joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020376
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002039d
push 0x2a5c
push 0
push 0x5b41
call fcn.100269b4
add esp, 0xc
jmp 0x10020425
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100203dd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100203db
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x10020425
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002040b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10020425
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x10020400
mov esp, ebp
pop ebp
ret
Function at 0x10026858
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100268aa
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10026888
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x100268a8
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100268a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x100268c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 1
push 0x22cb
push 0x7f80
call fcn.100212a8
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002924c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065d44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100292a1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x28]
push 0x2554
push 0x5ab4
push dword [ebp - 0x2c]
call fcn.10035eea
add esp, 0x14
jmp 0x100293df
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x6c67
mov dword [ebp - 0x44], 0x100098d8
cmp dword [ebp - 0x24], 0x6d62
jle 0x1002936c
and dword [ebp - 0x1c], 0
jmp 0x100292d5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x21cb
jge 0x1002936c
and dword [ebp - 0x14], 0
jmp 0x100292ef
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7451
jge 0x10029367
and dword [ebp - 0x18], 0
jmp 0x10029305
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x71de
jge 0x10029365
and dword [ebp - 0x20], 0
jmp 0x1002931b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2988
jge 0x10029363
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1001d2d7
jmp 0x10029314
jmp 0x100292fe
jmp 0x100292e8
jmp 0x100292ce
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10029382
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x100293a3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x100293a3
push 0x7c6
call dword [sym.imp.USER32.dll_IsWindow]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6b29
jge 0x100293b9
push dword [ebp - 0x44]
call fcn.10050266
pop ecx
jmp 0x100293d5
or dword [ebp - 4], 0xffffffff
jmp 0x100293df
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029585
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065d4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002972c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100295f9
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100295f4
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1e16
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1002972a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x6df6
mov dword [ebp - 0x48], 0x1000993c
cmp dword [ebp - 0x2c], 0x706f
jle 0x100296ab
and dword [ebp - 0x24], 0
jmp 0x1002962d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x42da
jge 0x100296ab
and dword [ebp - 0x1c], 0
jmp 0x10029643
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2bcc
jge 0x100296a6
and dword [ebp - 0x20], 0
jmp 0x10029659
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x47f1
jge 0x100296a4
and dword [ebp - 0x28], 0
jmp 0x1002966f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x4c40
jge 0x100296a2
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
sub eax, edx
mov ecx, dword [ebp - 0x28]
shl eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x10029668
jmp 0x10029652
jmp 0x1002963c
jmp 0x10029626
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x100296cd
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jge 0x100296ea
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1001d5d0
mov dword [eax], 0x9c14
jmp 0x100296c2
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x6a11
jge 0x10029704
mov edx, dword [ebp - 0x48]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x10029720
or dword [ebp - 4], 0xffffffff
jmp 0x1002972a
jmp 0x10029740
push 0x1512
push 0x5765
push 1
call fcn.10020f38
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a4c5
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065d76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002a51a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x5c75
push 0x2b19
call fcn.1003a561
add esp, 0x14
jmp 0x1002a668
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002a547
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1002a542
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
jmp 0x1002a668
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x4a52
mov dword [ebp - 0x48], 0x10009aa8
cmp dword [ebp - 0x28], 0x4cfc
jle 0x1002a617
and dword [ebp - 0x18], 0
jmp 0x1002a57b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7612
jge 0x1002a617
and dword [ebp - 0x1c], 0
jmp 0x1002a595
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x517
jge 0x1002a612
and dword [ebp - 0x20], 0
jmp 0x1002a5ab
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b7d
jge 0x1002a60d
and dword [ebp - 0x24], 0
jmp 0x1002a5c1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xa95
jge 0x1002a60b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1001d2d7
jmp 0x1002a5ba
jmp 0x1002a5a4
jmp 0x1002a58e
jmp 0x1002a574
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1002a62c
push 0xcb2
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x48ce
jge 0x1002a642
push dword [ebp - 0x48]
call fcn.10050266
pop ecx
jmp 0x1002a65e
or dword [ebp - 4], 0xffffffff
jmp 0x1002a668
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c679
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065de0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002c6e5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002c6cb
push 0x10bb
push 0x1e16
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x1002c6e0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x34c865b4
jmp 0x1002c7f7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0x76e6
mov dword [ebp - 0x34], 0x10009d20
cmp dword [ebp - 0x20], 0x79e7
jle 0x1002c77b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and dword [ebp - 0x1c], 0
jmp 0x1002c71d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6252
jge 0x1002c77b
and dword [ebp - 0x14], 0
jmp 0x1002c733
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x50ab
jge 0x1002c779
and dword [ebp - 0x18], 0
jmp 0x1002c749
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x57c6
jge 0x1002c777
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
add edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x1002c742
jmp 0x1002c72c
jmp 0x1002c716
lea eax, [ebp + 0x14]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x74a2
jge 0x1002c79b
mov edx, dword [ebp - 0x34]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1002c7b7
or dword [ebp - 4], 0xffffffff
jmp 0x1002c7c1
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1002c7ef
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002c7f7
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ca5f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002cab5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002ca9b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002ca99
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x1002cab0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x2bb11acc
jmp 0x1002cb37
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002caec
push 0xb54
push 0x22ca
push 0
push 0x22e2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002cb37
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002cb1a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1002cb37
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1001d5d0
mov dword [eax], 0x65b49d58
jmp 0x1002cb0f
mov esp, ebp
pop ebp
ret
Function at 0x1002ce8e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1002cee8
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002cece
push 0xb54
push 0x22ca
push 0
push 0x22e2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002cee3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x40cc74bf
jmp 0x1002cf86
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002cf5d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002cf3e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1002cf5b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.1001d5d0
mov dword [eax], 1
jmp 0x1002cf33
jmp 0x1002cf86
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x44]
call fcn.1001d5d0
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003c2a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003c2ca
push 0x514
push 1
push 0x7bc4
call fcn.1003c324
add esp, 0xc
jmp 0x1003c320
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003c305
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003c303
push 0
push 0x1e41
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1003c320
push 0x4df
push 0
push 0x14d2
push 0x974
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret

Function at 0x1003c33c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003c3bf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003c372
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1003c3bd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003c3a0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003c3bd
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001d5d0
mov dword [eax], 4
jmp 0x1003c395
jmp 0x1003c3c7
push 0
call fcn.1003aaf2
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004d1df
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0xc], 0x20ee
cmp dword [esp + 0xc], 0x21cf
push esi
push edi
jle 0x1004d294
push 0x1128
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], edi
xor ebx, ebx
and dword [esp + 0x1c], 0
lea eax, [ebx + edi]
mov edi, eax
mov dword [esp + 0x18], eax
xor edi, esi
mov esi, dword [esp + 0x1c]
mov eax, edi
lea ecx, [esp + 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004d24c
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1001d982
inc esi
cmp esi, 0x509
jl 0x1004d232
mov esi, dword [esp + 0x10]
inc ebx
mov edi, dword [esp + 0xc]
cmp ebx, 0x31ed
jl 0x1004d21e
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x2bd0
jl 0x1004d21c
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x79da
jl 0x1004d216
cmp dword [esp + 0x14], 0x1de9
jge 0x1004d2a9
push 0x1000c2d8
call fcn.10050266
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100616a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006c750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10053838
mov dword [ebp - 0x14], eax
cmp dword [0x1061067c], esi
jne 0x10061798
push 0x800
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10061725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10061878
push esi
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10061878
push 0x10007524
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10061878
push eax
call ebx
push 0x10007530
push edi
mov dword [0x1061067c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007540
push edi
mov dword [0x10610680], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007554
push edi
mov dword [0x10610684], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061068c], eax
test eax, eax
je 0x10061795
push 0x10007570
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10610688], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100617bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100617b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100617d2
push 4
pop eax
jmp 0x1006187a
cmp dword [ebp - 0x14], esi
je 0x100617d2
push dword [0x1061067c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100617b7
mov eax, dword [0x10610688]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10061830
cmp dword [0x1061068c], edi
je 0x10061830
push eax
call ebx
push dword [0x1061068c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10061830
test eax, eax
je 0x10061830
call ecx
test eax, eax
je 0x10061825
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10061825
test byte [ebp - 8], 1
jne 0x10061830
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10061860
mov eax, dword [0x10610680]
cmp eax, edi
je 0x1006185d
push eax
call ebx
test eax, eax
je 0x1006185d
call eax
mov esi, eax
test esi, esi
je 0x1006185d
mov eax, dword [0x10610684]
cmp eax, edi
je 0x1006185d
push eax
call ebx
test eax, eax
je 0x1006185d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1061067c]
call ebx
test eax, eax
je 0x10061878
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006187a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050d4b
mov esp, ebp
pop ebp
ret