joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458248
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
sub esp, 0x264
push ebp
mov ebp, dword [esp + 0x278]
push esi
mov esi, dword [esp + 0x274]
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
call fcn.0040be80
lea ecx, [esp + 0x18]
call fcn.0040be80
lea ecx, [esp + 0x38]
call fcn.0040be80
push str.SOFTWAREClasses_
lea eax, [esp + 0x2c]
call fcn.004021d0
mov edi, dword [esp + 0x274]
lea eax, [esp + 0x28]
call fcn.0040d160
mov edi, str.CLSID
lea eax, [esp + 0x28]
call fcn.0040d160
push 0x4838e8
lea eax, [esp + 0x1c]
call fcn.004021d0
test esi, esi
je 0x4582ee
cmp word [esi], 0x5c
je 0x4582ee
cmp word [esi + 2], 0x5c
je 0x4582ee
push 0x4899f8
lea eax, [esp + 0x1c]
call fcn.004021d0
mov edi, esi
lea eax, [esp + 0x18]
call fcn.0040d160
test ebp, ebp
je 0x45834c
push 0x20
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.00412fa0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x3c]
mov dword [esp + 0x50], 0
call fcn.0040dd10
mov edi, str.IPC_
mov eax, esi
call fcn.0040d160
mov eax, dword [esp + 0x284]
mov edx, dword [esp + 0x38]
push 0
push ebp
push eax
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x6c], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
test esi, esi
jne 0x4583ff
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push reloc.WSOCK32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x4583ff
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x4583f8
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x6c]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x28], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4583f1
mov eax, dword [esp + 0x10]
shr eax, 1
xor ecx, ecx
lea edi, [esp + 0x68]
mov dword [esp + 0x10], eax
mov word [esp + eax*2 + 0x68], cx
call fcn.0040fd60
mov edx, dword [esp + 0x27c]
mov edi, eax
push edx
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push edi
mov esi, eax
call fcn.00413583
add esp, 4
mov eax, dword [esp + 0xc]
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea ecx, [esp + 0x38]
call fcn.00402610
lea ecx, [esp + 0x18]
call fcn.00402610
lea ecx, [esp + 0x28]
call fcn.00402610
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x264
ret
Function at 0x458426
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24c
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push esi
push edi
lea ecx, [esp + 0x30]
call fcn.0040be80
fld1
lea eax, [esp + 0x24]
fstp qword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
test esi, esi
jl 0x458627
mov edi, dword [esp + 0x24]
call fcn.0040fd60
mov esi, eax
push str.interface_
lea eax, [esp + 0x34]
call fcn.004021d0
mov edi, esi
lea eax, [esp + 0x30]
call fcn.0040d160
mov edi, str.TypeLib
lea eax, [esp + 0x30]
call fcn.0040d160
push esi
call fcn.00413583
mov ecx, dword [esp + 0x28]
add esp, 4
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x458627
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x2c], 0x1fe
call ebx
mov esi, eax
test esi, esi
jne 0x45861c
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
lea edi, [esp + 0x50]
mov dword [esp + 0x14], eax
mov word [esp + eax*2 + 0x50], cx
call fcn.0040fd60
lea edx, [esp + 0x40]
mov edi, eax
push edx
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push edi
mov esi, eax
call fcn.00413583
add esp, 4
test esi, esi
jl 0x45861c
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push str.Version
push edx
mov dword [esp + 0x2c], 0x1fe
call ebx
test eax, eax
jne 0x458577
mov eax, dword [esp + 0x14]
shr eax, 1
lea edx, [esp + 0x50]
xor ecx, ecx
push edx
mov dword [esp + 0x18], eax
mov word [esp + eax*2 + 0x54], cx
call fcn.00413d47
fstp qword [esp + 0x2c]
add esp, 4
fld1
lea eax, [esp + 0x20]
push eax
push 0
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x40]
fstp qword [esp]
call fcn.00415800
fnstcw word [esp + 0x2a]
add esp, 0x10
movzx eax, word [esp + 0x1a]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp dword [esp + 0x20]
mov cx, word [esp + 0x20]
movzx edx, cx
push edx
fldcw word [esp + 0x1e]
lea edx, [esp + 0x4c]
fld qword [esp + 0x34]
fnstcw word [esp + 0x1e]
movzx eax, word [esp + 0x1e]
or eax, 0xc00
mov dword [esp + 0x24], eax
fldcw word [esp + 0x24]
fistp dword [esp + 0x24]
mov ax, word [esp + 0x24]
movzx ecx, ax
push ecx
fldcw word [esp + 0x22]
push edx
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
test esi, esi
jl 0x45861c
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push ebp
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
call fcn.00402610
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
Function at 0x45863d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x284
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x20]
mov esi, 0x80004002
xor ebx, ebx
mov dword [esp + 0x14], 0x28
call fcn.0040be80
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push str.interface
push accept
call ebp
test eax, eax
jne 0x458782
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x4c]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x458777
mov eax, dword [esp + 0x14]
xor edx, edx
mov word [esp + eax*2 + 0x38], dx
push str.interface_
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x1fe
call fcn.004021d0
lea edi, [esp + 0x38]
lea eax, [esp + 0x20]
call fcn.0040d160
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push edx
push accept
call ebp
test eax, eax
jne 0x458765
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x8c]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45875a
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x29c]
shr eax, 1
xor ecx, ecx
mov dword [esp + 0x14], eax
mov word [esp + eax*2 + 0x88], cx
push edx
lea eax, [esp + 0x8c]
push eax
call fcn.00411380
add esp, 8
test eax, eax
jne 0x45875a
mov ecx, dword [esp + 0x298]
push ecx
push edi
call dword [sym.imp.ole32.dll_IIDFromString]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x458777
inc ebx
mov dword [esp + 0x14], 0x28
jmp 0x458684
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
call fcn.00402610
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x284
ret
Function at 0x46088c
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x200
push esi
mov esi, dword [esp + 0x208]
mov eax, dword [esi + 0x54]
push 0x3e9
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x460912
push 0x100
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test byte [esi + 0x10], 1
je 0x4608de
cmp word [esp + 4], 0
jne 0x4608de
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop esi
add esp, 0x200
ret 4
fldz
fcomp qword [esi + 0x18]
fnstsw ax
test ah, 5
jp 0x4608f9
mov edx, dword [esi + 0x54]
push 0x40a
push edx
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [esp + 4]
push eax
lea eax, [esi + 0x34]
call fcn.004021d0
mov ecx, dword [esi + 0x54]
push 1
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
add esp, 0x200
ret 4
Function at 0x460d4a
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push 0x4838e8
call fcn.004021d0
push ebx
call fcn.004385b7
test al, al
je 0x460d6d
xor al, al
pop ebx
ret 8
mov eax, dword [ebx]
push ebp
push esi
push edi
push 0
push 0
push 0xe
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x460d8a
mov edi, 0x7fff
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004114ca
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push esi
push ebp
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x18]
mov word [esi + edi*2], cx
jne 0x460de1
push 0x4838e8
call fcn.004021d0
push esi
call fcn.0041109f
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
push esi
call fcn.004021d0
push esi
call fcn.0041109f
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x461a27
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov edx, dword [ebx]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0xb0
push edx
call esi
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
jb 0x461a5a
pop esi
xor al, al
pop ebx
pop ecx
ret 8
mov ecx, dword [ebx]
push edi
push 0
push 0
push 0xe
push ecx
call esi
mov edi, eax
test edi, edi
je 0x461ae5
cmp edi, dword [esp + 0xc]
jb 0x461ae5
cmp edi, dword [esp + 0x14]
jb 0x461ae5
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004114ca
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push esi
push ebp
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
test eax, eax
je 0x461adc
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x461ab9
xor ecx, ecx
mov word [esi + eax*2], cx
mov edx, dword [esp + 0xc]
lea eax, [esi + edx*2]
push eax
mov eax, dword [esp + 0x1c]
call fcn.004021d0
push esi
call fcn.0041109f
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret 8
push esi
call fcn.0041109f
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 8
Function at 0x46473c
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
mov eax, 2
push ebp
mov word [ebx], ax
call fcn.0045a5d1
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_inet_addr
lea esi, [esp + 0x10]
mov edi, eax
call fcn.00401330
cmp edi, 0xffffffff
jne 0x4647ae
push 0x489858
push ebp
call fcn.0044cf77
add esp, 8
test al, al
je 0x4647ae
push 0
push 1
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
add eax, ecx
call fcn.00404110
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0x10
push 0
push 2
jmp 0x46478c
mov eax, dword [esp + 0x30]
lea ecx, [eax - 1]
mov dword [ebx + 4], edi
cmp ecx, 0xfffe
ja 0x4647a8
push eax
call sub.WSOCK32.dll_htons
pop edi
pop esi
mov word [ebx + 2], ax
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10

Function at 0x465f93
Capabilities:
Parse url

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [esp + 0x64]
push edi
mov edi, dword [esp + 0x6c]
push 0x38
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00412fa0
add esp, 0xc
lea ecx, [esp + 0x24]
mov ebx, 1
push ecx
push 0
push esi
mov dword [esp + 0x30], 0x7c
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x58], ebx
call fcn.00411085
add esp, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x466000
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push 0
push edx
mov ecx, edi
call fcn.00403fa0
mov eax, dword [esp + 0x34]
push 0
push eax
mov eax, dword [esp + 0x40]
lea ecx, [edi + 0x10]
call fcn.00403fa0
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push 0
push ecx
lea ecx, [edi + 0x20]
call fcn.00403fa0
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
push 0
push edx
lea ecx, [edi + 0x30]
call fcn.00403fa0
mov eax, dword [esp + 0x50]
push 0
lea esi, [edi + 0x40]
push eax
mov eax, dword [esp + 0x5c]
mov ecx, esi
call fcn.00403fa0
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
push 0
lea ebp, [edi + 0x50]
push ecx
mov ecx, ebp
call fcn.00403fa0
push ebp
lea edx, [esp + 0x18]
push edx
push esi
call fcn.0044cfca
push eax
lea esi, [edi + 0x60]
call fcn.0040dd10
lea ecx, [esp + 0x14]
call fcn.00402610
mov ax, word [esp + 0x3c]
mov word [edi + 0x78], ax
mov eax, dword [esp + 0x30]
mov dword [edi + 0x74], eax
sub eax, ebx
je 0x4660d1
sub eax, ebx
je 0x4660be
mov dword [edi + 0x70], 3
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
mov dword [edi + 0x70], 2
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
mov dword [edi + 0x70], ebx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x54
ret 8
Function at 0x466215
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0xd0], 0
je 0x466253
test al, al
je 0x466253
lea eax, [esi + 0xd4]
push eax
call fcn.00434394
push esi
push 0
push 0x466208
call fcn.004154b2
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
ret 8
push eax
push esi
call fcn.004660e0
pop esi
ret 8
Function at 0x4679a3
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x18
mov al, byte [0x49628f]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [esp + 0x2c]
push 0x8000
push edi
mov byte [esp + 0x18], al
call fcn.004142ea
add esp, 4
push eax
call fcn.004141f3
add esp, 8
mov esi, eax
push ebp
mov dword [esp + 0x18], esi
call fcn.00443eb5
test al, al
je 0x467a02
push edi
push ebp
call fcn.00443257
push eax
push 1
push ebp
call fcn.004671eb
push eax
call fcn.0041447e
add esp, 0x10
mov ebx, eax
jmp 0x467a4e
push esi
jmp 0x467a61
lea esi, [esp + 0x18]
call fcn.0040d2b0
push ebp
call fcn.004532ca
push esi
push eax
call fcn.0045fb79
mov edx, dword [esp + 0x18]
push edx
push 0x4863f0
push edi
call fcn.00414500
add esp, 0xc
cmp byte [esp + 0x10], 0
mov ebx, eax
je 0x467a41
push ebp
call fcn.004532e8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [esp + 0x18]
call fcn.00401330
mov esi, dword [esp + 0x14]
push edi
call fcn.004147a6
add esp, 4
cmp esi, 0xffffffff
jne 0x4679ff
push 0x4000
push edi
call fcn.004142ea
add esp, 4
push eax
call fcn.004141f3
add esp, 8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x18
ret
Function at 0x4773f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a6cc1], bl
je 0x477588
mov eax, dword [0x4a6cc4]
cmp eax, ebx
je 0x477588
mov edx, 3
mov word [eax + 0x38], dx
mov dword [eax + 0x40], ecx
mov word [eax + 0x98], dx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x4a6cc4]
mov dword [edx + 0xa0], eax
mov eax, 3
mov word [edx + 0xa8], ax
mov ecx, dword [ebp + 0xec]
push ecx
call fcn.00437541
mov dword [edx + 0xb0], eax
cmp esi, ebx
je 0x477508
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov eax, 8
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
add edx, 0x68
push edx
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a6cc4]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x20]
push edx
add eax, 0x58
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a6cc4]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x20]
push edx
add eax, 0x78
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a6cc4]
mov ecx, 3
mov word [eax + 0x88], cx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x90], edx
mov word [eax + 0xb8], cx
movzx ecx, word [esi]
test cx, cx
je 0x4774f9
movzx esi, cx
jmp 0x4774fc
mov esi, dword [esi + 0x1c]
mov dword [eax + 0xc0], esi
test esi, esi
je 0x477508
mov edi, esi
mov eax, dword [esp + 0x50]
test eax, eax
je 0x47751d
mov edi, eax
lea ebx, [esp + 0x10]
call fcn.0040e420
jmp 0x47753c
push edi
lea edx, [esp + 0x34]
push edx
call fcn.0044b010
mov edi, eax
lea esi, [esp + 0x10]
call fcn.0040e370
lea ecx, [esp + 0x30]
call fcn.00402610
mov eax, dword [0x4a6cc4]
add eax, 0x48
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00475ccc
mov ecx, dword [0x4a6cc4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 8
call eax
mov edx, dword [ebp]
mov ecx, dword [esp + 0x48]
mov eax, dword [edx + 4]
push 0
push ecx
add eax, ebp
call fcn.00404110
lea esi, [esp + 0x10]
call fcn.00409280
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x14
mov eax, dword [ebp]
mov eax, dword [eax + 4]
push ebx
push ecx
add eax, ebp
call fcn.00404110
cmp byte [esp + 0x54], bl
je 0x477573
lea esi, [esp + 0x10]
call fcn.00409280
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x14
Function at 0x1008fc1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1001ce8
xor esi, esi
push esi
push 1
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10164c4], eax
cmp eax, esi
je 0x1009086
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push 0x1008d15
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10164c0], eax
cmp eax, esi
je 0x1009039
xor edi, edi
cmp dword [0x10164c8], esi
jne 0x10090cc
cmp edi, 0x3e8
jae 0x10090cc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp dword [0x10164c0], esi
jne 0x100900b
jmp 0x10090cc
push dword [0x10164c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10164c4], esi
call edi
push esi
push esi
mov ebx, eax
call edi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1001cc8
push 0x1001480
push 0x3b3
push esi
push 0x100147c
push 0xf0000
push 0x1001c98
push 0x2000048
jmp 0x10090bf
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push esi
push esi
mov ebx, eax
call edi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1001cc8
push 0x1001480
push 0x3b9
push esi
push 0x100147c
push 0xf0000
push 0x1001c6c
push 0x2000049
call fcn.01007def
pop ecx
pop ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x100a4ba
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1013f48
call fcn.0100a704
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10166ec
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100a271
cmp eax, esi
jne 0x100a264
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100a274
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100a24b
xor esi, esi
inc esi
mov eax, dword [0x10166e8]
cmp eax, esi
jne 0x100a287
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100a2b6
mov eax, dword [0x10166e8]
test eax, eax
jne 0x100a2b0
mov dword [0x10166e8], esi
push 0x1001308
push 0x10012fc
call fcn.0100a1b0
pop ecx
pop ecx
test eax, eax
je 0x100a2b6
jmp 0x100a3de
mov dword [0x10160e4], esi
mov eax, dword [0x10166e8]
cmp eax, esi
jne 0x100a2da
push 0x10012f8
push 0x10012e4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10166e8], 2
test ebx, ebx
jne 0x100a2e6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10166f8], 0
je 0x100a30a
push 0x10166f8
call fcn.0100a679
pop ecx
test eax, eax
je 0x100a30a
push 0
push 2
push 0
call dword [0x10166f8]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100a366
test al, al
je 0x100a324
cmp dword [ebp - 0x1c], 0
jne 0x100a366
mov al, byte [esi]
test al, al
je 0x100a334
cmp al, 0x20
ja 0x100a334
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100a324
test byte [ebp - 0x3c], 1
je 0x100a340
movzx eax, word [ebp - 0x38]
jmp 0x100a343
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x10160e0], eax
cmp dword [0x10160d4], 0
jne 0x100a3ba
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100a375
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100a388
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100a311
cmp dword [0x10160e4], 0
jne 0x100a3c9
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10160e0]
jmp 0x100a3ea
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100a749
ret
call fcn.0100a851
jmp 0x100a211
Function at 0x100b671
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1016034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x100b805
xor eax, eax
cmp ax, word [esi]
je 0x100b805
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.0100b46f
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x100b7ee
push edi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0100b451
cmp eax, ebx
jl 0x100b782
cmp dword [ebp - 0x1c], 1
jne 0x100b74d
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100b6e7
mov ecx, dword [ebp - 0x14]
sub eax, edx
sar eax, 1
lea esi, [ecx + eax*2]
cmp dword [ebp - 0xc], ebx
je 0x100b711
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
push dword [ebp - 8]
cmp esi, ebx
je 0x100b7c2
xor eax, eax
mov word [esi], ax
call fcn.0100bf26
test eax, eax
jne 0x100b743
push ebx
push dword [ebp - 8]
call edi
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x100b717
mov esi, dword [ebp - 0x14]
movzx eax, word [esi]
cmp ax, 0x61
jb 0x100b75f
cmp ax, 0x7a
jbe 0x100b76b
cmp ax, 0x41
jb 0x100b711
cmp ax, 0x5a
ja 0x100b711
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x100b711
push 0x5c
pop eax
cmp ax, word [esi + 4]
jne 0x100b711
add esi, 8
jmp 0x100b711
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1002ce8
push 0x3000000
push 0x1016414
mov dword [ebp - 0x10], eax
call fcn.0100b1ab
add esp, 0x14
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
jmp 0x100b7f7
call fcn.0100bf26
xor esi, esi
inc esi
cmp eax, esi
je 0x100b7e9
push ebx
push dword [ebp - 8]
call edi
cmp eax, esi
je 0x100b7e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x20]
push 0x1002c88
jmp 0x100b799
mov dword [ebp - 0x18], esi
jmp 0x100b7ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
jmp 0x100b80f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100a4c9
leave
ret 4