joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001fb50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1009ab90
push 0x10054cd0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdb8
mov eax, dword [0x100a11a4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
cmp dword [ebp - 0x24c], 0xffffffff
je 0x1001fc4f
mov dword [ebp - 4], 0
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x1001fc31
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001fc16
mov dword [ebp - 0x254], 1
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x258], ecx
jmp 0x1001fc31
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x250], eax
jmp 0x1001fbe0
mov dword [ebp - 4], 0xfffffffe
call fcn.1001fc3f
jmp 0x1001fc4d
jmp 0x1001fc59
mov dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret 4

Function at 0x1001fc80
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x244], 0
cmp dword [ebp - 0x238], 0xffffffff
je 0x1001fd6c
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x238]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x1001fd5d
xor edx, edx
mov byte [ebp - 0x231], dl
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x231]
call fcn.1001ed10
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001fd42
mov ecx, dword [ebp - 0x228]
push ecx
push 0x1001f990
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x1001fd42
mov dword [ebp - 0x240], 1
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x244], edx
jmp 0x1001fd5d
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x238]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x23c], eax
jmp 0x1001fce6
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001fd76
mov dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
Function at 0x1001ffb0
Capabilities:
Patch process command line

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
push str.NtQueryInformationProcess
push 0x10085818
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1002008e
push 0
push 0x18
lea eax, [ebp - 0x28]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1002008e
push 0
push 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x24]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1002008e
push 0
push 8
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1002008e
movzx edx, word [ebp - 0xc]
xor eax, eax
add edx, 2
setb al
neg eax
or eax, edx
push eax
call fcn.100633a8
add esp, 4
mov dword [ebp - 0x2c], eax
movzx ecx, word [ebp - 0xc]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10053860
add esp, 0xc
push 0
movzx eax, word [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret

Function at 0x100206e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1009aa50
push 0x10054cd0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdbc
mov eax, dword [0x100a11a4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x250], 0
cmp dword [ebp - 0x24c], 0xffffffff
je 0x100207c9
mov dword [ebp - 4], 0
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x100207ab
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10020790
mov dword [ebp - 0x250], 1
jmp 0x100207ab
lea ecx, [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x254], eax
jmp 0x10020766
mov dword [ebp - 4], 0xfffffffe
call fcn.100207b9
jmp 0x100207c7
jmp 0x100207d3
mov dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret 4
Function at 0x10020820
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.10002cc0
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
mov edx, dword [ebp + 0xc]
push edx
call fcn.10002cc0
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
mov eax, dword [ebp + 8]
push eax
call fcn.10002cc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1001e550
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x1c]
push ecx
push 0x1001f7d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100208c4
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x1c]
call fcn.1001e8d0
mov eax, dword [ebp - 0x24]
jmp 0x100208d6
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x1c]
call fcn.1001e8d0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002a420
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a6a6
mov eax, dword fs:[0]
push eax
sub esp, 0x698
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6a0], ecx
cmp dword [ebp + 8], 0
jne 0x1002a45e
xor eax, eax
jmp 0x1002a63d
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x1002a46f
xor eax, eax
jmp 0x1002a63d
mov edx, dword [ebp + 8]
mov dword [ebp - 0x688], edx
mov eax, dword [ebp - 0x688]
add eax, 2
mov dword [ebp - 0x694], eax
mov ecx, dword [ebp - 0x688]
mov dx, word [ecx]
mov word [ebp - 0x68a], dx
add dword [ebp - 0x688], 2
cmp word [ebp - 0x68a], 0
jne 0x1002a487
mov eax, dword [ebp - 0x688]
sub eax, dword [ebp - 0x694]
sar eax, 1
mov dword [ebp - 0x698], eax
mov ecx, dword [ebp - 0x698]
mov dword [ebp - 0x69c], ecx
cmp dword [ebp - 0x69c], 0x104
jl 0x1002a4db
xor eax, eax
jmp 0x1002a63d
push 0x410
push 0
lea edx, [ebp - 0x420]
push edx
call fcn.10053860
add esp, 0xc
push 0x10086bd4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x260
lea ecx, [ebp - 0x684]
call fcn.100062d0
lea ecx, [ebp - 0x684]
call fcn.10026d30
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x684]
call fcn.1002a7f0
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0
je 0x1002a606
lea ecx, [ebp - 0x684]
call fcn.1002b0c0
test eax, eax
je 0x1002a572
lea ecx, [ebp - 0x684]
call fcn.1002aae0
mov dword [ebp - 0x690], eax
jmp 0x1002a543
push 4
lea ecx, [ebp - 0x424]
call fcn.100062d0
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x684]
call fcn.1002ac20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x684]
call fcn.1002b0a0
test eax, eax
je 0x1002a5cf
lea ecx, [ebp - 0x424]
call fcn.100034b0
push eax
mov ecx, dword [ebp - 0x6a0]
call fcn.1002a420
lea ecx, [ebp - 0x424]
call fcn.100034b0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1002a5e1
lea ecx, [ebp - 0x424]
call fcn.100034b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x684]
call fcn.1002aae0
mov dword [ebp - 0x690], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
call fcn.10003140
jmp 0x1002a543
lea ecx, [ebp - 0x684]
call fcn.10029f50
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.10026db0
mov eax, dword [ebp - 0x6a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a660
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a6db
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.10053860
add esp, 0xc
push 1
push 0x19
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 4
lea ecx, [ebp - 0x424]
call fcn.100062d0
lea ecx, [ebp - 0x424]
call fcn.10002d70
mov dword [ebp - 4], 0
xor edx, edx
mov byte [ebp - 0x425], dl
lea ecx, [ebp - 0x425]
call fcn.10028420
push eax
push str._s.lnk
lea eax, [ebp - 0x424]
push eax
call fcn.100046a0
add esp, 0xc
lea ecx, [ebp - 0x424]
call fcn.100034b0
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002a738
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.10053860
add esp, 0xc
push 1
push 0x17
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov byte [ebp - 0x426], al
lea ecx, [ebp - 0x426]
call fcn.100293d0
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002a7a5
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x42c]
call fcn.1002a420
push 0
push 0
push 0x1000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.10003140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
Function at 0x1002b490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x104
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.10053860
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x41d], cl
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x41c]
push ecx
push str.DisplayIcon
lea ecx, [ebp - 0x41d]
call fcn.10029930
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xea
jne 0x1002b52d
jmp 0x1002b5b6
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x104
push 0x208
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.10053860
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x41e], al
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x41c]
push eax
push str.UninstallString
lea ecx, [ebp - 0x41e]
call fcn.10028cc0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xea
jne 0x1002b5a4
jmp 0x1002b5b6
mov dword [ebp - 0x428], 0
xor ecx, ecx
jne 0x1002b4b3
cmp dword [ebp - 0x428], 0
je 0x1002b5ca
mov ecx, dword [ebp - 0x42c]
call fcn.1002b980
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
Function at 0x1002b5e0
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x218], 4
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 4
xor eax, eax
mov byte [ebp - 0x219], al
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0x10086c04
lea ecx, [ebp - 0x219]
call fcn.10028bf0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1002b65d
cmp dword [ebp - 0x210], 1
je 0x1002b662
jmp 0x1002b76c
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.10053860
add esp, 0xc
push 1
push 0x19
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov byte [ebp - 0x21a], al
lea ecx, [ebp - 0x21a]
call fcn.10028470
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..lnk
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002b70a
mov dword [ebp - 0x210], 0
xor ecx, ecx
mov byte [ebp - 0x21b], cl
push 4
lea edx, [ebp - 0x210]
push edx
push 4
push 0x10086c24
lea ecx, [ebp - 0x21b]
call fcn.10028e30
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1002b76c
mov ecx, dword [ebp - 0x220]
call fcn.1002a660
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x220]
call fcn.10029fc0
test eax, eax
je 0x1002b76c
mov ecx, dword [ebp - 0x220]
call fcn.1002b980
mov dword [ebp - 0x210], 0
xor ecx, ecx
mov byte [ebp - 0x21c], cl
push 4
lea edx, [ebp - 0x210]
push edx
push 4
push str.shortcut
lea ecx, [ebp - 0x21c]
call fcn.10027520
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.10029c90
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x210], 0x104
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.10053860
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x215], cl
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0x10086990
lea ecx, [ebp - 0x215]
call fcn.10029420
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x220], eax
xor edx, edx
mov byte [ebp - 0x216], dl
lea ecx, [ebp - 0x216]
call fcn.10027ba0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1002b854
jmp 0x1002b87d
cmp dword [ebp - 0x220], 0
jne 0x1002b86a
mov ecx, dword [ebp - 0x21c]
call fcn.1002b980
jmp 0x1002b87d
mov ecx, dword [ebp - 0x21c]
call fcn.1002b980
xor ecx, ecx
jne 0x1002b7c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
Function at 0x1002f3d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x1002f5d4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1002f5d4
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.10053860
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push 0x1008a0d4
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x1002f5a9
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1002f598
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x1002f562
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push 0x1008a110
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002f55a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.10053860
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.1002f5f0
add esp, 0x18
test eax, eax
je 0x1002f55a
cmp byte [ebp - 0x68], 0
je 0x1002f51c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x1002f55a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x1002f549
mov al, byte [esi + ecx]
test al, al
je 0x1002f549
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1002f530
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1002f470
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x1002f5d4
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.10030670
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.10036c51
mov esp, ebp
pop ebp
ret
Function at 0x1002f710
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002f88f
cmp dword [ebp + 0xc], 0x20
jb 0x1002f88f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.10053860
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x1008a17c
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1002f88f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f7a0
sub ecx, edx
cmp ecx, 0x40
jne 0x1002f88f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x1002f7dc
mov al, byte [esi + ecx]
test al, al
je 0x1002f7dc
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1002f7c6
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x1002f819
mov al, byte [esi + ecx]
test al, al
je 0x1002f819
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1002f800
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.10053860
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1002f8a0
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x1002f88f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.10030670
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.10036c51
mov esp, ebp
pop ebp
ret
Function at 0x10030160
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.10036c70
mov eax, dword [0x100a11a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x100302cd
cmp dword [ebp + 0xc], 0
je 0x100302cd
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push 0x1008a084
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.100306e0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100302b0
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.10053860
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100302a5
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.10053860
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.10031470
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.10030670
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x100302ba
inc esi
cmp esi, 0x10
jl 0x100301a0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10036c51
mov esp, ebp
pop ebp
ret