joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006f62
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x100a900
call fcn.01007154
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x100c56c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1006d1d
cmp eax, esi
jne 0x1006d10
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1006d20
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006cf7
xor esi, esi
inc esi
mov eax, dword [0x100c568]
cmp eax, esi
jne 0x1006d33
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006d62
mov eax, dword [0x100c568]
test eax, eax
jne 0x1006d5c
mov dword [0x100c568], esi
push 0x10012a4
push 0x1001298
call fcn.01006c59
pop ecx
pop ecx
test eax, eax
je 0x1006d62
jmp 0x1006e86
mov dword [0x100c200], esi
mov eax, dword [0x100c568]
cmp eax, esi
jne 0x1006d86
push 0x1001294
push 0x100128c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100c568], 2
cmp dword [ebp - 0x20], ebx
jne 0x1006d93
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100c570], ebx
je 0x1006db4
push 0x100c570
call fcn.010070c9
pop ecx
test eax, eax
je 0x1006db4
push ebx
push 2
push ebx
call dword [0x100c570]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1006e86
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1006e1e
cmp cx, bx
je 0x1006dd9
cmp dword [ebp - 0x1c], ebx
jne 0x1006e1e
movzx ecx, word [eax]
cmp cx, bx
je 0x1006dee
cmp cx, 0x20
ja 0x1006dee
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1006dd9
test byte [ebp - 0x40], 1
je 0x1006dfa
movzx ecx, word [ebp - 0x3c]
jmp 0x1006dfd
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x100c1fc], eax
cmp dword [0x100c1f0], ebx
jne 0x1006e63
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1006e2f
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1006dc3
cmp dword [0x100c200], ebx
jne 0x1006e71
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100c1fc]
jmp 0x1006e92
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01007199
ret
call fcn.010072a1
jmp 0x1006cba
Function at 0x1007cb1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100c124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x21c], 0
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1007dd0
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x1007dd0
push ebx
push edi
mov edi, 0x1001310
xor ecx, ecx
cmp word [esi], cx
mov ebx, esi
jmp 0x1007d2e
movzx eax, word [ebx]
cmp ax, 0x20
je 0x1007d36
cmp ax, 0x2c
je 0x1007d36
inc ebx
inc ebx
cmp word [ebx], cx
mov dword [ebp - 0x210], ebx
jne 0x1007d1a
cmp word [ebx], cx
jne 0x1007d47
mov dword [ebp - 0x214], 1
jmp 0x1007d4c
xor eax, eax
mov word [ebx], ax
cmp word [esi], cx
je 0x1007dbe
push esi
push 0x1001300
call fcn.01007884
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
push ecx
push eax
push esi
call fcn.0100a0eb
test eax, eax
jge 0x1007de5
push 0x100172c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push 0
push edi
mov ebx, eax
call fcn.01007919
test ebx, ebx
je 0x1007db8
push esi
push 0x1030
push 0x20c
push 0x203
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x18
mov ebx, dword [ebp - 0x210]
cmp dword [ebp - 0x214], 0
lea esi, [ebx + 2]
je 0x1007d11
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
pop esi
call fcn.01006f7d
leave
ret 0xc
push esi
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push edi
call fcn.01007919
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x21c], 1
jmp 0x1007dbe
Function at 0x1007e16
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100c124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push 0x40000047
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x20c], esi
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1007f82
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1007f82
push ebx
lea eax, [ebp - 0x208]
push eax
xor ebx, ebx
inc ebx
push ebx
push esi
push 0x1001840
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1007f81
push edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1001834
push esi
push dword [ebp - 0x208]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x214], 0x1fe
call esi
mov edi, 0x10012e0
test eax, eax
jne 0x1007f06
cmp dword [ebp - 0x210], ebx
jne 0x1007f06
mov ebx, 0x10017c0
push ebx
push edi
call fcn.01007884
push dword [ebp - 0x218]
lea eax, [ebp - 0x204]
push 7
push eax
call fcn.01007cb1
test eax, eax
je 0x1007ef8
mov dword [ebp - 0x20c], 1
push ebx
push 0x10012f0
call fcn.01007884
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10017b4
push 0
push dword [ebp - 0x208]
mov dword [ebp - 0x214], 0x1fe
call esi
test eax, eax
jne 0x1007f74
cmp dword [ebp - 0x210], ebx
jne 0x1007f74
mov esi, 0x1001740
push esi
push edi
call fcn.01007884
push dword [ebp - 0x218]
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.01007cb1
test eax, eax
je 0x1007f69
mov dword [ebp - 0x20c], ebx
push esi
push 0x10012f0
call fcn.01007884
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20c]
xor ecx, ebp
pop esi
call fcn.01006f7d
leave
ret 4
Function at 0x10098a4
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x100c124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, 0x488
push ebx
mov dword [ebp - 0x494], eax
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 8]
mov dword [ebp - 0x45c], eax
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x460], 0x20000
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x420], 0x78
mov dword [ebp - 0x41c], 0x280
mov dword [ebp - 0x490], 0x80004005
cmp dword [ebp - 0x494], edi
jne 0x1009930
mov eax, dword [esi]
mov dword [ebp - 0x494], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
je 0x1009aaa
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push edi
push dword [ebp - 0x494]
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.01008a10
cmp eax, edi
mov dword [ebp - 0x490], eax
jl 0x1009aaa
push 0x1001bc8
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.0100978f
cmp eax, edi
mov dword [ebp - 0x490], eax
jl 0x1009aaa
mov ebx, dword [sym.imp.ADVAPI32.dll_StartTraceW]
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x494]
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x498], edi
call ebx
push eax
call fcn.01009770
mov dword [ebp - 0x490], eax
cmp eax, 0x80070057
jne 0x1009a13
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1009a08
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x494]
lea eax, [ebp - 0x49c]
push eax
call ebx
push eax
call fcn.01009770
jmp 0x1009a0d
call fcn.01009109
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], edi
jl 0x1009aaa
mov dword [ebp - 0x494], edi
cmp dword [esi + 0x14], edi
jbe 0x1009a7b
xor ebx, ebx
cmp dword [ebp - 0x490], edi
jl 0x1009a83
mov eax, dword [esi + 0x10]
push edi
push edi
push edi
push edi
add eax, ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 4
push 1
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_EnableTraceEx]
push eax
call fcn.01009770
inc dword [ebp - 0x494]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x494]
add ebx, 0x18
cmp eax, dword [esi + 0x14]
jb 0x1009a2c
cmp dword [ebp - 0x490], edi
jge 0x1009aaa
lea eax, [ebp - 0x48c]
push eax
push edi
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
call dword [sym.imp.ADVAPI32.dll_StopTraceW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x490]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006f7d
leave
ret 8
Function at 0x100a6e4
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x100c124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push 0x40
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x47c]
push ebx
push eax
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x480], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x420], ebx
cmp edi, ebx
jne 0x100a75d
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], 0x44
mov dword [ebp - 0x424], eax
cmp esi, ebx
jne 0x100a771
lea esi, [ebp - 0x43c]
mov dword [ebp - 0x420], 1
push dword [ebp - 0x41c]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x102
lea eax, [ebp - 0x414]
push eax
call fcn.01007f9c
cmp eax, ebx
mov dword [ebp - 0x418], eax
jl 0x100a835
lea eax, [ebp - 0x414]
push eax
call sub.SHLWAPI.dll_PathQuoteSpacesW
push 0x1005db4
mov edi, 0x208
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01006655
cmp eax, ebx
mov dword [ebp - 0x418], eax
jl 0x100a835
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01006655
cmp eax, ebx
mov dword [ebp - 0x418], eax
jl 0x100a835
push esi
push dword [ebp - 0x424]
lea eax, [ebp - 0x414]
push dword [ebp - 0x42c]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100a81e
call fcn.0100a489
mov dword [ebp - 0x418], eax
jmp 0x100a835
cmp dword [ebp - 0x420], ebx
je 0x100a835
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006f7d
leave
ret 0x14
Function at 0x1005226
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100d038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1005244
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100525e
and eax, 0xffff
or eax, 0x80070000
jmp 0x100525e
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100522e
xor eax, eax
cmp dword [ebp - 0x14], ebx
sete al
mov esi, eax
cmp dword [ebp - 0x10], ebx
je 0x100526e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008732
leave
ret

Function at 0x1005406
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x100d038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x64]
call fcn.0100545a
mov esi, dword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 0x30], 2
call esi
test eax, eax
jne 0x10053b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10053a9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1005430
push 4
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
push 0x100143c
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.01005283
mov esi, eax
add esp, 0x10
cmp esi, edi
jl 0x1005430
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.msvcrt.dll__wsetlocale]
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0x1001428
push 0x40000002
call fcn.010050b9
pop ecx
pop ecx
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.01005881
mov esi, eax
cmp esi, edi
jne 0x1005449
lea eax, [ebp - 0x64]
push eax
call fcn.010052e2
mov esi, eax
cmp esi, edi
jge 0x1005430
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.010050ea
lea ecx, [ebp - 0x64]
call fcn.010055f3
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008732
leave
ret
cmp esi, 1
jne 0x1005426
call fcn.010050da
jmp 0x1005430
Function at 0x1005e34
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push 0x2000
push dword [ebp + 8]
mov esi, ecx
call fcn.01009686
test eax, eax
je 0x1005e34
mov edx, dword [esi + 0x20]
mov ecx, dword [ebp - 0x10]
dec edx
test ecx, edx
jne 0x1005e34
mov dword [esi + 0x24], ecx
mov dword [esi + 0x30], eax
pop edi
xor eax, eax
pop esi
leave
ret 4

Function at 0x100641e
Capabilities:
Get common file path

Disassembly:
push 0x18
push 0x100c3f0
call fcn.01008748
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 4], esi
push dword [edi + 0x20]
call fcn.01005dbc
mov dword [ebp - 0x1c], eax
xor ecx, ecx
cmp eax, ecx
jne 0x10063cd
mov dword [ebp - 0x20], 0x8007000e
jmp 0x100643e
cmp dword [ebp + 0xc], ecx
je 0x10063e3
mov esi, dword [edi + 0x18]
sub esi, 1
mov dword [ebp - 0x28], esi
mov ebx, dword [edi + 0x1c]
sbb ebx, ecx
mov dword [ebp - 0x24], ebx
push ecx
push ebx
push esi
mov ecx, edi
call fcn.01005d51
test eax, eax
jne 0x100640a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1006405
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x20], eax
jmp 0x100643e
push dword [edi + 0x20]
mov ebx, dword [ebp - 0x1c]
push ebx
mov ecx, edi
call fcn.01005c76
test eax, eax
je 0x10063f1
cmp dword [ebp + 0xc], 0
je 0x1006432
mov esi, dword [edi + 0x20]
sub esi, 0x200
mov dword [ebp - 0x28], esi
and dword [ebp - 0x24], 0
add esi, ebx
mov ecx, 0x80
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 0xfffffffe
call fcn.01006455
mov eax, dword [ebp - 0x20]
call fcn.0100878d
ret 8
Function at 0x1006f3a
Capabilities:
Write file on windows

Disassembly:
push 0x238
push 0x100c4d0
call fcn.010088fc
mov ebx, ecx
mov esi, 0x10015c0
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
xor edi, edi
push edi
lea eax, [ebp - 0x232]
push eax
call fcn.01008958
add esp, 0xc
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 4], edi
cmp word [ebx + 0x48], di
je 0x100705a
mov esi, 0x104
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
jne 0x1006f57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1006f4c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x238], eax
jmp 0x100705a
push 0x10015a8
push esi
lea eax, [ebp - 0x234]
push eax
call fcn.01006df0
mov dword [ebp - 0x238], eax
cmp eax, edi
jl 0x100705a
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x23c], eax
cmp eax, edi
je 0x100701e
push 0x1001598
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov edi, eax
push 0x1001580
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x248], eax
push 0x1001570
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x240], eax
test edi, edi
je 0x1007050
cmp dword [ebp - 0x248], 0
je 0x1007050
test eax, eax
je 0x1007050
mov ax, word [ebx + 0x48]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x244]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
call edi
mov dword [ebp - 0x238], eax
test eax, eax
jl 0x100705a
push dword [ebx + 0x4c]
mov esi, dword [ebp + 8]
push esi
push dword [ebp - 0x244]
call dword [ebp - 0x248]
mov dword [ebp - 0x238], eax
cmp eax, 0x80070001
jne 0x100702a
mov dword [ebp - 0x238], 1
jmp 0x100705a
test eax, eax
jge 0x100705a
push eax
neg esi
sbb esi, esi
and esi, 0x3fffffff
add esi, 0x8000002c
push esi
call fcn.010079b3
push eax
call fcn.01007b3a
add esp, 0xc
jmp 0x100705a
mov dword [ebp - 0x238], 0x80070001
mov dword [ebp - 4], 0xfffffffe
call fcn.01007074
mov eax, dword [ebp - 0x238]
call fcn.01008944
ret 4
Function at 0x1006fbd
Capabilities:
Write file on windows

Disassembly:
push 0x238
push 0x100c4d0
call fcn.010088fc
mov ebx, ecx
mov esi, 0x10015c0
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
xor edi, edi
push edi
lea eax, [ebp - 0x232]
push eax
call fcn.01008958
add esp, 0xc
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 4], edi
cmp word [ebx + 0x48], di
je 0x100705a
mov esi, 0x104
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
jne 0x1006f57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1006f4c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x238], eax
jmp 0x100705a
push 0x10015a8
push esi
lea eax, [ebp - 0x234]
push eax
call fcn.01006df0
mov dword [ebp - 0x238], eax
cmp eax, edi
jl 0x100705a
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x23c], eax
cmp eax, edi
je 0x100701e
push 0x1001598
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov edi, eax
push 0x1001580
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x248], eax
push 0x1001570
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x240], eax
test edi, edi
je 0x1007050
cmp dword [ebp - 0x248], 0
je 0x1007050
test eax, eax
je 0x1007050
mov ax, word [ebx + 0x48]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x244]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
call edi
mov dword [ebp - 0x238], eax
test eax, eax
jl 0x100705a
push dword [ebx + 0x4c]
mov esi, dword [ebp + 8]
push esi
push dword [ebp - 0x244]
call dword [ebp - 0x248]
mov dword [ebp - 0x238], eax
cmp eax, 0x80070001
jne 0x100702a
mov dword [ebp - 0x238], 1
jmp 0x100705a
test eax, eax
jge 0x100705a
push eax
neg esi
sbb esi, esi
and esi, 0x3fffffff
add esi, 0x8000002c
push esi
call fcn.010079b3
push eax
call fcn.01007b3a
add esp, 0xc
jmp 0x100705a
mov dword [ebp - 0x238], 0x80070001
mov dword [ebp - 4], 0xfffffffe
call fcn.01007074
mov eax, dword [ebp - 0x238]
call fcn.01008944
ret 4
Function at 0x40d590
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401f20
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x42e1bb
mov eax, dword [0x4a7f54]
test eax, eax
je 0x42e1d4
mov byte [ebp - 1], 0
mov esi, 0x4a90e8
cmp eax, 1
je 0x42e1ea
push 0x4a7f54
lea ecx, [ebp - 1]
mov eax, 0x4a7f6c
call fcn.0040f520
test al, al
je 0x42e211
mov cl, byte [0x4a90e8]
mov bl, byte [0x4a90e9]
push 0x4a7f50
lea edx, [ebp - 0x438]
push edx
push 0x104
push 0x4a7f6c
mov byte [0x4a7f58], cl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [0x4a7f54]
push eax
push 0x4a7f6c
call fcn.00401460
test eax, eax
jne 0x42e227
cmp bl, 1
je 0x42e24d
call fcn.00410390
call fcn.00410570
cmp byte [0x4a7f58], 0
jne 0x40d669
mov esi, 0x4a8710
call fcn.0040e0c0
push 1
mov ecx, 0x4a8178
call fcn.004091e0
cmp byte [0x4a7f58], 0
jne 0x40d688
mov ecx, 0x4a8710
call fcn.00401000
mov ebx, 0x4a90e8
call fcn.0040ec50
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push 0x484c92
push 0x484c98
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d69f
lea ecx, [ebp - 0x228]
mov dword [0x4974f4], 0xffffffff
push ecx
jmp 0x40d699
mov ebx, dword [0x4a7f5c]
push 0xffffffffffffffff
push 1
mov byte [ebp - 2], 0
call fcn.00403a50
mov dl, byte [0x4974e8]
mov bl, byte [ebp - 2]
mov byte [0x4a90eb], dl
jmp 0x40d62b
lea eax, [ebp - 0x228]
mov dword [0x4974f4], 1
push eax
jmp 0x40d699
mov ebx, 0x4a90e8
call fcn.0040ec50
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4974f4], 1
jmp 0x40d69f
call fcn.00432fee
test al, al
jne 0x40d64c
push 0x104
lea edx, [ebp - 0x438]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 1], 0
je 0x42e2cb
mov edi, 0x484d00
lea esi, [ebp - 0x14]
call fcn.00401b10
mov edi, 0x4a7f6c
mov eax, esi
call fcn.0040d200
mov edi, 0x484d00
mov eax, esi
call fcn.0040d200
mov ecx, dword [ebp - 0x14]
push 1
lea eax, [ebp - 0x228]
push eax
push ecx
lea edx, [ebp - 0x438]
push edx
push 0x484d04
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00402250
jmp 0x40d688
push 1
lea eax, [ebp - 0x228]
push eax
push edi
lea ecx, [ebp - 0x438]
push ecx
push 0x484d04
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40d688
Function at 0x40e4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00403350
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x485628
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x427190
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push ebx
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push 0x485618
push edx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42721a
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.004115d7
add esp, 4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0043652f
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push edi
push 0
push 0
push 0x485618
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x427210
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
xor ecx, ecx
mov word [edi + eax*2], cx
mov ebx, edi
mov eax, esi
call fcn.00402160
mov bl, 1
lea edx, [ebp - 0x10]
push edx
call fcn.00436508
pop edi
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret