joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e23a8
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x50f09d], 1
call fcn.00488544
test al, al
jne 0x4e23fa
push 5
mov eax, dword [0x507e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x507e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x507e7c]
mov eax, dword [eax + 0x124]
mov cl, 2
xor edx, edx
call fcn.004e228c
ret

Function at 0x4e58f4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4e5919
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e76a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4e76cc
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4e76d5
call fcn.004e63c0
mov eax, 0xa
call fcn.00482104
call fcn.004e63c0
call fcn.004e766c
test al, al
jne 0x4e76aa
pop ebx
ret

Function at 0x4e7bf8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x507a08]
cmp dword [eax], 0
je 0x4e7ca3
mov eax, dword [0x507a08]
mov eax, dword [eax]
call fcn.004649a0
test al, al
je 0x4e7ca3
mov eax, dword [0x507a08]
mov eax, dword [eax]
cmp byte [eax + 0x1e2], 0
je 0x4e7c4d
cmp byte [ebx + 0x389], 0
jne 0x4e7c4d
mov eax, dword [0x507e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4e7c51
xor eax, eax
jmp 0x4e7c53
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x507a08]
mov eax, dword [eax]
call fcn.004645f4
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x4e7ca3
test bl, bl
je 0x4e7c8f
push 5
mov eax, dword [0x507a08]
mov eax, dword [eax]
call fcn.004645f4
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e7ca3
push 0
mov eax, dword [0x507a08]
mov eax, dword [eax]
call fcn.004645f4
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4e7d54
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x50f056], 0
push 0x4e7e2c
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
push 0x4e7e48
push ebx
call fcn.00409620
test eax, eax
je 0x4e7de0
lea edx, [esp + 4]
push edx
call eax
push 0x4e7e70
push ebx
call fcn.00409620
mov esi, eax
test esi, esi
je 0x4e7dea
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4e7dea
cmp dword [esp], 0
je 0x4e7dea
call fcn.004853e8
test al, al
je 0x4e7dea
push 0x4e7e90
push ebx
call fcn.00409620
test eax, eax
je 0x4e7dea
push 0x4e7ec4
push 0x4e7ee4
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409620
test eax, eax
je 0x4e7dea
mov byte [0x50f056], 1
jmp 0x4e7dea
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
movzx eax, word [esp + 4]
sub ax, 1
jb 0x4e7e03
sub ax, 5
je 0x4e7e0c
sub ax, 3
je 0x4e7e15
jmp 0x4e7e1e
mov byte [0x50748c], 1
jmp 0x4e7e25
mov byte [0x50748c], 3
jmp 0x4e7e25
mov byte [0x50748c], 2
jmp 0x4e7e25
mov byte [0x50748c], 0
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4e7f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e7f70
mov edx, 0x80000002
xor eax, eax
call fcn.004811a4
test eax, eax
jne 0x4e7f69
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4e7fc4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4e7f60
cmp dword [ebp - 0xc], 4
jne 0x4e7f60
cmp dword [ebp - 8], 4
jne 0x4e7f60
movzx eax, word [ebp - 0x10]
mov word [0x50f06c], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret

Function at 0x4e816c
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e821b
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x50f068], eax
cmp byte [0x50f055], 0
je 0x4e821b
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4e820c
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e821b
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x50f06c], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x50f06e], al
movzx eax, word [esp + 0x22c]
mov word [0x50f070], ax
jmp 0x4e821b
cmp eax, 4
jne 0x4e821b
call fcn.004e7f00
call fcn.004e7fdc
add esp, 0x230
ret
Function at 0x4f3538
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4f370a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00406584
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x507908]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.004811a4
test eax, eax
jne 0x4f36ef
xor eax, eax
push ebp
push 0x4f36e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.004928c8
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x4f35c9
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x4f35f6
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x4f3618
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x4f368e
sub eax, 0xe9
je 0x4f3632
sub eax, 0x19
je 0x4f36cd
jmp 0x4f3687
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f3649
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x4f365c
call fcn.00404b68
jmp 0x4f36ef
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4f3673
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406584
jmp 0x4f35bd
call fcn.00404b68
jmp 0x4f36ef
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.004928c8
lea eax, [ebp - 4]
call fcn.00406eb8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00406584
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.004a3a58
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00490a60
inc ebx
jmp 0x4f35bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f36eb
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3711
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4f912c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f91b0
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4f9198
mov ebx, esi
test ebx, ebx
je 0x4f915e
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004064d4
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4f91cc
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x4f919a
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f91b7
lea eax, [ebp - 8]
call fcn.00406438
ret

Function at 0x4fd738
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fd87b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4fd894
mov edx, ebx
call fcn.00406914
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4fd855
xor eax, eax
push ebp
push 0x4fd84e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4fd8b0
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0040eb68
test eax, eax
jne 0x4fd81f
test byte [ebp - 0x258], 0x10
jne 0x4fd81f
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00406640
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406914
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x4fd811
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4fd7a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd855
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd882
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fd8bc
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4fd9bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406448
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0047fca8
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4fd9d8
call fcn.0040ee3c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4fd95c
test esi, 0x10
jne 0x4fd98c
test esi, 1
je 0x4fd95c
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4fd986
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406448
jmp 0x4fd999
inc edi
cmp edi, 0xa
je 0x4fd999
inc ebx
cmp ebx, 0x3e8
jne 0x4fd8fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd9c3
lea eax, [ebp - 0x14]
call fcn.00406438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4fe43c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fe4e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4fe500
push ebx
push 0x4fe510
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004069f8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4fe4c2
mov eax, dword [0x507e7c]
mov eax, dword [eax + 0x1a8]
call fcn.004fe394
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe4eb
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fee84
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ff072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00480d4c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00486590
test al, al
jne 0x4feef1
xor eax, eax
push ebp
push 0x4feee7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00486a80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4feef1
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [0x50f16c]
call fcn.004064d4
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4fef20
mov eax, dword [0x507e7c]
mov eax, dword [eax + 0x1a4]
call fcn.004fe394
push 0x80
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x50bb50]
push eax
push 0
mov ecx, 0x4ff080
mov edx, 0x4ff084
xor eax, eax
call fcn.0040a124
mov dword [ebp - 8], eax
push 0x4fe554
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x50f198], eax
xor eax, eax
push ebp
push 0x4ff03b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x507e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00480720
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4ff0a0
call fcn.0040ee3c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.00480600
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406854
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fe43c
mov dword [ebp - 0xc], eax
call fcn.004fe518
test al, al
jne 0x4ff01b
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4feff9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff042
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x5003c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50067a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x507e6c]
mov eax, dword [eax]
mov edx, 0x500694
call fcn.0047cb0c
push 5
mov eax, dword [0x507e6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x500641
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004e2634
lea eax, [ebp - 0x10]
call fcn.00480bc4
mov eax, dword [ebp - 0x10]
call fcn.0040e8e8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00480720
mov edx, dword [ebp - 0x14]
mov eax, 0x50f16c
call fcn.00406448
call fcn.004fe74c
lea ecx, [ebp - 0x18]
mov edx, 0x5006b4
mov eax, dword [0x50f16c]
call fcn.0047f804
mov edx, dword [ebp - 0x18]
mov eax, 0x50f170
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x5006cc
mov eax, dword [0x50f16c]
call fcn.0047f804
mov edx, dword [ebp - 0x1c]
mov eax, 0x50f174
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x50f16c]
mov dl, 1
mov eax, dword [0x4823ec]
call fcn.0048272c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500518
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004826ec
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004826c4
cmp dword [ebp - 0xc], 0x67734d49
je 0x5004f3
mov cl, 1
xor edx, edx
mov eax, dword [0x50f174]
call fcn.004839b0
jmp 0x500502
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x50f16c]
call fcn.004839b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50051f
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x407ce0
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x40f008
call fcn.004078d0
push 1
call fcn.0040735f
pop ecx
test al, al
je 0x407cbe
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00407310
mov byte [ebp - 0x24], al
mov eax, dword [0x410058]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x407cbe
test eax, eax
jne 0x407bdc
mov dword [0x410058], ecx
push 0x40ded4
push 0x40dec4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x407bbf
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x407cae
push 0x40dec0
push 0x40deb4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x410058], 2
jmp 0x407be1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00407342
pop ecx
call fcn.00407de7
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x407c12
push esi
call fcn.0040727c
pop ecx
test al, al
je 0x407c12
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.00407ded
mov esi, eax
cmp dword [esi], edi
je 0x407c30
push esi
call fcn.0040727c
pop ecx
test al, al
je 0x407c30
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00407537
test al, al
je 0x407cc5
test bl, bl
jne 0x407c63
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00407398
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x407cae
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00407594
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.0054d000
jmp 0x407b52
Function at 0x1001d10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac0
push ebx
push esi
push edi
push 0x1e
pop ecx
mov esi, 0x1001c50
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
cmp dword [ebp + 0x10], edi
push 0x7a
mov dword [ebp - 0x1c], 0x80000002
mov dword [ebp - 0x18], 0x80000001
pop ebx
jbe 0x1001e45
mov eax, dword [ebp + 0xc]
mov word [eax], di
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
cmp word [eax], di
jne 0x1001e45
lea eax, [ebp - 0x10]
push eax
push 1
push edi
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 4]
push dword [ebp + eax*4 - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x1001e38
xor esi, esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2a0]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 8], 0x410
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
inc esi
cmp ebx, edi
jne 0x1001e2f
cmp dword [ebp - 8], 2
jbe 0x1001e23
cmp dword [ebp - 0xc], 1
je 0x1001dd2
cmp dword [ebp - 0xc], 2
jne 0x1001e23
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001e23
push 0x208
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
je 0x1001e23
add eax, 2
cmp eax, dword [ebp + 0x10]
jae 0x1001e23
lea eax, [ebp - 0xac0]
push eax
push 0x1001c40
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp + 0xc]
cmp word [eax], di
je 0x1001d86
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jb 0x1001d53
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x1001f7d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0xe
pop ecx
xor esi, esi
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
push esi
rep stosd dword es:[edi], eax
call sub.IMM32.dll_ImmDisableIME
push dword [ebp + 8]
jmp loc.01004000
Function at 0x100049b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test byte [0x1000a04c], 8
jne 0x10004aa0
lea esi, [edi - 1]
test edi, edi
je 0x10004a90
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyW]
jmp 0x100049f0
add dword [ebx + 0x24], 1
sub esi, 1
cmp esi, 0xffffffff
je 0x10004a90
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10004a0e
mov edx, dword [eax]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 8
test eax, eax
je 0x100049e4
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x10004a2c
mov edx, dword [eax]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 8
test eax, eax
je 0x100049e4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebx + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call edi
sub esp, 0x10
cmp eax, 0x103
jne 0x100049e0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call edi
sub esp, 0x10
cmp eax, 0x103
je 0x10004ad1
sub esi, 1
add dword [ebx + 0x2c], 1
cmp esi, 0xffffffff
jne 0x100049f0
nop
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.enumerator__p__count__lu._n
mov dword [esp + 8], str.enum_moniker_Skip
mov dword [esp + 4], 0x1000a04c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x100049cc
mov eax, 1
jmp 0x10004a92
Function at 0x100092e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10009338
cmp byte [esi + ebx - 1], 0xa
je 0x1000930c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1001b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret