joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000480c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
mov eax, dword [ebp + 0x1b8]
mov dword [0x100286ac], eax
mov eax, dword [ebp + 0x1c0]
mov dword [0x100286a8], eax
mov eax, dword [ebp + 0x1bc]
push ebx
mov dword [0x100286b0], eax
push esi
lea eax, [ebp + 0x19c]
push eax
call fcn.10001954
lea eax, [ebp - 0x6c]
push eax
call fcn.10001954
lea eax, [ebp + 0x98]
push eax
call fcn.10001954
push str.hklm
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
lea ecx, [ebp - 0x7c]
push ecx
sbb eax, eax
push 9
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x6c]
add eax, 0x80000002
push ecx
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004936
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x70], ebx
call esi
cmp dword [ebp - 0x70], ebx
je 0x10004936
cmp dword [ebp - 0x80], 7
jne 0x10004936
inc dword [ebp - 0x70]
push edi
push dword [ebp - 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
mov dword [ebp - 0x74], ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x70]
push ecx
push eax
push ebx
mov dword [ebp - 0x78], eax
push ebx
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x7c]
call esi
cmp dword [ebp - 0x70], ebx
jbe 0x1000491e
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
add eax, ecx
cmp byte [eax], bl
jne 0x10004913
mov byte [eax], 0x2a
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x70]
jb 0x10004904
push dword [ebp - 0x78]
call fcn.1000198e
push dword [ebp - 0x78]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
jmp 0x10004940
push 0x10022400
call fcn.1000198e
mov ecx, dword [ebp + 0x1a8]
pop esi
xor ecx, ebp
pop ebx
call fcn.100061c6
add ebp, 0x1ac
leave
ret
Function at 0x10004957
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x274], esi
lea edi, [ebp - 0x270]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x31
stosd dword es:[edi], eax
lea eax, [ebp - 0x37]
push esi
push eax
mov byte [ebp - 0x38], 0
call fcn.100063b0
push 0x31
lea eax, [ebp - 0x6b]
push esi
push eax
mov byte [ebp - 0x6c], 0
call fcn.100063b0
mov eax, dword [ebp + 0xc]
mov dword [0x100286ac], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100286a8], eax
mov eax, dword [ebp + 0x10]
mov dword [0x100286b0], eax
add esp, 0x18
lea eax, [ebp - 0x38]
push eax
call fcn.10001954
lea eax, [ebp - 0x6c]
push eax
call fcn.10001954
lea eax, [ebp - 0x38]
push eax
call fcn.10006cd0
test eax, eax
pop ecx
jbe 0x10004b15
lea eax, [ebp - 0x6c]
push eax
call fcn.10006cd0
test eax, eax
pop ecx
jbe 0x10004b15
lea eax, [ebp - 0x38]
push eax
call fcn.10006b5b
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x264], edi
call fcn.10006b5b
cmp edi, esi
pop ecx
pop ecx
mov dword [ebp - 0x278], eax
je 0x10004b15
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10004b15
push 0x1f3
lea eax, [ebp - 0x25f]
push esi
push eax
mov byte [ebp - 0x260], 0
call fcn.100063b0
add esp, 0xc
push 0x1f4
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x260]
push eax
call fcn.10006cd0
test eax, eax
pop ecx
jbe 0x10004b15
push ebx
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
lea eax, [ebp - 0x274]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp ebx, esi
je 0x10004b14
push esi
push esi
push 0x31
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
call esi
mov edi, eax
push 0x400
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.10006cd0
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push edi
push ebx
call esi
mov esi, dword [ebp - 0x26c]
sub esi, dword [ebp - 0x274]
mov edi, dword [ebp - 0x268]
sub edi, dword [ebp - 0x270]
add esi, dword [ebp - 0x278]
push ebx
push dword [ebp - 0x264]
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
cmp esi, eax
jle 0x10004b14
push 0xa
push edi
push esi
push eax
push eax
push eax
push dword [ebp - 0x264]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100061c6
leave
ret
Function at 0x10004b23
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10004b9e
push esi
push 0x40
call edi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10004b9e
push eax
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10004b95
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push 0x10022650
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10004b95
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x10004bf8
push ebx
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x10004bf8
push esi
push ebx
push 0
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10004bf1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push 0x10022650
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10004bf1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
jne 0x10004c09
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
test eax, eax
jge 0x10004c12
push 2
pop eax
leave
ret
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
leave
ret

Function at 0x10004c1d
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push edi
push dword [esp + 0xc]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0xb7
setne bl
test edi, edi
je 0x10004c86
test ebx, ebx
je 0x10004c86
push esi
push 0x3e8
call fcn.10005fe4
push 4
mov esi, eax
push 0
push esi
call fcn.100063b0
push dword [esp + 0x20]
push esi
call fcn.10007010
mov eax, dword [0x10029810]
shl eax, 2
add esp, 0x18
inc dword [0x10029810]
mov dword [eax + 0x100286e0], esi
mov dword [eax + 0x10029680], edi
pop esi
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x10004c8b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x10029810], ebx
mov dword [ebp - 0x454], eax
jle 0x10004d9c
push esi
mov esi, edi
shl esi, 2
cmp dword [esi + 0x10029680], ebx
je 0x10004d28
mov eax, dword [esi + 0x100286e0]
cmp eax, ebx
je 0x10004d28
push eax
call fcn.10006cd0
test eax, eax
pop ecx
je 0x10004d28
mov eax, dword [esi + 0x100286e0]
push dword [ebp - 0x454]
push eax
call fcn.10006546
test eax, eax
pop ecx
pop ecx
jne 0x10004d28
push dword [esi + 0x10029680]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x10004d33
push dword [esi + 0x10029680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x100286e0]
mov dword [esi + 0x10029680], ebx
call fcn.1000729c
pop ecx
mov dword [esi + 0x100286e0], ebx
inc edi
cmp edi, dword [0x10029810]
jl 0x10004cba
jmp 0x10004d9b
push 8
pop ecx
push 0x3c8
lea eax, [ebp - 0x430]
push ebx
mov esi, str.ReleaseMutex_Fail_GetLastError
lea edi, [ebp - 0x450]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100063b0
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.100063b0
add esp, 0x18
push 0xa
push 0x64
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10007405
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10007020
add esp, 0x18
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100061c6
leave
ret
Function at 0x10004dcd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
fldz
push ebx
push esi
fstp qword [ebp - 0x10]
mov esi, dword [ebp + 0x14]
push edi
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.10005fe4
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0x14], esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004ea5
fldz
fcomp qword [ebp + 8]
fnstsw ax
test ah, 0x44
jnp 0x10004e85
push dword [ebp + 0x14]
push ebx
push edi
call fcn.100063b0
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10004e85
mov eax, dword [ebp + 0x14]
inc eax
push eax
call fcn.10005fe4
pop ecx
xor edx, edx
xor ecx, ecx
cmp dword [ebp + 0x14], ebx
mov esi, eax
jbe 0x10004e71
mov al, byte [edx + edi]
cmp al, 0x39
jg 0x10004e63
cmp al, 0x30
jge 0x10004e67
cmp al, 0x2e
jne 0x10004e6b
mov byte [ecx + esi], al
inc ecx
inc edx
cmp edx, dword [ebp + 0x14]
jb 0x10004e58
push esi
mov byte [ecx + esi], bl
call fcn.10007659
fstp qword [ebp - 0x10]
push esi
call fcn.1000729c
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x10004e93
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld qword [ebp - 0x10]
fcomp qword [ebp + 8]
fnstsw ax
test ah, 0x41
jp 0x10004ea5
xor eax, eax
inc eax
jmp 0x10004ea7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10004ee4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push eax
call fcn.10007659
fstp qword [ebp - 0x30]
fldz
pop ecx
lea eax, [ebp - 0x20]
fstp qword [ebp - 0x28]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push esi
push SysReAllocStringLen
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x14
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004fbd
fldz
fcomp qword [ebp - 0x30]
fnstsw ax
test ah, 0x44
jnp 0x10004fb8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push str.Version
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10004fa7
mov eax, dword [ebp - 0x1c]
inc eax
push eax
call fcn.10005fe4
mov esi, eax
xor edx, edx
xor eax, eax
cmp dword [ebp - 0x1c], ebx
pop ecx
jbe 0x10004f93
mov cl, byte [ebp + edx - 0x18]
cmp cl, 0x39
jg 0x10004f84
cmp cl, 0x30
jge 0x10004f89
cmp cl, 0x2e
jne 0x10004f8d
mov byte [eax + esi], cl
inc eax
inc edx
cmp edx, dword [ebp - 0x1c]
jb 0x10004f76
push esi
mov byte [eax + esi], bl
call fcn.10007659
fstp qword [ebp - 0x28]
push esi
call fcn.1000729c
pop ecx
pop ecx
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x30]
fnstsw ax
test ah, 5
jnp 0x10004fb8
xor eax, eax
jmp 0x10004fc0
xor eax, eax
inc eax
jmp 0x10004fc0
push 2
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100061c6
leave
ret
Function at 0x10004fce
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push eax
call fcn.10007659
fstp qword [ebp - 0x30]
fldz
pop ecx
lea eax, [ebp - 0x20]
fstp qword [ebp - 0x28]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push esi
push SysReAllocStringLen
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x14
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100050a3
fldz
fcomp qword [ebp - 0x30]
fnstsw ax
test ah, 0x44
jnp 0x1000509e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push str.Version
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005091
mov eax, dword [ebp - 0x1c]
inc eax
push eax
call fcn.10005fe4
mov esi, eax
xor edx, edx
xor eax, eax
cmp dword [ebp - 0x1c], ebx
pop ecx
jbe 0x1000507d
mov cl, byte [ebp + edx - 0x18]
cmp cl, 0x39
jg 0x1000506e
cmp cl, 0x30
jge 0x10005073
cmp cl, 0x2e
jne 0x10005077
mov byte [eax + esi], cl
inc eax
inc edx
cmp edx, dword [ebp - 0x1c]
jb 0x10005060
push esi
mov byte [eax + esi], bl
call fcn.10007659
fstp qword [ebp - 0x28]
push esi
call fcn.1000729c
pop ecx
pop ecx
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x30]
fnstsw ax
test ah, 0x41
jne 0x100050a3
xor eax, eax
inc eax
jmp 0x100050a5
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100061c6
leave
ret
Function at 0x100050b3
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1b0]
and dword [ebp - 0x78], 0
push ebx
mov ebx, dword [ebp + 0x1ac]
push esi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x1b8]
push edi
mov edi, dword [ebp + 0x1b4]
push eax
call fcn.10007659
fstp qword [ebp - 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
push edi
call esi
push ebx
mov dword [ebp - 0x70], eax
call esi
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax + 0xa]
push eax
mov dword [ebp - 0x70], eax
call fcn.10005fe4
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push ebx
push str._s_s_is1
push eax
mov dword [ebp - 0x6c], eax
call esi
add esp, 0x14
test ebx, ebx
je 0x10005248
test edi, edi
je 0x10005248
cmp dword [ebp - 0x74], 0
je 0x10005248
fld qword [ebp - 0x80]
push str.DisplayVersion
push dword [ebp - 0x70]
push dword [ebp - 0x6c]
push ecx
push ecx
fstp qword [esp]
call fcn.10004dcd
add esp, 0x14
test eax, eax
je 0x100051d8
lea eax, [ebp - 0x70]
push eax
push 0xf003f
xor esi, esi
push esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000523a
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push str.UninstallString
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100051cd
mov eax, dword [ebp - 0x74]
inc eax
push eax
call fcn.10005fe4
lea ecx, [ebp - 0x68]
push ecx
push eax
mov dword [ebp - 0x78], eax
call fcn.10007010
add esp, 0xc
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000523a
push edi
push dword [ebp - 0x74]
push str._s_s
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x6c]
call fcn.10006cd0
fld qword [ebp - 0x80]
add esp, 0x14
push str.Version
inc eax
push eax
push dword [ebp - 0x6c]
push ecx
push ecx
fstp qword [esp]
call fcn.10004dcd
add esp, 0x14
test eax, eax
je 0x1000523a
push dword [ebp - 0x6c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push edi
push ebx
push str._s_s_is1
push dword [ebp - 0x6c]
call esi
add esp, 0x10
push dword [ebp - 0x6c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x6c]
call fcn.1000729c
mov eax, dword [ebp - 0x78]
pop ecx
jmp 0x1000524a
xor eax, eax
mov ecx, dword [ebp + 0x1a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100061c6
add ebp, 0x1a4
leave
ret
Function at 0x10005425
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xbc
mov eax, dword [0x10027410]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x78]
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, 0x7f00
mov dword [ebp - 0x18], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push edi
push esi
mov dword [ebp - 0x30], eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
mov dword [ebp - 0x20], eax
call ebx
push edi
push esi
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], str.nsis_customMessage
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
je 0x10005566
push esi
push esi
call ebx
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.dummy
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
push ebx
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp + 4]
push str.__d____d
push eax
call fcn.10007108
add esp, 0x10
lea eax, [ebp + 4]
push eax
call edi
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x10005551
push esi
push esi
push dword [ebp]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10005557
push str.____________________________
call edi
push dword [ebp + 0x7c]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x4c], 2
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push dword [ebp]
call ebx
test eax, eax
jne 0x10005504
push dword [0x1002a7e8]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_UnregisterClassA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp + 4]
push 0x10022500
push eax
call fcn.10007108
add esp, 0xc
lea eax, [ebp + 4]
push eax
call edi
mov ecx, dword [ebp + 0x68]
mov eax, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100061c6
add ebp, 0x6c
leave
ret
Function at 0x10008ef3
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10008f40
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10008f27
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10008f30
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10008f3a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10008f1c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]

Function at 0x10008f4d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10008ec4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10008ee2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
cmp cx, word [eax + 6]
jbe 0x10008ea6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10008f8d
dec eax
je 0x10008f84
sub eax, 3
je 0x10008f7b
mov dword [ebp - 4], 0x40
jmp 0x10008faa
mov dword [ebp - 4], 4
jmp 0x10008f90
mov dword [ebp - 4], 0x20
jmp 0x10008f90
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10008fdc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10008f5c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.100087fd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100087b2
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
inc ebp
cld
invalid
inc dword [edx]
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.100087fd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100087b2
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
and bh, ah
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.100087fd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100087b2
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.100087ed
adc byte [ebx + 1], dl
retf