joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10157be
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0x80004005
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x18], edi
jne 0x10157e8
mov eax, 0x80070057
jmp 0x1015995
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0xc], edi
jne 0x10157f4
cmp eax, edi
je 0x1015854
neg eax
sbb eax, eax
lea edx, [ebp - 8]
push edx
and eax, 0x100
or eax, 1
push eax
push edi
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x1015854
push eax
call fcn.0100629e
mov dword [ebp - 4], eax
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101597f
test byte [eax + 0x1c], 1
je 0x101597f
push dword [ebp - 4]
push 0x1002c38
push 0xba
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dc70
jmp 0x101597f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 2
push dword [ebp + 0x10]
push edi
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x10158a2
cmp dword [ebp + 0x14], edi
je 0x1015894
cmp dword [ebp + 0x1c], edi
je 0x1015887
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01016864
jmp 0x101589a
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
call fcn.01012cbe
jmp 0x101589a
push eax
call fcn.0100629e
mov dword [ebp - 4], eax
jmp 0x101597e
mov eax, dword [ebp - 0xc]
push ebx
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
pop ecx
cmp ebx, edi
jne 0x10158f4
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1015972
test byte [eax + 0x1c], 1
je 0x1015972
push 0x1002c38
push 0xbb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
jmp 0x1015972
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 2
push dword [ebp + 0x10]
push edi
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x1015933
push eax
call fcn.0100629e
mov dword [ebp - 4], eax
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1015972
test byte [eax + 0x1c], 1
je 0x1015972
push dword [ebp - 4]
push 0x1002c38
push 0xbc
jmp 0x1015962
mov ecx, dword [ebp + 0x18]
push ebx
call fcn.01012cbe
cmp eax, edi
mov dword [ebp - 4], eax
jge 0x101596f
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1015972
test byte [eax + 0x1c], 1
je 0x1015972
push dword [ebp - 4]
push 0x1002c38
push 0xbd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dc70
jmp 0x1015972
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x101597d
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
pop esi
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x1015992
cmp eax, dword [ebp + 8]
je 0x1015992
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
leave
ret 0x1c
Function at 0x1016864
Capabilities:
Query environment variable

Disassembly:
push 0xc
mov eax, 0x101a250
call fcn.01012547
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x101695f
cmp dword [ebp + 0xc], ebx
je 0x101695f
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
or dword [ebp - 4], 0xffffffff
pop ecx
mov esi, eax
jmp 0x10168c0
cmp esi, ebx
jne 0x10168f2
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x10168eb
test byte [eax + 0x1c], 1
je 0x10168eb
push dword [ebp - 0x14]
push 0x1002f3c
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dc70
mov edi, 0x8007000e
jmp 0x101695b
push dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1016943
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1016933
test byte [eax + 0x1c], 1
je 0x1016933
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x101d014]
push 0x1002f3c
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dc70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100629e
mov edi, eax
jmp 0x1016950
mov ecx, dword [ebp + 0xc]
push esi
call fcn.01012b8a
xor esi, esi
xor edi, edi
cmp esi, ebx
je 0x101695b
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
jmp 0x1016988
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1016983
test byte [eax + 0x1c], 1
je 0x1016983
push 0x1002f3c
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
mov eax, 0x80070057
call fcn.010125fb
ret 8
Function at 0x1016d6c
Capabilities:
Get common file path

Disassembly:
push 0x90
mov eax, 0x101a312
call fcn.01012582
mov esi, dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp - 0x9c]
call fcn.0101292a
and dword [ebp - 4], 0
xor eax, eax
and dword [edi + 0xc0], eax
mov word [ebp - 0x90], ax
push 0x40
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1016e8f
cmp eax, 0x40
ja 0x1016e8f
push esi
call fcn.01016739
mov ebx, eax
test ebx, ebx
je 0x1016e74
cmp ebx, esi
je 0x1016e74
sub eax, esi
sar eax, 1
dec eax
push eax
push esi
lea ecx, [ebp - 0x9c]
call fcn.01013579
test eax, eax
jge 0x1016e20
mov ecx, dword [0x101d014]
cmp ecx, 0x101d014
je 0x1016eb3
test byte [ecx + 0x1c], 1
je 0x1016eb3
push eax
push 0x1003070
push 0x13
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100dc70
jmp 0x1016eb3
lea ecx, [ebp - 0x9c]
call fcn.01012949
push eax
lea eax, [ebp - 0x90]
push eax
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x1016eb3
xor esi, esi
push ebx
push dword [esi*8 + 0x101d82c]
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x1016e5b
inc esi
cmp esi, 2
jb 0x1016e40
jmp 0x1016eb3
mov dword [edi + 0xc0], 1
mov eax, dword [esi*8 + 0x101d830]
mov dword [edi + 0xc4], eax
jmp 0x1016eb3
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1016eb3
test byte [eax + 0x1c], 1
je 0x1016eb3
push 0x1003070
push 0x12
jmp 0x1016ea8
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1016eb3
test byte [eax + 0x1c], 1
je 0x1016eb3
push 0x1003070
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
mov edi, dword [edi + 0xc0]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0101293c
mov eax, edi
call fcn.01012614
ret 4
Function at 0x1017126
Capabilities:
Set environment variable

Disassembly:
push 0xc
mov eax, 0x101a347
call fcn.0101250f
lea ecx, [ebp - 0x18]
call fcn.0101292a
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x101722b
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x101722b
push esi
call fcn.01016739
test eax, eax
je 0x10171f1
cmp eax, esi
je 0x10171f1
sub eax, esi
sar eax, 1
dec eax
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.01013579
mov edi, eax
test edi, edi
jge 0x10171ad
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101721b
test byte [eax + 0x1c], 1
je 0x101721b
push edi
push 0x1003070
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dc70
jmp 0x101721b
lea ecx, [ebp - 0x18]
call fcn.01012949
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x10171ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100629e
mov edi, eax
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101721b
test byte [eax + 0x1c], 1
je 0x101721b
push edi
push 0x1003070
push 0xd
jmp 0x10171a0
xor edi, edi
jmp 0x101721b
mov edi, 0x80070057
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101721b
test byte [eax + 0x1c], 2
je 0x101721b
push esi
push 0x1003070
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100496d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0101293c
mov eax, edi
jmp 0x1017260
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101724f
test byte [eax + 0x1c], 1
je 0x101724f
push 0x1003070
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0101293c
mov eax, 0x80070057
call fcn.010125fb
ret 8
Function at 0x10184eb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 8], ebx
call fcn.01018480
mov dword [ebp - 4], ebx
or edi, 0xffffffff
cmp dword [esi], edi
jne 0x1018559
push ebx
push 8
push 3
push ebx
push dword [ebp + 0xc]
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, edi
jne 0x1018559
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x101853d
cmp eax, 0x21
je 0x101853d
cmp eax, 0x36
jne 0x1018551
inc dword [ebp - 4]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 5
jb 0x1018507
cmp dword [esi], edi
je 0x1018608
mov eax, dword [esi]
cmp eax, ebx
je 0x1018608
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, edi
jne 0x10185a6
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101862f
test byte [eax + 0x1c], 1
je 0x101862f
push 0x1003224
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
jmp 0x101862f
push ebx
push eax
push ebx
push 8
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x10185d6
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101862f
test byte [eax + 0x1c], 1
je 0x101862f
push 0x1003224
push 0xc
jmp 0x1018596
push ebx
push ebx
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x1018604
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101862f
test byte [eax + 0x1c], 1
je 0x101862f
push 0x1003224
push 0xd
jmp 0x1018596
xor edi, edi
jmp 0x1018648
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x101862f
test byte [eax + 0x1c], 1
je 0x101862f
push dword [ebp + 8]
push 0x1003224
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100496d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100629e
mov edi, eax
cmp edi, ebx
jge 0x1018648
mov ecx, esi
call fcn.01018480
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10189de
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x101a3e0
call fcn.01012547
mov esi, ecx
mov dword [ebp - 0x20], esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp + 8], ebx
mov dword [ebp - 0x1c], ebx
cmp edi, ebx
jne 0x1018a2f
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1018a25
test byte [eax + 0x1c], 1
je 0x1018a25
push 0x1003248
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
mov eax, 0x80070057
jmp 0x1018be3
lea ecx, [esi + 0x20]
call fcn.01012b76
test eax, eax
je 0x1018a45
mov eax, 0xe0000000
jmp 0x1018be3
cmp dword [esi + 4], ebx
je 0x1018bd0
cmp dword [esi], ebx
jne 0x1018bd0
lea ebx, [esi + 0x14]
mov ecx, ebx
call fcn.01012951
test eax, eax
jne 0x1018a7e
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1018ab3
cmp dword [ebp - 0x14], edi
je 0x1018ab3
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], edi
jmp 0x1018ab3
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x20019
push eax
push 0
mov ecx, ebx
call fcn.01012949
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1018aaa
mov esi, 0x80004005
jmp 0x1018be1
mov dword [ebp - 0x1c], 1
xor ebx, ebx
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
lea ecx, [esi + 0x20]
call fcn.01012949
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1018add
mov esi, 0x80004005
jmp 0x1018bd2
mov eax, dword [ebp - 0x18]
xor edx, edx
inc edx
cmp eax, edx
je 0x1018af7
cmp eax, 2
je 0x1018af7
cmp eax, 7
jne 0x1018afa
add dword [ebp + 8], 2
jmp 0x1018afa
inc dword [ebp + 8]
push eax
call fcn.010188ba
mov ecx, dword [esi + 0xc]
cmp ecx, eax
je 0x1018b4b
cmp ecx, 9
je 0x1018b4b
cmp ecx, 5
jne 0x1018b15
cmp eax, edx
je 0x1018b4b
cmp ecx, edx
jne 0x1018b1e
cmp eax, 5
je 0x1018b4b
cmp ecx, ebx
jne 0x1018b26
cmp eax, edx
je 0x1018b4b
mov eax, dword [0x101d014]
cmp eax, 0x101d014
je 0x1018ad3
test byte [eax + 0x1c], dl
je 0x1018ad3
push 0x1003248
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010043b6
jmp 0x1018ad3
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1018b5f
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [esi + 8], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [esi + 8], eax
jmp 0x1018b83
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x1018b91
mov esi, 0x8007000e
jmp 0x1018bd2
push dword [ebp + 8]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
lea eax, [ebp - 0x18]
push eax
push ebx
lea ecx, [esi + 0x20]
call fcn.01012949
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1018ad3
mov eax, dword [ebp + 8]
mov dword [esi], 1
mov dword [esi + 0x10], eax
xor esi, esi
cmp dword [ebp - 0x1c], 0
je 0x1018be1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.010125fb
ret 8
Function at 0x1001df0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0x1001180
call dword [sym.imp.msvcrt.dll_getenv]
mov edi, dword [ebp + 8]
mov esi, eax
add esp, 4
test esi, esi
je 0x1001e58
cmp byte [esi], 0
je 0x1001e58
push 0x100117c
lea eax, [edi + 0x1c]
push eax
push esi
mov dword [edi + 0x18], 1
call fcn.01001c50
test eax, eax
je 0x1001e58
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [edi + 0x18], 0
test ebx, ebx
je 0x1001e57
push eax
call dword [sym.imp.msvcrt.dll_strerror]
mov ecx, dword [ebp + 0x10]
push eax
push esi
push 0x1001164
push ecx
push ebx
call fcn.01001d80
add esp, 0x18
pop ebx
add edi, 0x18
push edi
push 0x1001154
call dword [sym.imp.msvcrt.dll_getenv]
add esp, 4
push eax
call fcn.01001be0
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1002370
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x1005004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x808], ebx
mov byte [ebp - 0x404], 0
test esi, esi
je 0x1002563
cmp dword [esi + 4], 0
jne 0x10023bf
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010041df
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x1002550
cmp byte [eax], 0
je 0x1002550
push edi
push 0x10011d0
push eax
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x100242b
test ebx, ebx
je 0x1002416
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
push eax
call dword [sym.imp.msvcrt.dll_strerror]
mov ecx, dword [0x1005388]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push 0x100136c
push edx
push ebx
call fcn.01001d80
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010041df
mov esp, ebp
pop ebp
ret 0xc
push edi
lea eax, [ebp - 0x804]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0xc
test eax, eax
je 0x10024e9
lea esp, [esp]
lea ecx, [ebp - 0x804]
push ecx
call fcn.01002620
cmp byte [eax], 0
je 0x10024cb
push 0x400
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x80c]
push eax
lea ecx, [ebp - 0x804]
push ecx
call fcn.01001e80
cmp eax, 1
jne 0x10024cb
mov edx, dword [ebp - 0x80c]
push edx
push esi
call fcn.01001ae0
cmp dword [edx + 0xc], 0
mov eax, dword [section..data]
je 0x10024a2
mov ecx, dword [edx + 0xc]
jmp 0x10024a4
mov ecx, eax
cmp dword [edx + 8], 0
je 0x10024ad
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
push ebx
push ecx
push eax
push edx
push 0x1001354
push 2
call fcn.01002230
mov ebx, dword [ebp - 0x808]
add esp, 0x18
push edi
lea eax, [ebp - 0x804]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x1002450
push edi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 4
cmp dword [esi + 0xc], 0
je 0x100250c
cmp byte [ebp - 0x404], 0
jne 0x1002515
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [ebp - 0x404], 0
je 0x1002532
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x404]
push edx
push eax
push 0x1001328
push ecx
push ebx
call fcn.01001d80
add esp, 0x14
xor eax, eax
cmp byte [ebp - 0x404], al
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010041df
mov esp, ebp
pop ebp
ret 0xc
test ebx, ebx
je 0x1002563
mov edx, dword [ebp + 0x10]
push 0x1001314
push edx
push ebx
call fcn.01001d00
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.010041df
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10029c0
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x100536c]
push esi
test eax, eax
je 0x10029d6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1005380
call fcn.01001b60
mov esi, dword [ebp + 8]
push esi
push 0x1001470
push 1
call fcn.01002230
add esp, 0xc
push esi
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x1003070
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1005004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x310], eax
test ebx, ebx
jne 0x10030ae
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010041df
mov esp, ebp
pop ebp
ret 0x14
push edi
push 0x104
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x100311e
test esi, esi
je 0x1003109
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x100
lea edx, [ebp - 0x208]
push edx
push 0
mov edi, eax
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x208]
push eax
push edi
push 0x1001530
push ecx
push esi
call fcn.01001d80
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010041df
mov esp, ebp
pop ebp
ret 0x14
lea edx, [ebp - 0x30c]
push edx
push 0x1001520
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.01001d80
lea ecx, [ebp - 0x108]
push 0x100117c
push ecx
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x1003198
test esi, esi
je 0x1003183
call dword [sym.imp.msvcrt.dll__errno]
mov edx, dword [eax]
push edx
call dword [sym.imp.msvcrt.dll_strerror]
mov ecx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0x10014fc
push ecx
push esi
call fcn.01001d80
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010041df
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x10031df
mov ebx, dword [sym.imp.msvcrt.dll_fputs]
mov edx, dword [esi + 4]
push edi
push edx
call ebx
mov eax, dword [esi + 0x10]
add esp, 8
test eax, eax
je 0x10031cd
cmp byte [eax], 0
je 0x10031cd
push edi
push 0x10014f8
call ebx
mov eax, dword [esi + 0x10]
push edi
push eax
call ebx
add esp, 0x10
push edi
push 0x10011f4
call ebx
mov esi, dword [esi + 0x14]
add esp, 8
test esi, esi
jne 0x10031a5
push edi
call dword [sym.imp.msvcrt.dll_fclose]
mov eax, dword [ebp - 0x310]
add esp, 4
test eax, eax
je 0x1003204
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x108]
push ecx
push edx
push eax
call fcn.01001d00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.010041df
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40279c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402834
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402814
xor eax, eax
push ebp
push 0x40280d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402850
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402814
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402e7c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x402edd
cmp word [0x406208], 0xd7b2
jne 0x402ea5
cmp dword [0x406210], 0
jbe 0x402ea5
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402f04
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405018], 0
jne 0x402ef9
push 0
push 0x40504c
push 0x405054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403550
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4035b6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403138
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402660
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4035a0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035bd
lea eax, [ebp - 0x10]
call fcn.00402ff8
ret
Function at 0x404280
Capabilities:
Copy file
Delete file
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x404317
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, ebx
call fcn.00403374
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00403374
push eax
call sub.kernel32.dll_CopyFileA
push esi
call sub.kernel32.dll_LoadLibraryA
mov edi, eax
test edi, edi
je 0x404307
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00403374
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404301
mov eax, dword [ebp - 0xc]
push eax
push 0x40425c
push edi
call sub.kernel32.dll_EnumResourceTypesA
test eax, eax
je 0x4042f6
mov byte [ebp - 5], 1
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_EndUpdateResourceA
push edi
call sub.kernel32.dll_FreeLibrary_1
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x404321
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret