joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5d00
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf07a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x50331c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.00422c0c
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [ebp + 8]
push eax
push str._s_del__x
lea eax, [ebp - 0x14]
call fcn.004229e7
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4c5dea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
call fcn.00421fdc
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004909ca
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4c5db8
push 4
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00422c02
mov eax, dword [ebp - 0x1c]
jmp 0x4c5e03
push 4
push 0
lea eax, [ebp - 0x14]
call fcn.00421fdc
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4c5dea
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00422c02
mov eax, dword [ebp - 0x20]
jmp 0x4c5e03
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00422c02
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4c6c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf3f3
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov eax, dword [ebp - 0x260]
add eax, 0xc
call fcn.004220b9
movzx eax, al
test eax, eax
jne 0x4c6d01
mov eax, dword [ebp - 0x260]
add eax, 8
call fcn.004220b9
movzx ecx, al
test ecx, ecx
jne 0x4c6d01
mov eax, dword [ebp - 0x260]
add eax, 0x10
call fcn.004220b9
movzx edx, al
test edx, edx
je 0x4c6d08
xor eax, eax
jmp 0x4c6ea4
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
or ecx, 0x20019
push ecx
push 0
mov eax, dword [ebp - 0x260]
add eax, 0xc
call fcn.00421fdc
push eax
mov edx, dword [ebp - 0x260]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x4c6d67
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4c6ea4
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x228], 0x105
mov word [ebp - 0x224], 0
push 0x208
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.00489db0
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x260]
add eax, 8
call fcn.00421fdc
push eax
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x22c], 0
jne 0x4c6ea2
cmp dword [ebp - 0x10], 1
jne 0x4c6ea2
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.00422646
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x234]
push ecx
call fcn.004c67b0
add esp, 4
push 0x105
lea esi, [ebp - 0x234]
call fcn.004228e8
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
or eax, 0xffffffff
lea esi, [ebp - 0x234]
call fcn.004228cf
mov eax, dword [ebp - 0x260]
add eax, 0x10
call fcn.00421fdc
push eax
push 0x105
lea esi, [ebp - 0x234]
call fcn.004228e8
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
or eax, 0xffffffff
lea esi, [ebp - 0x234]
call fcn.004228cf
lea edx, [ebp - 0x234]
push edx
call fcn.004c5630
add esp, 4
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00422c02
mov eax, dword [ebp - 0x238]
jmp 0x4c6ea4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret 4
Function at 0x4c7470
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x244], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00422646
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea edx, [ebp - 0x23c]
push edx
call fcn.00489db0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c74ce
jmp 0x4c7537
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x4c74f9
jmp 0x4c7537
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 8]
call fcn.0042606f
test eax, eax
jne 0x4c7523
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x238]
mov dword [eax], ecx
mov dword [ebp - 0x244], 1
jmp 0x4c7537
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c74f9
cmp dword [ebp - 4], 0xffffffff
je 0x4c7547
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x244]
mov dword [ebp - 0x24c], edx
lea ecx, [ebp - 8]
call fcn.00422c02
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4c7570
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf4f9
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x228], 0
push 0
lea ecx, [ebp - 0x230]
call fcn.00486f70
mov dword [ebp - 4], 0
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x224], 0
push 0x206
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00489db0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00422c0c
mov byte [ebp - 4], 1
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4c7662
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4c7662
push 0x4e0eb4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00422646
mov edx, dword [ebp - 0x234]
or edx, 1
mov dword [ebp - 0x234], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00422c02
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004883f0
mov eax, dword [ebp + 8]
jmp 0x4c774a
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x22c], 0
jne 0x4c7683
jmp 0x4c7709
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea ecx, [ebp - 0x224]
push ecx
call fcn.00489b50
add esp, 4
test eax, eax
je 0x4c76c7
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00422bc8
lea ecx, [ebp - 0x230]
call fcn.0047e910
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4c7709
lea ecx, [ebp - 0x230]
call fcn.004883e0
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x280]
push eax
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 8]
call fcn.00422bb6
mov ecx, dword [ebp - 0x234]
or ecx, 1
mov dword [ebp - 0x234], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00422c02
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004883f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4c78c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 4
call fcn.004220b9
movzx eax, al
test eax, eax
je 0x4c78df
xor eax, eax
jmp 0x4c7932
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00421fdc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c78fe
xor eax, eax
jmp 0x4c7932
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x4c791e
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00421fdc
push eax
call fcn.004c7240
add esp, 4
jmp 0x4c7932
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00421fdc
push eax
call fcn.004c5d00
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x4c8a10
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.SbieDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x4cc1c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfc09
mov eax, dword fs:[0]
push eax
sub esp, 0x560
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54c], ecx
mov word [ebp - 0x4cc], 0
push 0x18e
push 0
lea eax, [ebp - 0x4ca]
push eax
call fcn.00489db0
add esp, 0xc
push 0x324
push 0
lea ecx, [ebp - 0x33c]
push ecx
call fcn.00489db0
add esp, 0xc
lea edx, [ebp - 0x4cc]
push edx
call fcn.004cd760
add esp, 4
test eax, eax
jne 0x4cc244
mov eax, 1
jmp 0x4cc431
lea eax, [ebp - 0x33c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call fcn.00422bc8
mov eax, dword [ebp + 8]
add eax, 8
mov ecx, 0x32
lea edx, [ebp - 0x4f8]
call fcn.00422893
mov dword [ebp - 0x550], eax
mov edx, dword [ebp - 0x550]
mov dword [ebp - 0x554], edx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
add edi, 8
mov eax, dword [ebp - 0x554]
call fcn.00422ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f8]
call fcn.00422c02
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
call fcn.00422bc8
mov eax, dword [ebp + 8]
add eax, 0xc
mov ecx, 0x32
lea edx, [ebp - 0x4fc]
call fcn.00422893
mov dword [ebp - 0x558], eax
mov edx, dword [ebp - 0x558]
mov dword [ebp - 0x55c], edx
mov dword [ebp - 4], 1
mov edi, dword [ebp + 8]
add edi, 0xc
mov eax, dword [ebp - 0x55c]
call fcn.00422ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4fc]
call fcn.00422c02
lea eax, [ebp - 0x4cc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00422bc8
mov ecx, 0x32
lea edx, [ebp - 0x500]
mov eax, dword [ebp + 8]
call fcn.00422893
mov dword [ebp - 0x560], eax
mov edx, dword [ebp - 0x560]
mov dword [ebp - 0x564], edx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x564]
mov edi, dword [ebp + 8]
call fcn.00422ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x500]
call fcn.00422c02
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x568], 0
fild qword [ebp - 0x56c]
fdiv qword [0x4ed070]
sub esp, 8
fstp qword [esp]
push str._.2f_GHZ
mov eax, dword [ebp + 8]
add eax, 4
call fcn.004229e7
add esp, 0xc
mov dword [ebp - 0x4f4], 0
xor ecx, ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x4d8], ecx
mov dword [ebp - 0x4d4], ecx
push 0x4e20f8
push 0x4e210c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0
jne 0x4cc413
lea edx, [ebp - 0x4f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x4cc420
lea eax, [ebp - 0x4f4]
push eax
call dword [ebp - 0x4d0]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x4e0]
mov dword [ecx + 0x10], edx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret 4
Function at 0x4cd8f0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf537
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.00422646
mov dword [ebp - 4], 0
lea eax, [ebp - 0x228]
call fcn.00418503
cmp eax, 3
jl 0x4cd9a4
mov ecx, 3
lea edx, [ebp - 0x66c]
lea eax, [ebp - 0x228]
call fcn.00422893
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x69c], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x69c]
lea edi, [ebp - 0x228]
call fcn.00422ab0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x66c]
call fcn.00422c02
mov dword [ebp - 0x668], 0x104
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x444], 0x104
mov ecx, dword [ebp - 0x444]
push ecx
lea edx, [ebp - 0x664]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 0x44c]
push edx
mov eax, dword [ebp - 0x668]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea eax, [ebp - 0x228]
call fcn.00421fdc
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x4cda4c
mov dword [ebp - 0x670], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00422c02
mov eax, dword [ebp - 0x670]
jmp 0x4cda85
mov edx, dword [ebp - 0x44c]
push edx
push 0x4e1c60
mov eax, dword [ebp + 8]
call fcn.004229e7
add esp, 8
mov dword [ebp - 0x674], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00422c02
mov eax, dword [ebp - 0x674]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4ce2a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf31b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50331c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], str.QQPCRTP
push 0x4df9c0
push 0x4df9d8
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x18]
push eax
call fcn.004ce1b0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
call fcn.004220b9
movzx ecx, al
test ecx, ecx
je 0x4ce315
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00422c02
jmp 0x4ce387
lea eax, [ebp - 0x18]
call fcn.00421fdc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ce339
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00422c02
jmp 0x4ce387
mov dword [ebp - 0x1c], 0
jmp 0x4ce34b
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 1
jae 0x4ce370
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x10]
push ecx
call fcn.00433905
add esp, 4
test eax, eax
je 0x4ce36e
mov dword [ebp - 0x14], 1
jmp 0x4ce370
jmp 0x4ce342
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00422c02
xor edx, edx
jne 0x4ce2d3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4ce670
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cff9d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x50331c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.004c6920
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4ce6bb
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4ce6c0
jmp 0x4ce77b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ce6d3
jmp 0x4ce77b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004c68f0
test eax, eax
jne 0x4ce6e8
jmp 0x4ce77b
lea ecx, [ebp - 0x34]
call fcn.00486640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004c8420
test eax, eax
jne 0x4ce712
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00486750
jmp 0x4ce77b
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp - 0x34]
push edx
call fcn.00486670
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x38]
push eax
call fcn.004ce4d0
add esp, 0x14
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x38]
call fcn.00418503
push eax
lea eax, [ebp - 0x38]
call fcn.00421fdc
push eax
push 0x100
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004898fa
add esp, 0x10
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x38]
call fcn.00422c02
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00486750
xor edx, edx
jne 0x4ce6ab
lea ecx, [ebp - 0x20]
call fcn.004c57b0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004c57d0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x10d3e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00010d05
pop ebp
jmp fcn.00010680
Function at 0x100c855
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x102e77c]
push ebx
push esi
push edi
push 4
pop edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 1
xor esi, esi
push esi
push 0x1001808
push 0x80000002
mov dword [ebp - 0x210], esi
xor ebx, ebx
mov dword [ebp - 0x21c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c945
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push 0x10017f8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c8e0
cmp dword [ebp - 0x214], edi
jne 0x100c8de
cmp dword [ebp - 0x218], esi
je 0x100c8de
inc ebx
jmp 0x100c8e0
xor ebx, ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x100c945
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x10017bc
call dword [fcn.010010f8]
test eax, eax
je 0x100c945
push 2
pop edi
push esi
push 0x80000080
push 2
push esi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [fcn.010010fc]
cmp eax, 0xffffffff
mov dword [0x102e060], eax
jne 0x100c945
push 0x3e8
call dword [0x1001100]
dec edi
cmp edi, esi
jg 0x100c90e
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102222e
leave
ret

Function at 0x100c9d4
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x102e060], 0xffffffff
mov eax, dword [0x102e77c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
je 0x100ca53
push dword [ebp + 0xc]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
push 0x1001858
lea eax, [ebp - 0x2c]
push 0x28
push eax
call fcn.0100c96e
add esp, 0x14
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
je 0x100ca53
lea eax, [ebp - 0x2c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ca23
push 0
lea ecx, [ebp - 0x30]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [0x102e060]
call dword [fcn.010010f0]
lea eax, [ebp - 0x2c]
push eax
push 0x1001854
call fcn.010230f4
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0102222e
leave
ret 8
Function at 0x100ca64
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
cmp dword [0x102e060], 0xffffffff
mov eax, dword [0x102e77c]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
je 0x100cb1a
push eax
push 0x1001868
lea eax, [ebp - 0x40c]
push 9
push eax
call fcn.0100c96e
add esp, 0x10
test eax, eax
jne 0x100cb1a
push edi
push esi
mov esi, 0x400
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.0100c7c7
test eax, eax
jne 0x100cb1a
push 0x1001864
push esi
lea eax, [ebp - 0x40c]
push eax
call fcn.0100c99c
test eax, eax
jne 0x100cb1a
lea eax, [ebp - 0x40c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100cae1
push 0
lea ecx, [ebp - 0x410]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [0x102e060]
call dword [fcn.010010f0]
lea eax, [ebp - 0x40c]
push eax
push 0x1001854
call fcn.010230f4
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0102222e
leave
ret 0xc