joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407299
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f19c]
jne 0x4072a3
repz ret
jmp fcn.0040a270

Function at 0x40dcc3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40dcea
call fcn.0040cb86
mov dword [eax], esi
call fcn.0040cb73
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040cb21
mov eax, esi
jmp 0x40dd3f
test dword [ebp + 0xc], 0xfffffff9
jne 0x40dcd0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40dd17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040cb99
pop ecx
call fcn.0040cb73
mov eax, dword [eax]
jmp 0x40dd3f
test al, 0x10
jne 0x40dd3d
test al, 1
je 0x40dd3d
test byte [ebp + 0xc], 2
je 0x40dd3d
call fcn.0040cb86
mov dword [eax], 5
call fcn.0040cb73
mov dword [eax], 0xd
jmp 0x40dd0e
xor eax, eax
pop esi
pop ebp
ret

Function at 0x413bf0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f19c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b11d
and dword [ebp - 0x14], 0
cmp dword [0x421dc8], 0
mov dword [ebp - 0x18], eax
jne 0x413ca3
push 0x41c90c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413d4b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41c900
push ebx
call edi
test eax, eax
je 0x413d4b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x41c8f0
push ebx
mov dword [0x421dc8], eax
call edi
push eax
call esi
push 0x41c8dc
push ebx
mov dword [0x421dcc], eax
call edi
push eax
call esi
push 0x41c8c0
push ebx
mov dword [0x421dd0], eax
call edi
push eax
call esi
mov dword [0x421dd8], eax
test eax, eax
je 0x413ca3
push 0x41c8a8
push ebx
call edi
push eax
call esi
mov dword [0x421dd4], eax
mov eax, dword [0x421dd4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413cfc
cmp dword [0x421dd8], ecx
je 0x413cfc
push eax
call esi
push dword [0x421dd8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413cfc
test ebx, ebx
je 0x413cfc
call edi
test eax, eax
je 0x413cf3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413cf3
test byte [ebp - 8], 1
jne 0x413cfc
or dword [ebp + 0x10], 0x200000
jmp 0x413d2f
mov eax, dword [0x421dcc]
cmp eax, dword [ebp - 0x18]
je 0x413d2f
push eax
call esi
test eax, eax
je 0x413d2f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413d2f
mov eax, dword [0x421dd0]
cmp eax, dword [ebp - 0x18]
je 0x413d2f
push eax
call esi
test eax, eax
je 0x413d2f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x421dc8]
call esi
test eax, eax
je 0x413d4b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413d4d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407299
leave
ret
Function at 0x5e48f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x190000]
push edi
jmp 0x5e490a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5e4911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e4900
mov eax, 1
add ebx, ebx
jne 0x5e4923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5e4934
jne 0x5e4953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e4953
dec eax
add ebx, ebx
jne 0x5e4940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5e4918
add ebx, ebx
jne 0x5e494f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5e49a5
xor ecx, ecx
sub eax, 3
jb 0x5e496b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5e49da
sar eax, 1
mov ebp, eax
jmp 0x5e4976
add ebx, ebx
jne 0x5e4976
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e4944
inc ecx
add ebx, ebx
jne 0x5e4984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e4944
add ebx, ebx
jne 0x5e4991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5e4986
jne 0x5e49a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5e4986
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5e49c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5e49b6
jmp 0x5e4906
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5e49c4
add edi, ecx
jmp 0x5e4906
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5e49e2
cmp byte [edi], 0x11
jne 0x5e49e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5e49e7
lea edi, [esi + 0x1dd000]
mov eax, dword [edi]
or eax, eax
je 0x5e4a5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f2d04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f2e80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5e4a14
mov ecx, edi
jns 0x5e4a43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f2e84]
or eax, eax
je 0x5e4a59
mov dword [ebx], eax
add ebx, 4
jmp 0x5e4a31
call dword [esi + 0x2f2e94]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5e4a90
cmp al, 0xef
ja 0x5e4a83
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5e4a65
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5e4a72
mov ebp, dword [esi + 0x2f2e88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5e4ac4
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x1008efb0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1008f174
pushal
mov esi, section.UPX1
lea edi, [esi - 0x55000]
push edi
jmp 0x1008efda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1008efe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1008efd0
mov eax, 1
add ebx, ebx
jne 0x1008eff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1008efe8
jne 0x1008f004
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1008efe8
xor ecx, ecx
sub eax, 3
jb 0x1008f018
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1008f08a
mov ebp, eax
add ebx, ebx
jne 0x1008f023
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1008f030
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1008f054
inc ecx
add ebx, ebx
jne 0x1008f040
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1008f035
jne 0x1008f051
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1008f035
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1008f074
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1008f065
jmp 0x1008efd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1008f074
add edi, ecx
jmp 0x1008efd6
pop esi
mov edi, esi
mov ecx, 0xe2e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1008f092
cmp byte [edi], 0x13
jne 0x1008f092
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1008f097
lea edi, [esi + 0x8b000]
mov eax, dword [edi]
or eax, eax
je 0x1008f106
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f3d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f430]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1008f0c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f434]
or eax, eax
je 0x1008f100
mov dword [ebx], eax
add ebx, 4
jmp 0x1008f0e1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1008f137
cmp al, 0xef
ja 0x1008f12a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1008f10c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1008f119
mov ebp, dword [esi + 0x8f438]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1008f16b
sub esp, 0xffffff80
jmp 0x10006d8b
Function at 0x667f2d09
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x6680448c]
push edi
push 0x45
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
pop edi
jne 0x667f2d59
cmp dword [ebp - 0x114], 5
jb 0x667f2d59
xor eax, eax
inc eax
jmp 0x667f2d5b
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.6680214e
leave
ret

Function at 0x667f2d6a
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x6680448c]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 8], esi
call fcn.667f2d09
test eax, eax
je 0x667f2dff
lea eax, [ebp - 0xc]
push eax
push 0x20006
push esi
push 0x667f1310
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x667f2df8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x667f12f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x667f2de3
push 0x667f12e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x667f2de3
push esi
push dword [0x66804020]
push ebx
call eax
cmp eax, esi
jne 0x667f2dec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
jmp 0x667f2e72
mov eax, 0x522
jmp 0x667f2e72
call fcn.667f2cb5
test eax, eax
jne 0x667f2e5a
push 0x11
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x667f12ac
push esi
mov dword [ebp - 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x667f2e4f
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x1c]
call fcn.66800dd2
push dword [ebp - 0x1c]
call esi
jmp 0x667f2df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x667f2df3
mov eax, dword [0x6680703c]
cmp eax, esi
je 0x667f2e6f
lea ecx, [ebp - 0xc]
push ecx
push esi
push ebx
call eax
xor eax, eax
jmp 0x667f2e72
push 0x1f
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.6680214e
leave
ret

Function at 0x667f3015
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 4
je 0x667f3054
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 4], eax
cmp dword [esi + 4], 0
mov eax, dword [ebp + 0xc]
pop esi
jne 0x667f3061
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x667f3c57
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x667f3c66
xor eax, eax
jmp 0x667f3cc6
push ebx
lea eax, [ebp + 8]
push eax
push 0x667f1490
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test ebx, ebx
jne 0x667f3cc3
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp + 0xc]
push eax
push 3
push ebx
push 0x667f1408
push dword [ebp + 8]
call esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push ebx
push 0x667f1430
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x667f412f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x6680448c]
push esi
push edi
xor esi, esi
mov edx, 0x82
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, edx
mov word [ebp - 0x41c], si
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x210], si
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x670]
push eax
push 0x20019
push esi
push 0x667f2238
push 0x80000002
mov dword [ebp - 0x670], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x667f419a
xor eax, eax
jmp 0x667f4215
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push dword [ebp - 0x670]
mov dword [ebp - 0x674], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x670]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x667f4196
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x667f4196
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp esi, 0xffffffff
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.6680214e
leave
ret
Function at 0x667f42b1
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6680448c]
push edi
push 0
push 0x667f4226
push ecx
push 0x949
push dword [0x66807168]
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], edx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edi, eax
test edi, edi
je 0x667f43a4
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x214]
push eax
push edi
call esi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, dword [ebp - 0x208]
sub eax, dword [ebp - 0x210]
push 0
push eax
mov eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x208]
add eax, dword [ebp - 0x210]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x214]
cdq
sub eax, edx
sar eax, 1
push eax
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 0x218]
and word [ebp - 0x204], 0
push 0x1fd
lea edx, [ebp - 0x204]
call fcn.66800be7
lea eax, [ebp - 0x204]
push eax
push 0x947
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
call fcn.6680214e
leave
ret
Function at 0x667f63ed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi], 0x15c4
jae 0x667f6409
push 0x7a
pop eax
jmp 0x667f654b
lea eax, [ebp - 8]
push eax
push 0x667f1690
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x667f654b
and dword [edi + 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x667f170c
push dword [ebp - 8]
call esi
xor ebx, ebx
inc ebx
cmp dword [ebp - 0xc], 0
je 0x667f645d
or dword [edi + 4], ebx
push 4
pop eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x667f1764
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], 0
je 0x667f6488
or dword [edi + 4], 2
lea eax, [ebp + 0xc]
push eax
lea eax, [edi + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x667f16d8
push dword [ebp - 8]
mov dword [ebp + 0xc], 0x82
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp + 0xc]
push eax
lea eax, [edi + 0x8a]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x667f16f0
push dword [ebp - 8]
mov dword [ebp + 0xc], 0x102
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp + 0xc]
push eax
lea eax, [edi + 0x590]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x667f1734
push dword [ebp - 8]
mov dword [ebp + 0xc], 0x82
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp + 0xc]
push eax
lea eax, [edi + 0x612]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x667f174c
push dword [ebp - 8]
mov dword [ebp + 0xc], 0x82
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp + 0xc]
push eax
add edi, 0xa98
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0x667f178c
push dword [ebp - 8]
mov dword [ebp + 0xc], 0x82
mov dword [ebp - 4], ebx
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret 8
Function at 0x667f6555
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi], 0x15c4
jae 0x667f656f
push 0x7a
pop eax
jmp 0x667f664d
lea eax, [ebp + 0xc]
push eax
push 0x667f1690
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x667f664d
mov eax, dword [edi + 4]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop ebx
and eax, 1
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x667f170c
push dword [ebp + 0xc]
call esi
mov eax, dword [edi + 4]
shr eax, 1
and eax, 1
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x667f1764
push dword [ebp + 0xc]
call esi
add ebx, 0x7e
push ebx
lea eax, [edi + 8]
push eax
push 1
push 0
push 0x667f16d8
push dword [ebp + 0xc]
call esi
push 0x102
lea eax, [edi + 0x8a]
push eax
push 1
push 0
push 0x667f16f0
push dword [ebp + 0xc]
call esi
push ebx
lea eax, [edi + 0x590]
push eax
push 1
push 0
push 0x667f1734
push dword [ebp + 0xc]
call esi
push ebx
lea eax, [edi + 0x612]
push eax
push 1
push 0
push 0x667f174c
push dword [ebp + 0xc]
call esi
push ebx
add edi, 0xa98
push edi
push 1
push 0
push 0x667f178c
push dword [ebp + 0xc]
call esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret 8

Function at 0x667f73c3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0x667f18c0
push 0x80000001
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x667f74b5
mov ax, word [edi + 0xa98]
xor ecx, ecx
test ax, ax
setne cl
push ebx
test ax, ax
push esi
mov ebx, 0x667f19ac
mov eax, 0x667f19a4
lea ecx, [ecx + ecx + 6]
jne 0x667f740e
mov eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ecx
push eax
push 1
push 0
push 0x667f191c
push dword [ebp - 4]
call esi
mov eax, dword [edi + 4]
and eax, 2
push 0
pop ecx
setne cl
test eax, eax
mov eax, 0x667f19a4
lea ecx, [ecx + ecx + 6]
jne 0x667f743f
mov eax, ebx
push ecx
push eax
push 1
push 0
push 0x667f1938
push dword [ebp - 4]
call esi
mov ebx, 0x82
push ebx
lea eax, [edi + 8]
push eax
push 1
push 0
push 0x667f196c
push dword [ebp - 4]
call esi
push 0x102
lea eax, [edi + 0x8a]
push eax
push 1
push 0
push 0x667f1988
push dword [ebp - 4]
call esi
push ebx
lea eax, [edi + 0xa98]
push eax
push 1
push 0
push 0x667f1954
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [edi + 0x896]
lea ecx, [edi + 0x694]
call fcn.667f7327
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret
Function at 0x667f86bd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x667f1a2c
push 0x80000002
mov edi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x667f870e
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x667f870e
mov dword [ebp - 8], 1
cmp dword [ebp - 4], esi
pop edi
pop esi
pop ebx
je 0x667f871f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x667f9eba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push edi
push 0x871
push ebx
call esi
test eax, eax
mov edi, 0x873
je 0x667f9efd
mov eax, dword [0x66804040]
and byte [eax + 4], 0x7f
mov eax, dword [0x66804040]
push 0x667f29a8
add eax, 0x14c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x667f9f41
push 0x872
push ebx
call esi
test eax, eax
je 0x667f9f14
mov eax, dword [0x66804040]
or byte [eax + 4], 0x80
jmp 0x667f9ee5
push edi
push ebx
call esi
test eax, eax
je 0x667f9f41
mov eax, dword [0x66804040]
and byte [eax + 4], 0x7f
mov eax, dword [0x66804040]
push 0x104
add eax, 0x14c
push eax
push 0x87a
push ebx
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push edi
push ebx
call esi
test eax, eax
je 0x667f9f74
mov eax, dword [0x66804040]
add eax, 0x14c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x667f9f74
push 0x52c
mov edx, 0x87a
mov ecx, ebx
call fcn.66801e08
xor eax, eax
jmp 0x667f9f77
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x667fcbe9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x6680448c]
and dword [ebp - 0xd0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push esi
mov ebx, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x31
lea edx, [ebp - 0x68]
mov ecx, edi
call fcn.66800be7
lea edx, [ebp - 0x68]
mov ecx, esi
call fcn.667fcb53
test eax, eax
je 0x667fcc6d
push 0x31
lea edx, [ebp - 0xcc]
mov ecx, ebx
call fcn.66800be7
xor edi, edi
push edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x68]
mov ecx, esi
call fcn.667fcb53
test eax, eax
je 0x667fcc6d
inc edi
cmp edi, 0x14
jb 0x667fcc42
jmp 0x667fcc92
push 0x667f29ac
push dword [ebp + 0xc]
mov dword [ebp - 0xd0], 1
push esi
call fcn.667f7305
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc]
push esi
call fcn.667f7305
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd0]
pop edi
pop esi
pop ebx
call fcn.6680214e
leave
ret 8