esi, 0x400
cmp esi, 0x2000
jb 0x1003b5f
xor eax, eax
jmp 0x1003c99
cmp dword [ebp + 0xc], 0
je 0x1003bbc
call fcn.010066d4
mov esi, dword [ebp - 0x668]
jmp 0x1003c53
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1001974
push esi
push ebx
call edi
cmp word [ebp - 0x20c], 0
je 0x1003c48
cmp dword [ebp + 0x10], 0
je 0x1003c03
lea eax, [ebp - 0x20c]
push eax
call fcn.01003ab4
test eax, eax
je 0x1003c48
lea eax, [ebp - 0x20c]
push eax
call dword [ebp - 0x670]
inc dword [ebp - 0x66c]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x1003c48
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x650]
lea eax, [ebp - 0x20c]
push eax
call fcn.01003a5c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x1003bc7
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x678]
lea eax, [ebp - 0x414]
push eax
call fcn.01003a5c
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0xc], 0
je 0x1003c93
call fcn.010066e4
mov eax, dword [ebp - 0x66c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0100815d
leave
ret 0xc
Function at 0x1003cfa
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1009020]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01003cad
test eax, eax
je 0x1003dff
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, 0x400
mov ebx, 0x1001940
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x418], eax
je 0x1003dfc
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, esi
shr ecx, 1
push ecx
push eax
push 0x1001974
push 0
push ebx
call edi
lea ecx, [esi - 5]
cmp eax, ecx
jb 0x1003d8e
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esi, 0x400
cmp esi, 0x2000
jb 0x1003d3d
jmp 0x1003dfc
cmp dword [ebp + 0xc], 0
je 0x1003d99
call fcn.010066d4
mov esi, dword [ebp - 0x418]
jmp 0x1003ddf
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x1001974
push esi
push ebx
call edi
cmp word [ebp - 0x414], 0
je 0x1003dd4
lea eax, [ebp - 0x414]
push eax
call dword [ebp - 0x41c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x1003da1
cmp dword [ebp + 0xc], 0
je 0x1003df0
call fcn.010066e4
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0100815d
leave
ret 8

Function at 0x1003e10
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push edi
lea eax, [ebp - 8]
push eax
push 0xb
xor edi, edi
push edi
call esi
test eax, eax
je 0x1003e5d
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
test eax, eax
mov esi, dword [sym.imp.SHELL32.dll_ILFree]
je 0x1003e58
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_ILIsParent]
test eax, eax
je 0x1003e53
inc edi
push dword [ebp - 4]
call esi
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1004673
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x1009020]
mov dword [ebp - 4], eax
mov eax, dword [0x100926c]
push edi
mov edi, dword [eax]
test edi, edi
je 0x1004763
and word [ebp - 0x20c], 0
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x10015d8
push 0x10015c4
push 0x80000002
call fcn.01006926
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x10015f0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xa30], eax
je 0x1004763
push esi
xor esi, esi
test edi, edi
jle 0x1004756
push esi
push dword [0x100926c]
call dword [sym.imp.COMCTL32.dll_DSA_GetItemPtr]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
push 0x10017e8
lea eax, [ebp - 0xa2c]
push 0x410
push eax
call fcn.01004645
add esp, 0x20
push 0
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0xa2c]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
cmp esi, edi
jl 0x10046ed
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.0100815d
leave
ret
Function at 0x1004bbb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x1009020]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x80000000
push eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x88], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x84], ebx
je 0x1004d64
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [ebp - 0x8c]
push eax
push 0x22
lea eax, [ebp - 0xb4]
push eax
push ebx
call edi
cmp dword [ebp - 0xb4], 0x43434d50
je 0x1004cb6
cmp dword [ebp - 0xb4], 0x43554d50
jne 0x1004d57
push esi
push esi
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
push esi
lea eax, [ebp - 0x8c]
push eax
push 0x3c
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x84]
call edi
push 2
push esi
push esi
push dword [ebp - 0x84]
call ebx
cmp dword [ebp - 0x3c], eax
ja 0x1004d57
push esi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x84]
call ebx
push esi
lea eax, [ebp - 0x8c]
push eax
push 0x3e
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x84]
call edi
lea eax, [ebp - 0x80]
push eax
push 0x1f
push dword [ebp - 0x88]
call fcn.0100252f
push 2
pop esi
jmp 0x1004d57
push 2
push esi
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call ebx
cmp word [ebp - 0xae], ax
ja 0x1004d57
cmp word [ebp - 0x9e], si
jne 0x1004d15
push dword [ebp - 0x90]
mov ebx, dword [ebp - 0x88]
call sub.SHELL32.dll_Ordinal_34
push dword [ebp - 0x90]
mov edi, eax
call dword [sym.imp.SHELL32.dll_Ordinal_31]
cmp edi, esi
je 0x1004d10
cmp eax, esi
je 0x1004d10
cmp edi, eax
je 0x1004d10
mov cx, word [edi]
mov word [ebx], cx
inc ebx
inc ebx
inc edi
inc edi
jne 0x1004cfc
mov word [ebx], si
jmp 0x1004d54
movzx eax, word [ebp - 0x9e]
push esi
push esi
push eax
push dword [ebp - 0x84]
call ebx
push esi
lea eax, [ebp - 0x8c]
push eax
push 0x1f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x84]
call edi
push 0x1f
push dword [ebp - 0x88]
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor esi, esi
inc esi
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0100815d
leave
ret 8
Function at 0x1004d79
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1009020]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
push 2
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x438], ecx
call ebx
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
jbe 0x1004e49
push esi
mov esi, dword [sym.imp.COMCTL32.dll_DSA_GetItemPtr]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x428], ecx
push 0
push 0
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call ebx
push 0
lea eax, [ebp - 0x430]
push eax
push 0xd
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x42c]
call edi
test eax, eax
je 0x1004e47
xor ecx, ecx
cmp dword [ebp - 0x430], ecx
je 0x1004e47
movzx eax, word [ebp - 0x424]
sub eax, 0x8000
je 0x1004f50
sub eax, 0x101
je 0x1004ed2
dec eax
je 0x1004e9a
dec eax
je 0x1004e78
dec eax
je 0x1004e56
sub eax, 0x7efb
je 0x1004e47
cmp dword [ebp - 0x438], ecx
je 0x1004e47
cmp word [ebp - 0x41c], 6
jae 0x1004f3e
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100815d
leave
ret 8
push dword [ebp - 0x420]
push dword [0x1009270]
call esi
test eax, eax
je 0x1004f3e
mov dword [eax + 0x18], 1
jmp 0x1004f3e
push dword [ebp - 0x420]
push dword [0x1009270]
call esi
test eax, eax
je 0x1004f3e
mov dword [eax + 0x14], 7
jmp 0x1004f3e
push ecx
lea eax, [ebp - 0x430]
push eax
push 2
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x42c]
call edi
push dword [ebp - 0x420]
push dword [0x1009270]
call esi
test eax, eax
je 0x1004f3e
mov cx, word [ebp - 0x434]
mov word [eax + 0x12], cx
jmp 0x1004f3e
mov eax, dword [ebp - 0x428]
push ecx
push ecx
add eax, 0xc
push eax
push dword [ebp - 0x42c]
call ebx
push 0
lea eax, [ebp - 0x430]
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x42c]
call edi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.0100252f
push dword [ebp - 0x420]
push dword [0x1009270]
call esi
test eax, eax
je 0x1004f3e
lea ecx, [ebp - 0x414]
push ecx
add eax, 4
push eax
call dword [sym.imp.COMCTL32.dll_Str_SetPtrW]
movzx eax, word [ebp - 0x41c]
add dword [ebp - 0x428], eax
jmp 0x1004dca
mov dword [ebp - 0x438], 1
jmp 0x1004f3e
Function at 0x1005311
Capabilities:
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
cmp word [0x1009048], 0
mov eax, dword [0x1009020]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x210], eax
mov esi, 0x1009048
jne 0x1005410
push 0x10013a0
mov edi, 0x104
push edi
push esi
push 0x1001974
mov ebx, 0x10013b8
push ebx
push 0x1001950
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [0x1009048], 0
jne 0x10053ae
lea eax, [ebp - 0x214]
push eax
push esi
push 0x1001608
push 0x80000001
mov dword [ebp - 0x214], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x10053a4
push edi
push esi
push 0xd7
push dword [0x1009264]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [0x1009048], 0
je 0x1005424
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Ordinal_175]
lea eax, [ebp - 0x20c]
push eax
call sub.SHELL32.dll_Ordinal_32
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010025d8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10013f0
push 0x80000001
call fcn.01006982
cmp word [0x1009048], 0
je 0x1005424
push esi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005424
inc eax
jmp 0x1005426
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100815d
leave
ret 4
Function at 0x10057a3
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
push dword [0x1009250]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10057d5
xor eax, eax
jmp 0x10058bd
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10058b1
push dword [ebp - 4]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x10058b1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call esi
mov edi, eax
cmp edi, ebx
je 0x10058a6
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100589d
cmp dword [edi], 0x43434d50
jne 0x1005864
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.010048f4
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
push eax
mov dword [ebp + 0xc], eax
call esi
mov edi, eax
cmp edi, ebx
je 0x10058a6
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100589d
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret 8
Function at 0x10058c7
Capabilities:
Delete file
Get common file path
Query environment variable
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x1009020]
mov ecx, dword [ebp + 0x18]
push edi
push 0x1009250
xor edi, edi
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x670], eax
mov eax, dword [ebp + 0x14]
push ecx
push eax
mov dword [ebp - 0x664], edi
mov dword [ebp - 0x668], edi
mov dword [ebp - 0x660], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100591c
xor eax, eax
jmp 0x1005add
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x678]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x44]
push eax
push edi
push dword [0x1009250]
mov dword [ebp - 0x66c], 0x1f
call ebx
cmp eax, 0x103
mov word [ebp - 8], di
je 0x1005ab2
push esi
mov esi, 0x104
cmp eax, edi
jne 0x1005a6f
push esi
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x65c]
push eax
call fcn.0100252f
push esi
lea eax, [ebp - 0x65c]
push eax
push 0x100184c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x1001848
push esi
lea eax, [ebp - 0x24c]
push eax
call fcn.010025d8
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x24c]
push eax
call fcn.010025d8
push 0x100183c
push esi
lea eax, [ebp - 0x24c]
push eax
call fcn.010025d8
cmp dword [ebp + 0x10], edi
je 0x10059ef
lea eax, [ebp - 0x24c]
push eax
call fcn.01003a85
cmp eax, dword [ebp - 0x678]
je 0x1005a6f
lea eax, [ebp - 0x454]
push eax
push edi
push 0x1001834
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1005a6f
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x454]
push eax
call fcn.010057a3
test eax, eax
je 0x1005a6f
cmp dword [ebp + 0xc], edi
je 0x1005a3d
cmp dword [ebp - 0x668], edi
jne 0x1005a3d
call fcn.010066d4
mov dword [ebp - 0x668], 1
lea eax, [ebp - 0x454]
push eax
call dword [ebp - 0x670]
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x678]
lea eax, [ebp - 0x24c]
push eax
call fcn.01003a5c
inc dword [ebp - 0x660]
inc dword [ebp - 0x664]
lea eax, [ebp - 0x678]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x664]
mov dword [ebp - 0x66c], 0x1f
push dword [0x1009250]
call ebx
cmp eax, 0x103
mov word [ebp - 8], di
jne 0x1005960
pop esi
push dword [0x1009250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], edi
mov dword [0x1009250], edi
pop ebx
je 0x1005ad7
cmp dword [ebp - 0x668], edi
je 0x1005ad7
call fcn.010066e4
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 4]
pop edi
call fcn.0100815d
leave
ret 0x14
Function at 0x100632a
Capabilities:
Create process on windows
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x1009020]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor esi, esi
push ebx
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x298], esi
call fcn.01002fa8
test eax, eax
je 0x100656a
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x294], eax
je 0x100655f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 0x29c]
push ecx
push 0x3c
lea ecx, [ebp - 0x314]
push ecx
push eax
call edi
test eax, eax
je 0x1006552
cmp dword [ebp - 0x29c], 0x3c
jne 0x1006552
push esi
push esi
push dword [ebp - 0x2f0]
push dword [ebp - 0x294]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x29c]
push eax
push 0x3e
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x294]
call edi
lea eax, [ebp - 0x84]
push eax
push 0x1f
lea eax, [ebp - 0x44]
push eax
call fcn.0100252f
lea eax, [ebp - 0x44]
push eax
call fcn.01005311
test eax, eax
lea eax, [ebp - 0x28c]
je 0x1006424
cmp dword [0x1009254], esi
push 1
je 0x1006420
push 0x18
push eax
push dword [ebp - 0x290]
call dword [sym.imp.SHELL32.dll_Ordinal_175]
jmp 0x100643d
push 7
jmp 0x1006411
push ebx
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x290]
call fcn.0100314a
test eax, eax
je 0x1006552
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x310]
push dword [ebp - 0x2e4]
push dword [ebp - 0x294]
call fcn.0100430c
test eax, eax
jne 0x1006481
test byte [ebp + 0x10], 2
je 0x1006481
push 0x30
push esi
push 0xcf
push 0xca
push dword [ebp - 0x290]
call fcn.01006c1a
push dword [ebp - 0x310]
push dword [ebp - 0x294]
call fcn.01004d79
call fcn.0100347a
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.SHELL32.dll_IsLFNDrive]
test eax, eax
jne 0x10064ad
call fcn.010034be
call fcn.01005e98
lea eax, [ebp - 0x28c]
push eax
call fcn.01003902
test byte [ebp + 0x10], 8
je 0x10064cb
call fcn.0100563e
jmp 0x10064e0
movzx eax, word [ebp - 0x2e4]
push eax
push esi
lea eax, [ebp - 0x28c]
push eax
call fcn.01004f61
test byte [ebp + 0x10], 4
je 0x1006548
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x2c8], eax
mov eax, dword [0x1009264]
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x2d8]
push eax
mov dword [ebp - 0x2d8], 0x3c
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2cc], esi
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2bc], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x298], 1
push dword [ebp - 0x294]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
call fcn.01002fd3
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100815d
leave
ret 0xc