joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d32910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [edx]
mov ebx, dword [eax + 0x1c]
mov ecx, ebx
call dword [section..00cfg]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], esi
mov ecx, esi
push eax
call ebx
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp ebx, esi
je 0x1d3296e
nop
mov ecx, ebx
call fcn.01d2a0e0
add ebx, 0x14
cmp ebx, esi
jne 0x1d32960
mov edi, dword [ebp - 0x2c]
lea eax, [edi + 0x7c]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x28]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x20], ecx
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
call ebx
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x20]
push eax
push dword [edi + 0x58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1d329b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1d32a13
mov byte [edi + 0xa2], 1
mov eax, 1
lock xadd dword [edi + 8], eax
mov bl, 1
cmp eax, 0x7fffffff
je 0x1d32a32
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x1d329ff
mov esi, dword [ebp - 0x18]
mov eax, edi
cmp esi, edi
je 0x1d329f3
nop
add esi, 0xffffffec
je 0x1d32a17
mov ecx, esi
call fcn.01d2a050
cmp esi, edi
jne 0x1d329e0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
push eax
call fcn.01e5f36c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x1d329ce
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x44
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.01ce782c
int3
Function at 0x1d62f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x1d72e30
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov edi, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [edi + 4], 1
jne 0x1d62f7f
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x2c]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x1d630a4
lea esi, [ebp - 0x28]
mov ecx, edi
push esi
call fcn.01d5baea
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x1f0ed8c
call fcn.01d6e006
mov esi, eax
mov edi, dword [ebp - 0x28]
cmp edi, 0x1f0ec9c
mov ebx, dword [ebp + 0xc]
je 0x1d62fd4
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x1d62fd4
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
dec eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [esi]
mov dl, byte [ebp + 0x18]
xor dl, 1
movzx edx, dl
mov edi, dword [ecx + edx*4 + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x28]
push esi
call edi
mov edi, esi
mov al, byte [ebp - 0x1d]
test al, al
jns 0x1d6300e
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
test al, al
js 0x1d63023
movzx eax, al
add eax, ebp
add eax, 0xffffffd8
cmp edi, eax
jne 0x1d6302f
jmp 0x1d6308a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
add ecx, eax
cmp edi, ecx
je 0x1d6308e
test ebx, ebx
je 0x1d63047
mov al, byte [edi]
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x1c]
je 0x1d6304b
lea edx, [ecx + 1]
mov dword [ebx + 0x18], edx
mov byte [ecx], al
jmp 0x1d63084
xor ebx, ebx
jmp 0x1d63084
mov dword [ebp - 0x2c], edi
movzx edi, al
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x30], ebx
mov ecx, ebx
push edi
call esi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x1d6307e
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x2c]
inc edi
mov al, byte [ebp - 0x1d]
jmp 0x1d63011
mov dword [esi], ebx
jmp 0x1d63099
mov dword [esi], ebx
push eax
call fcn.01e5f36c
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1d63e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x1d72e50
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov edi, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [edi + 4], 1
jne 0x1d63eff
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movzx eax, word [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x2c]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x1d64033
lea esi, [ebp - 0x28]
mov ecx, edi
push esi
call fcn.01d5baea
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x1f0ed94
call fcn.01d6e006
mov esi, eax
mov edi, dword [ebp - 0x28]
cmp edi, 0x1f0ec9c
mov ebx, dword [ebp + 0xc]
je 0x1d63f54
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x1d63f54
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
dec eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [esi]
mov dl, byte [ebp + 0x18]
xor dl, 1
movzx edx, dl
mov edi, dword [ecx + edx*4 + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x28]
push esi
call edi
mov edi, esi
mov al, byte [ebp - 0x1d]
test al, al
jns 0x1d63ffe
mov edi, dword [ebp - 0x28]
jmp 0x1d63ffe
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
lea edx, [ecx + edx*2]
cmp edi, edx
je 0x1d64019
test ebx, ebx
je 0x1d63fb7
movzx esi, word [edi]
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x1c]
je 0x1d63fbb
lea ecx, [eax + 2]
mov dword [ebx + 0x18], ecx
mov word [eax], si
jmp 0x1d63fec
xor ecx, ecx
jmp 0x1d63ff9
mov dword [ebp - 0x30], edi
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
movzx eax, si
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
push eax
call edi
mov esi, eax
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
xor ecx, ecx
cmp si, 0xffff
je 0x1d63ff6
mov ecx, ebx
mov al, byte [ebp - 0x1d]
add edi, 2
mov ebx, ecx
test al, al
js 0x1d63f90
movzx ecx, al
lea ecx, [ecx*2 - 0x28]
add ecx, ebp
cmp edi, ecx
jne 0x1d63f9d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1d64029
mov esi, dword [ebp + 8]
mov dword [esi], ebx
push ecx
call fcn.01e5f36c
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1d68124
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.01d72944
mov edx, eax
test ebx, ebx
je 0x1d6814b
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x1d68156
movzx eax, word [eax]
jmp 0x1d6816d
xor ecx, ecx
test dl, dl
je 0x1d68180
jmp 0x1d68214
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
mov byte [ebp - 0x10], dl
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp - 0x10]
xor edi, edi
cmp ax, 0xffff
sete al
je 0x1d6817a
mov edi, ebx
mov ecx, edi
cmp dl, al
je 0x1d681fa
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov dword [ebp - 0x10], ecx
je 0x1d68192
movzx edi, word [eax]
jmp 0x1d681a5
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov edi, eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [section..00cfg]
movzx eax, di
mov ecx, ebx
push eax
push 8
call esi
test al, al
je 0x1d681f4
mov esi, dword [ebp + 8]
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x10]
je 0x1d681de
add eax, 2
mov dword [edi + 0xc], eax
jmp 0x1d68131
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
jmp 0x1d6812e
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.01d72944
mov ebx, eax
test edi, edi
je 0x1d6821d
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
je 0x1d68223
movzx eax, word [eax]
jmp 0x1d68234
mov ecx, esi
call fcn.01d72944
mov ebx, eax
test bl, bl
jne 0x1d6823f
jmp 0x1d68245
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
cmp ax, 0xffff
sete al
xor bl, al
jne 0x1d68245
mov eax, dword [ebp + 0x10]
or byte [eax], 2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1d764df
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
test eax, eax
js 0x1d7662f
mov dword [ebp - 0x224], eax
mov esi, 0xff
mov ebx, 0x1f0f766
push esi
push dword [ebp - 0x21c]
push ebx
call fcn.01e7a87f
add esp, 0xc
push ebx
call fcn.01e79bc6
add esp, 4
sub esi, eax
push esi
push 0x1eb65c4
push ebx
call fcn.01e7a87f
add esp, 0xc
push edi
call sub.ntdll.dll_RtlFreeUnicodeString
lea esi, [ebp - 0x218]
push 0x208
push 0
push esi
call fcn.01e63410
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push 0x104
push esi
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1d7659a
push eax
push esi
push edi
call fcn.01e7a8c4
add esp, 0xc
test eax, eax
je 0x1d765c9
push 0x104
push esi
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1d765c5
push eax
push esi
push edi
call fcn.01e7a8c4
add esp, 0xc
test eax, eax
je 0x1d765c9
xor eax, eax
jmp 0x1d765cb
mov al, 1
mov byte [0x1f0f365], al
mov dword [ebp - 0x218], 0
push 0x1eb4188
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1eb8534
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1d7661b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov ecx, edi
call dword [section..00cfg]
push esi
push ebx
call edi
test eax, eax
je 0x1d7661b
cmp dword [ebp - 0x218], 0
setne al
jmp 0x1d7661d
xor eax, eax
mov byte [0x1f0f966], al
mov byte [0x1f0f364], 1
mov eax, dword [ebp - 0x224]
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d7676f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1d76794
mov eax, dword [ecx + 4]
test eax, eax
je 0x1d767bd
bt ebx, 8
jae 0x1d767a7
mov eax, ebx
and eax, 0x200
jne 0x1d767bd
cmp edi, 2
mov eax, 0x1f0f366
mov ecx, 0x1f0f566
cmove ecx, eax
cmp word [ecx], 0
je 0x1d767cf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [ebp - 0x34]
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1d767bd
cmp byte [0x1f0f966], 0
setne al
bt ebx, 8
jb 0x1d767bd
shr ebx, 9
and ebx, 1
or bl, al
je 0x1d767bd
cmp edi, 2
mov eax, 0x1eb8578
mov edx, 0x1eb858c
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x1d7682d
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x1d76832
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x50], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x1d76877
push ebx
push dword [edx]
push esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], eax
call fcn.01e75ee1
mov edx, dword [ebp - 0x4c]
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x48]
je 0x1d76885
add edx, 0x14
mov ecx, dword [ebp - 0x50]
inc ecx
cmp ecx, dword [ebp - 0x44]
jb 0x1d7684f
jmp 0x1d768e5
movzx ecx, word [esi + ebx*2]
cmp ecx, 0x5c
je 0x1d76892
test ecx, ecx
jne 0x1d76877
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x1d768b0
cmp ebx, 2
mov esi, ebx
jne 0x1d768bc
mov dword [ebp - 0x3c], str.WOW6432Node
mov dword [ebp - 0x38], eax
jmp 0x1d768bc
mov dword [ebp - 0x3c], str.WOW6432Node_
mov dword [ebp - 0x38], esi
mov esi, ebx
mov dword [ebp - 0x40], esi
cmp cx, 0x5c
jne 0x1d768d4
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x1d768c5
jmp 0x1d768d6
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x44], eax
mov edx, dword [edx + 0xc]
xor ecx, ecx
mov eax, edi
jmp 0x1d7687e
cmp dword [ebp - 0x40], 0
je 0x1d767bd
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1d768fc
mov eax, dword [ecx]
mov edx, dword [ebp - 0x38]
sub edx, eax
sar edx, 1
push dword [ebp - 0x3c]
push edx
call fcn.01d746da
jmp 0x1d767bd
Function at 0x1d76b8d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1f0f364], 0
jne 0x1d76bb6
call fcn.01d764df
test al, al
je 0x1d76c49
mov eax, dword [ebp + 0xc]
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov dword [edx + 4], ecx
mov dword [edx], ecx
push eax
push edx
call sub.ntdll.dll_RtlInitUnicodeString
mov eax, 0x18
lea esi, [ebp - 0x20]
mov dword [esi], eax
xor edx, edx
dec edx
lea ecx, [ebp - 0x2c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
push eax
call fcn.01cfcf8c
mov edi, 5
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x20]
call fcn.01cf8bf6
mov ebx, dword [ebp - 0x2c]
push esi
push dword [ebp - 0x20]
push ebx
push 1
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x1d76c1c
cmp eax, 0x80000005
jne 0x1d76c23
dec edi
jne 0x1d76bed
xor ebx, ebx
jmp 0x1d76c57
test eax, eax
js 0x1d76c1f
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x1d76c4d
add ebx, dword [ebx + 8]
lea edx, [ebx + eax]
mov ecx, dword [ebp + 0x14]
push eax
push edx
push ebx
call fcn.01cfbfbc
jmp 0x1d76c55
xor ebx, ebx
jmp 0x1d76c64
mov ecx, dword [ebp + 0x14]
call fcn.01cd429a
mov bl, 1
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov dword [ecx], eax
call fcn.01cd42ce
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d76f3a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1f0f364], 0
jne 0x1d76f5f
call fcn.01d764df
test al, al
je 0x1d76f8e
xor esi, esi
lea edi, [ebp - 0x18]
mov dword [edi + 4], esi
mov dword [edi], esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push edi
call sub.ntdll.dll_RtlInitUnicodeString
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
push ebx
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
jmp 0x1d76f90
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d77d60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1f0f968]
test eax, eax
jne 0x1d77e44
mov edi, 0xc
push edi
call fcn.01e5f33c
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1f0f968], eax
push edi
call fcn.01e5f33c
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1f0f96c], eax
call fcn.01d7a5b0
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push 0x1eb9b5a
call fcn.01cd2ef8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01cd2ef8
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01d78e1c
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01d77678
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1d77e17
push dword [ebp - 0x1c]
call fcn.01e5f36c
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1d77e28
push dword [ebp - 0x34]
call fcn.01e5f36c
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1d77e39
push dword [ebp - 0x28]
call fcn.01e5f36c
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1d77e65
mov eax, dword [0x1f0f968]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.01cd2db4
mov bl, 1
test esi, esi
je 0x1d77e67
mov ecx, esi
push dword [0x1f0f96c]
call fcn.01cd2db4
jmp 0x1d77e67
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d7847c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.01e63410
add esp, 0xc
mov edi, 0xfffffff4
lea ebx, [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [edi + str.PROGRAMW6432]
mov word [ebp - 0x218], 0
push 0x104
push ebx
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1d784f0
push dword [ebp + 8]
push eax
push ebx
call fcn.01d7841c
add esp, 0xc
test al, al
jne 0x1d784f9
add edi, 4
jne 0x1d784bc
xor ebx, ebx
jmp 0x1d784fb
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d788ce
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.01e63410
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
dec eax
lea esi, [ebp - 0x224]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.01cd2ef8
mov ecx, esi
push 0xa
push str.usp10.dll
call fcn.01d74480
cmp byte [eax + 0xb], 0
jns 0x1d78944
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [ebp - 0x219], 0
jns 0x1d78964
push dword [ebp - 0x224]
call fcn.01e5f36c
add esp, 4
cmp esi, 0xffffffff
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1d78d7c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push str.type
call fcn.01cd2ef8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.01cd2ef8
push esi
push edi
push ebx
call fcn.01d78e1c
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1d78dd9
push dword [ebp - 0x34]
call fcn.01e5f36c
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1d78dea
push dword [ebp - 0x28]
call fcn.01e5f36c
add esp, 4
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01d78fa7
mov dword [0x1f0f978], eax
cmp byte [esi + 0xb], 0
jns 0x1d78e0a
push dword [ebp - 0x1c]
call fcn.01e5f36c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1d79102
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x1f07010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1d791a4
mov edi, eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
push 0
push edi
call fcn.01d5a142
cmp byte [ebx + 0xb], 0
jns 0x1d7914c
mov ebx, dword [ebp - 0x1c]
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movzx ecx, byte [ebp - 0x11]
test eax, eax
je 0x1d79189
mov edx, ecx
test cl, cl
jns 0x1d79168
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x1d79189
lea edi, [ebp - 0x1c]
mov ecx, edi
push 0
push eax
call fcn.01d74c9a
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [edi]
movsd qword [esi], xmm0
jmp 0x1d791ac
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x1d791ac
push dword [ebp - 0x1c]
call fcn.01e5f36c
add esp, 4
jmp 0x1d791ac
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01e60425
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret