joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402798
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402778
xor eax, eax
push ebp
push 0x402771
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402778
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402de0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x405034], 0
je 0x402e41
cmp word [0x405208], 0xd7b2
jne 0x402e09
cmp dword [0x405210], 0
jbe 0x402e09
mov eax, 0x405204
call dword [0x405220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x404054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402e68
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x404018], 0
jne 0x402e5d
push 0
push 0x40404c
push 0x404054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4033a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403406
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004025f4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4033f0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40340d
lea eax, [ebp - 0x10]
call fcn.00402f5c
ret
Function at 0x403a3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040312c
xor eax, eax
push ebp
push 0x403b10
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
mov edx, dword [ebp - 4]
call fcn.00403878
lea eax, [ebp - 0x24c]
xor ecx, ecx
mov edx, 0x44
call fcn.004025d4
mov dword [ebp - 0x24c], 0x44
mov dword [ebp - 0x220], 1
mov word [ebp - 0x21c], si
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x403ad5
call sub.kernel32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x403af7
test bl, bl
je 0x403af7
push 0xffffffffffffffff
mov eax, dword [ebp - 0x25c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x25c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b17
lea eax, [ebp - 4]
call fcn.00402f5c
ret

Function at 0x403b20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040312c
xor eax, eax
push ebp
push 0x403c35
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetTopWindow
mov ebx, eax
test ebx, ebx
je 0x403c0f
push 0xff
lea eax, [ebp - 0x103]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x403bfd
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x103]
mov ecx, 0xff
call fcn.00403080
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00403850
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00403850
mov eax, dword [ebp - 0x110]
pop edx
call fcn.00403210
mov esi, eax
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x103]
mov ecx, 0xff
call fcn.00403080
mov edx, dword [ebp - 0x114]
mov eax, 0x403c4c
call fcn.00403210
test esi, esi
jle 0x403bfd
test eax, eax
jle 0x403c0f
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x403b6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c3c
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00402f80
lea eax, [ebp - 4]
call fcn.00402f5c
ret
Function at 0x409000
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x409006
or ebp, 0xffffffff
xor ebx, ebx
pop esi
lea edi, [esi - 0x8006]
push edi
add word [edi], 0
add esi, 0x1b3
jmp 0x40902e
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409028
mov eax, 1
add ebx, ebx
jne 0x40904b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x409040
jne 0x40905c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409040
xor ecx, ecx
sub eax, 3
jb 0x4090ca
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4090e6
mov ebp, eax
add ebx, ebx
jne 0x40907b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409088
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4090ac
inc ecx
add ebx, ebx
jne 0x409098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x40908d
jne 0x4090a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40908d
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x4090d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4090bc
jmp 0x40902e
mov eax, ebp
jmp 0x409070
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4090d0
add edi, ecx
jmp 0x40902e
pop esi
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0xa8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4090f6
cmp byte [edi], 0
jne 0x4090f6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4090fb
pop edi
mov eax, dword [edi]
or eax, eax
je 0x409166
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7078]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409123
push edx
mov ecx, edi
jns 0x409153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x707c]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x409140
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x409197
cmp al, 0xef
ja 0x40918a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40916c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x409179
popal
jmp 0x404516
Function at 0x100019c7
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x100019e8
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x100019df
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x100019d7
mov eax, ebx
leave
ret

Function at 0x10001a0e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x10001a6d
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x10001a9a
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x10001a89
xor ecx, eax
xor edx, ebx
dec edi
jne 0x10001a7a
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x10001ac0
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x10001a61
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x10002300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.1000198d
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x100024df
push dword [ebp - 4]
call fcn.10001971
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100023d0
jmp 0x100024df
push dword [ebp - 4]
call fcn.10001971
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x10002424
lea eax, [ebp - 4]
push eax
call fcn.100022e6
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.10001b98
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10002424
mov eax, 1
jmp 0x10002426
xor eax, eax
test eax, eax
je 0x100024d4
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x100024cc
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.10002103
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100024bb
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.100022bf
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x1000246e
add esp, 0xc
jmp 0x100024df
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x100023a9
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x10002500
mov esp, ebp
pop ebp
ret 8
Function at 0x10008091
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x100f8802]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100080cc
add dword [esp], 5
retf

Function at 0x1000876d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [0x100f8922]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100087b0
push 0x2b
push 0x40112d9
push 6
call fcn.1001ee16
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x100e924b]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100030ed
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.10020f10
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10008803
push ebx
call fcn.1001ee2e
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10008839
push 0x84
push 0x40112d9
push 6
call fcn.1001ee16
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x10008855
push eax
mov ebx, eax
call fcn.10003a93
inc eax
push eax
call fcn.1001ee28
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1000885a
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000886b
push ebx
call fcn.1001ee2e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ae7e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push 0x100e9218
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
nop
nop
cmp dword [ebp - 4], esp
je 0x1001aeba
push 0x24
push 0x4011966
push 6
call fcn.1001ee16
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x1001aece
mov esp, ebp
pop ebp
ret

Function at 0x1001c18d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1001c1bd
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001c1e4
push 0x19
push 0x4011988
push 6
call fcn.1001ee16
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001c1fb
mov eax, 0x100e9225
jmp 0x1001c2b1
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x100f7bfe]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.100030ed
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.100202b0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001c246
push ebx
call fcn.1001ee2e
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.1001bf91
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1001c26b
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1001c292
push 0xf8
push 0x4011988
push 6
call fcn.1001ee16
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x1001c2ac
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1001ee28
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1001c2b1
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001c2c2
push ebx
call fcn.1001ee2e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.10023d90
mov edi, dword [esp + 0x38]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
call dword [0x100f8f10]
add esp, 8
cmp ebp, esi
je 0x1001f9f0
cmp eax, esi
je 0x1001f9f0
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1001f986
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1001f9de
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f9d3
cmp dword [esp + 0x14], edi
jne 0x1001f9d3
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x1001f9fc
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x1001fa00
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x10005b50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10085640
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1007ab2c
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10006730
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10005ba4
jmp dword [ecx*4 + 0x10005d0c]
mov al, byte [esi]
test al, al
je 0x10005bd2
cmp al, 0x20
je 0x10005bbe
cmp al, 0xa1
jne 0x10005bd2
cmp byte [esi + 1], al
jne 0x10005bd2
test al, 0x80
je 0x10005bca
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10005bd2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10005bb1
test ecx, ecx
je case.default.0x10005ba4
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10005ba4
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10005c18
cmp dl, 0xa1
jne 0x10005c0c
cmp byte [eax + 1], 0xa1
jne 0x10005c0c
test ecx, ecx
jne 0x10005c04
mov edi, eax
mov ecx, 1
inc eax
jmp 0x10005c2c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10005c46
jmp 0x10005c2c
cmp dl, 0x20
jne 0x10005c2a
test ecx, ecx
jne 0x10005c23
mov edi, eax
mov ecx, 1
jmp 0x10005c2c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10005bec
cmp ecx, 1
jne case.default.0x10005ba4
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10005ba4
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10005ba4
mov al, byte [esi]
test al, al
je 0x10005c9e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10005c84
mov cl, byte [esi + 1]
test cl, cl
je 0x10005c9e
cmp al, 0xa1
jne 0x10005c74
cmp cl, al
je 0x10005c81
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.100069c0
inc esi
jmp 0x10005c96
cmp al, 0x20
je 0x10005c96
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10006a00
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10005c5d
push 0
lea ecx, [esp + 0x14]
call fcn.10006a00
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100168e0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10005cd1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x1008e64c
call fcn.10006930
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1007aabe
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1000e870
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x10085e3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.1007a833
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x1000e8f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.1007870d
mov eax, dword [eax]
push 0x100a5c88
push eax
call fcn.1006b3b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1007aabe
test bl, bl
je 0x1000e8f2
push 0x100a5c88
lea ecx, [esp + 0xc]
call fcn.1007ae4e
push 0x100a5c94
lea ecx, [esp + 0xc]
call fcn.1007ae4e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1000e92e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1007aabe
jmp 0x1000e9f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x1000e9b2
lea edx, [esp + 0x7c]
push 0x100a5c90
push edx
call fcn.1006b3b4
add esp, 8
test eax, eax
je 0x1000e9b2
lea eax, [esp + 0x7c]
push 0x100a5c8c
push eax
call fcn.1006b3b4
add esp, 8
test eax, eax
je 0x1000e9b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000e942
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1007aabe
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1000f200
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1000f262
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc