joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426528
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x4266fc
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x42e880]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x4266fc
test cl, 0x48
je 0x426593
cmp byte [eax + 5], 0xa
je 0x426593
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4265e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x4265cd
call fcn.0041c8f1
mov dword [eax], 9
call fcn.0041c8fa
mov dword [eax], esi
jmp 0x4265dd
cmp eax, 0x6d
je 0x4266fc
push eax
call fcn.0041c903
pop ecx
or eax, 0xffffffff
jmp 0x4266fe
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4266f7
test eax, eax
je 0x42660c
cmp byte [ebx], 0xa
jne 0x42660c
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x426615
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4266f1
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x4266e1
cmp al, 0xd
je 0x426647
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x4266d3
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x426661
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x42665c
add dword [ebp + 0x10], 2
jmp 0x4266b5
mov dword [ebp + 0x10], eax
jmp 0x4266cf
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426689
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4266cf
cmp dword [ebp - 0xc], 0
je 0x4266cf
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4266aa
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4266b5
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4266d2
cmp ebx, dword [ebp + 0xc]
jne 0x4266ba
cmp byte [ebp - 1], 0xa
jne 0x4266ba
mov byte [ebx], 0xa
jmp 0x4266d2
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042414f
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x4266d3
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x42662b
jmp 0x4266f1
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4266f1
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4266fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1030247
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10302a0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1030292
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x103028e
cmp esi, eax
jae 0x1030292
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1030280
cmp esi, eax
jb 0x1030296
xor eax, eax
jmp 0x103029f
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x10306f1
Capabilities:
Get token membership

Disassembly:
push 0x20
mov eax, 0x105eac4
call fcn.0104f396
xor ebx, ebx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
jne 0x103077c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], ebx
call edi
cmp eax, ebx
jle 0x103075a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x1030765
mov esi, 0x80004005
push 0x10016a0
push 0x100168c
call edi
push eax
call fcn.0104a5f6
add esp, 0xc
jmp 0x10307f0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10307eb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x10307a4
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10307af
mov esi, 0x80004005
push 0x1001648
push 0x1001634
jmp 0x103076f
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
cmp dword [ebp - 0x20], ebx
je 0x10307fe
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, esi
call fcn.0104f401
ret 4
Function at 0x1030c1a
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x105eaf6
call fcn.0104f320
and dword [ebp - 4], 0
push 0x1068adc
lea ecx, [ebp - 0x14]
call fcn.010309e3
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 1
test esi, esi
jne 0x1030c61
push 0x1001838
mov eax, 0x80070057
push 0x100182c
push eax
mov esi, eax
call fcn.0104a504
add esp, 0xc
jmp 0x1030d16
push 0x10017b8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x1030cab
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x1030c8c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x1030c97
mov esi, 0x80004005
push 0x100177c
push 0x1001770
call edi
push eax
call fcn.0104a5f6
jmp 0x1030c59
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, 0xb7
cmp eax, ecx
jne 0x1030d04
push 0x1001730
push 0x1001724
push ecx
call fcn.0104a6e8
add esp, 0xc
mov esi, 0x800700b7
jmp 0x1030d16
call esi
test eax, eax
jle 0x1030d14
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.010303ce
mov eax, esi
call fcn.0104f3d4
ret 8
Function at 0x1034624
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10687d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x238], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
jne 0x1034666
push 0x1003dd8
mov edi, 0x80070057
push 0x1003dc0
push edi
call fcn.0104a504
add esp, 0xc
jmp 0x103474c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, esi
jb 0x103469c
push 0x1003cd8
push 0x1003cbc
push 0x7a
call fcn.0104a6e8
add esp, 0xc
mov edi, 0x8007007a
jmp 0x103474b
test eax, eax
jne 0x10346d8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x10346b6
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x10346c1
mov edi, 0x80004005
push 0x1003c78
push 0x1003c5c
call esi
push eax
call fcn.0104a5f6
add esp, 0xc
jmp 0x103474b
lea eax, [ebp - 0x234]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x10346f9
cmp word [eax + 2], 0
jne 0x10346f9
xor ecx, ecx
mov word [eax], cx
mov esi, 0x1003c34
push esi
push 0x230
lea eax, [ebp - 0x234]
push eax
call fcn.0103414f
mov edi, eax
lea eax, [ebp - 0x234]
push eax
test edi, edi
jge 0x1034733
push esi
push 0x1003bf4
push 0x1003bdc
push edi
call fcn.0104a504
add esp, 0x14
jmp 0x103474b
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1034743
xor eax, eax
inc eax
jmp 0x1034749
mov eax, dword [ebp - 0x238]
mov dword [ebx], eax
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0104f2d3
leave
ret 4
Function at 0x103509d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x105efa8
call fcn.0104f2e8
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], 0x1003ab8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
jne 0x10350ef
push 0x1004268
mov eax, 0x80070057
push 0x1004250
push eax
mov dword [ebp - 0x10], eax
call fcn.0104a504
add esp, 0xc
jmp 0x103527d
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
mov esi, 0x1004238
push esi
mov edi, 0x80000002
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x10351e6
push 0x1068adc
lea ecx, [ebp + 8]
call fcn.010309e3
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.01046775
cmp eax, ebx
mov dword [ebp - 0x10], eax
jge 0x1035157
push 0x1004204
push 0x10041ec
push eax
call fcn.0104a504
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.010303ce
jmp 0x103527d
push 0x5c
lea ecx, [ebp + 8]
call fcn.0103145e
push 0x5c
lea ecx, [ebp + 8]
call fcn.010311ee
push 0x10041b4
lea ecx, [ebp + 8]
call fcn.01031508
push ebx
push 0x20028
lea ecx, [ebp - 0x3c]
call fcn.01033e67
push ebx
push ebx
push 0x1004190
lea ecx, [ebp - 0x3c]
call fcn.01034f9e
push ebx
push ebx
push 0x1004168
lea ecx, [ebp - 0x3c]
call fcn.01034f9e
push dword [ebp + 8]
mov dword [ebp - 0x1c], 1
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push dword [ebp + 8]
mov esi, eax
push 0x1004120
push 0x1004104
push esi
call fcn.0104a6e8
add esp, 0x10
cmp esi, ebx
jle 0x10351de
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0x10], esi
jmp 0x1035144
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov edi, 0x10040e4
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x1035240
cmp eax, 2
je 0x1035275
push esi
push edi
push 0x1004070
push 0x1004054
push eax
call fcn.0104a6e8
mov eax, dword [ebp - 0x20]
add esp, 0x14
cmp eax, ebx
jle 0x103523b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
jmp 0x103527d
cmp dword [ebp - 0x24], 4
jne 0x1035256
cmp dword [ebp - 0x18], 4
jne 0x1035256
xor eax, eax
cmp dword [ebp - 0x28], ebx
setne al
jmp 0x1035278
push esi
push edi
push 0x1003fd0
push 0x1003fb8
push 0xd
call fcn.0104a6e8
add esp, 0x14
mov dword [ebp - 0x10], 0x8007000d
jmp 0x103527d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 0x14], ebx
je 0x103528e
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x1c], ebx
je 0x10352b1
push ebx
push ebx
push 0x1004190
lea ecx, [ebp - 0x3c]
call fcn.01034fef
push ebx
push ebx
push 0x1004168
lea ecx, [ebp - 0x3c]
call fcn.01034fef
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x1003ab8
call fcn.01033eab
mov eax, dword [ebp - 0x10]
call fcn.0104f3d4
ret 4
Function at 0x104303d
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 4
pop ebx
xor edi, edi
push ebx
push edi
push 0x1010b50
push 0x80000002
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x1043091
mov esi, eax
jle 0x1043085
and esi, 0xffff
or esi, 0x80070000
push 0x1010b20
push 0x1010b04
jmp 0x1043101
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
lea ecx, [ebp - 8]
push ecx
push edi
push ebx
push edi
push edi
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x10430ca
mov esi, eax
jle 0x10430be
and esi, 0xffff
or esi, 0x80070000
push 0x1010ac8
push 0x1010aac
jmp 0x1043101
push edi
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x1010a8c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x104310f
mov esi, eax
jle 0x10430f7
and esi, 0xffff
or esi, 0x80070000
push 0x1010a48
push 0x1010a28
push eax
call fcn.0104a6e8
add esp, 0xc
jmp 0x104325a
push ebx
lea eax, [ebp + 0xc]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1010a08
push dword [ebp - 4]
call edi
test eax, eax
je 0x1043149
mov esi, eax
jle 0x104313a
and esi, 0xffff
or esi, 0x80070000
push 0x10109b8
push 0x1010998
jmp 0x104324f
push ebx
lea eax, [ebp + 0x10]
push eax
push ebx
push 0
push 0x101097c
push dword [ebp - 4]
call edi
test eax, eax
je 0x104317e
mov esi, eax
jle 0x104316f
and esi, 0xffff
or esi, 0x80070000
push 0x1010930
push 0x1010914
jmp 0x104324f
push ebx
lea eax, [ebp + 0x14]
push eax
push ebx
push 0
push 0x10108f8
push dword [ebp - 4]
call edi
test eax, eax
je 0x10431b3
mov esi, eax
jle 0x10431a4
and esi, 0xffff
or esi, 0x80070000
push 0x10108bc
push 0x10108a0
jmp 0x104324f
push ebx
lea eax, [ebp + 0x18]
push eax
push ebx
push 0
push 0x1010880
push dword [ebp - 4]
call edi
test eax, eax
je 0x10431e5
mov esi, eax
jle 0x10431d9
and esi, 0xffff
or esi, 0x80070000
push 0x1010830
push 0x1010810
jmp 0x104324f
cmp dword [ebp + 0x1c], esi
je 0x10431f1
mov dword [ebp - 0x10], 1
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x10107f4
push dword [ebp - 4]
call edi
test eax, eax
je 0x1043223
mov esi, eax
jle 0x1043217
and esi, 0xffff
or esi, 0x80070000
push 0x10107a8
push 0x1010788
jmp 0x104324f
push 0x101077c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1043258
mov esi, eax
jle 0x1043245
and esi, 0xffff
or esi, 0x80070000
push 0x1010740
push 0x1010724
push eax
call fcn.0104a6e8
add esp, 0xc
xor edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], edi
je 0x104326d
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], edi
cmp dword [ebp - 8], edi
je 0x104327a
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x1043284
push dword [ebp - 0xc]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1043374
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x1060148
call fcn.0104f320
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
lea ebx, [esi + 2]
push ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.01033f0f
movzx eax, al
test eax, eax
jne 0x10433df
push 0x1010c74
push 0x1010c68
push 0x8007000e
call fcn.0104a504
add esp, 0xc
push dword [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.0104f3d4
ret 4
mov eax, dword [edi]
push esi
push eax
push ebx
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.01043292
test eax, eax
jge 0x1043407
push 0x1010c20
push 0x1010c10
push eax
call fcn.0104a504
add esp, 0xc
push ebx
jmp 0x10433cd
lea eax, [ebx + esi*2]
xor ecx, ecx
mov word [eax + 2], cx
mov word [eax], cx
mov eax, 0x414
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, dword [edi]
push eax
push edi
push 0x1002678
push 0x1010bec
push 0x4000000
call fcn.0104a7da
add esp, 0x14
jmp 0x1043404
Function at 0x104347e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x10
mov eax, 0x1060170
call fcn.0104f320
xor edi, edi
push 0x1068adc
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.010309e3
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, dword [ecx - 0xc]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.01031394
cmp esi, 8
jb 0x10434de
push 8
push 0x1010d60
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10434de
push edi
lea ecx, [ebp - 0x14]
call fcn.01030be7
add eax, 0x10
jmp 0x1043511
cmp esi, 4
jb 0x1043508
push 4
push 0x1010d54
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1043508
push edi
lea ecx, [ebp - 0x14]
call fcn.01030be7
add eax, 8
jmp 0x1043511
push edi
lea ecx, [ebp - 0x14]
call fcn.01030be7
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push 0x5c
push eax
call ebx
pop ecx
pop ecx
cmp eax, edi
jne 0x1043554
mov esi, dword [ebp - 0x14]
push esi
push 0x1010d28
mov eax, 0x800700a1
push 0x1010d18
push eax
mov dword [ebp - 0x18], eax
call fcn.0104a504
lea ecx, [esi - 0x10]
add esp, 0x10
call fcn.010303ce
mov eax, dword [ebp - 0x18]
call fcn.0104f3d4
ret 8
push dword [ebp - 0x14]
lea esi, [eax + 2]
movzx edi, word [esi]
xor eax, eax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1043586
test al, 0x10
jne 0x10435d8
mov esi, dword [ebp - 0x14]
push esi
push 0x1010cdc
mov eax, 0x800700b7
push 0x1010ccc
jmp 0x1043535
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10435d8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x10435ac
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x18], eax
test eax, eax
jl 0x10435ba
mov dword [ebp - 0x18], 0x80004005
mov edi, dword [ebp - 0x14]
push edi
push 0x1010cdc
push 0x1010cbc
call esi
push eax
call fcn.0104a5f6
lea ecx, [edi - 0x10]
jmp 0x1043541
push 0x5c
push esi
mov word [esi], di
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x1043554
mov eax, dword [ebp + 8]
push dword [eax]
push 0x1002678
push 0x1010ca8
push 0x4000000
call fcn.0104a7da
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
jmp 0x1043544
Function at 0x1043cd6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x106024b
call fcn.0104f320
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 1
call fcn.0103097d
test byte [ebp + 0x18], 1
je 0x1043d0f
mov esi, 0x100
cmp dword [ebp + 0xc], ebx
je 0x1043d6d
lea eax, [ebp - 0x18]
push eax
or esi, 0x20019
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1043d73
jg 0x1043d37
mov dword [ebp - 0x14], eax
jmp 0x1043d48
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0xc]
push 0x10112d8
push 0x10112b8
push eax
call fcn.0104a6e8
add esp, 0x10
push ebx
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x1043e8d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
cmp eax, ebx
je 0x1043db6
jg 0x1043d96
mov dword [ebp - 0x14], eax
jmp 0x1043da7
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x10]
push 0x1011270
push 0x1011254
jmp 0x1043d55
cmp dword [ebp - 0x20], 1
je 0x1043dd9
push 0x1011210
mov eax, 0x8007000d
push 0x10111f4
push eax
mov dword [ebp - 0x14], eax
call fcn.0104a504
add esp, 0xc
jmp 0x1043d5e
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
lea ecx, [ebp - 0x24]
call fcn.01042fff
mov esi, dword [ebp - 0x24]
cmp esi, ebx
jne 0x1043e00
push 0x10110a0
mov eax, 0x8007000e
push 0x10111d8
jmp 0x1043dcb
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax], bl
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax - 1], bl
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
cmp eax, ebx
je 0x1043e57
jg 0x1043e2a
mov dword [ebp - 0x14], eax
jmp 0x1043e3b
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x10]
push 0x1011270
push 0x10111bc
push eax
call fcn.0104a6e8
add esp, 0x10
push esi
jmp 0x1043d5f
mov ecx, dword [ebp + 0x14]
push esi
call fcn.01031649
jmp 0x1043e51
cmp dword [ebp + 0xc], ebx
je 0x1043ea0
cmp dword [ebp - 0x18], ebx
je 0x1043ea0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
call fcn.0104f3d4
ret 0x14
Function at 0x1043fb7
Capabilities:
Get user security identifier

Disassembly:
push 0x18
mov eax, 0x1060293
call fcn.0104f320
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x1043fff
push 0x1011614
mov eax, 0x80070057
push 0x1011600
push eax
mov ebx, eax
call fcn.0104a504
add esp, 0xc
jmp 0x1044173
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [esi], eax
test eax, eax
jne 0x1044029
push 0x10115b8
mov eax, 0x8007000e
push 0x10115a4
jmp 0x1043fef
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1044060
push 0x1011540
push 0x1011528
mov eax, 0x8007000e
push eax
mov ebx, eax
call fcn.0104a504
add esp, 0xc
jmp 0x1044157
mov edi, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1044155
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10440ec
push dword [ebp - 0x18]
push dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov dword [ebx], eax
test eax, eax
jne 0x10440b8
push 0x10115b8
push 0x1011514
jmp 0x104404b
and dword [ebx], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
test eax, eax
jne 0x10440e4
push 0x1011540
push 0x1011500
jmp 0x104404b
mov dword [ebp - 0x14], eax
jmp 0x1044066
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x1044102
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x104410d
mov ebx, 0x80004005
push 0x10114dc
push 0x10114c8
call edi
push eax
call fcn.0104a5f6
jmp 0x1044058
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x104416f
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x104418c
mov eax, dword [esi]
test eax, eax
je 0x104418c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], 0
mov eax, ebx
call fcn.0104f3d4
ret 0xc