joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47456c
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push esi
pushf
call 0x4744e5
inc edx
dec ecx
pop esp
dec ebp
arpl word [ebx + 0x6e], ax
inc si
insb byte es:[edi], dx
push ecx
insd dword es:[edi], dx
inc ecx
outsd dx, dword [esi]
pushal
inc ebp
inc esi
pushal
pop edi
push ecx
bound eax, qword [ebp + 0x54]
outsb dx, byte [esi]
pop edx
push 0x64
push esi
push edx
push edi
inc edx
inc ebp
inc ebp
push esi
dec ebx
pop ebx
push eax
pop edi
inc esi
outsd dx, dword [esi]
push ebp
dec esi
pop ebx
push esp
pop ecx
arpl word [esi + 0x63], bx
inc edi
js 0x4744ec
pop ebx
pushal
pop ecx
push 0x6b
pushal
inc ebx
push 0x5151685f
pop ebp
inc ecx
push 0x4b4e5b47
imul eax, dword [ecx + 0x56], 0x69594668
inc ebx
js 0x47450d
dec esp
dec ecx
push esi
dec ecx
pushal
bound ecx, qword [esp + ecx*2 + 0x6a]
pop ebx
inc esi
push 0x4d6e4740
bound edx, qword [edi + 0x68]
pop ecx
arpl word [ebp + 0x64], cx
arpl word [ebx + 0x65], sp
popal
push 0x62784355
dec edx
dec eax
inc edi
pop ebx
pushal
outsb dx, byte [esi]
inc edi
mov esi, dword [esp]
lea esp, [esp + 4]
call 0x4744f1
mov dword [esp], edx
lea edx, [esp + 6]
call 0x474500
mov dword [esp], ebx
lea ebx, [esi - 0x6b07b]
push word [esp + 8]
mov ah, 0x24
or byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
popf
mov eax, ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
mov edx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
pushf
push ebp
call 0x47456c
pop eax
pop edi
jns 0x4745a0
insb byte es:[edi], dx
dec eax
pop esp
jns 0x47457b
push ebx
push 0x63666555
push edi
push esp
jns 0x47458b
inc esp
inc eax
dec ecx
imul edx, dword [edi + 0x5c], 0x494b4969
push ax
push ecx
pop ebp
dec edi
popal
pop esi
push esp
pop esp
dec edi
dec edx
arpl word [eax + 0x7b], cx
push eax
bound esp, qword [ebp + 0x68]
dec edi
dec edx
inc esi
pop edi
push ecx
js 0x4745bd
pop eax
imul ebx, dword [esi + 0x5d], 0xfc24648d
mov dword [esp], ecx
lea ecx, [esp + 0xa]
lea esp, [esp - 4]
mov dword [esp], edx
lea edx, [ebp - 0x6b13f]
push word [esp + 0xc]
popf
and al, 0xc
add byte [eax], al
add byte [esi - 0x63], ah
mov esi, edx
mov edx, dword [esp]
lea esp, [esp + 4]
pop ecx
mov ebp, dword [esp]
lea esp, [esp + 4]
and al, 4
lea esp, [esp + 2]
push edi
mov edi, eax
cmp eax, esi
push esi
push ebx
push ebx
push edx
push edx
push ebp
push 0xffffffffffffffe8
push 0x142
lock xchg dword [esp], eax
Function at 0x474bba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul ebx, dword [edi + 0x40], 0x56
inc esi
imul eax, dword [ebp + 0x48], 0x5a404e40
inc esp
push eax
push ebx
push ebx
push edi
push ebp
pop ebx
inc ebx
inc ecx
push ebp
pop ecx
pop eax
push edx
popal
inc eax
inc ebp
dec ecx
inc esp
pop eax
ret
ljmp 0:0x21e8c3
call 0x474bba
inc si
inc esp
jns 0x474c04
outsb dx, byte [esi]
pop ebx
dec edi
push ecx
imul ebx, dword [ecx + 0x4a], 0x40434e64
dec edx
pop si
push edi
push edx
pop edx
pop ebp
push ebp
popal
push 0x596f6e43
outsb dx, byte [esi]
dec ebp
lock xchg dword [esp], edx
lea edx, [edx - 0x711d9]
lock xchg dword [esp], edx
cmp esi, 0xb1547fe5
cmove eax, ebx
push dword fs:[0]
cmp dword [esp - 4], 0xee963427
cmove ebx, edx
mov eax, dword [esp + 0x10]
cmp edi, 0x9ee11823
cmove edx, ebx
mov dword [esp + 0x10], ebp
cmp dword [esp + 4], 0xd464f297
je 0x474bca
in eax, 0x7f
push esp
mov cl, 0xf
inc esp
ret
lea ebp, [esp + 0x10]
cmp ebx, 0xfed60405
je 0x491f97
add eax, 0xffed604
test byte [ecx + 0x2b0001d3], cl
loopne 0x474b92
sub esp, eax
cmp edi, 0xafe874ab
je 0x477793
jmp [ebx + 0xfafe874]
push ebx
cmp dword [esp + 0x7c], 0xf071249
jne 0x474c5b
inc edi
push ebx
dec eax
jmp 0x474c51
push ebp
push str.DecodePointer
pop edi
pop edi
push ebp
push ecx
push esi
cmp ebx, 0xdbc1ed23
je 0x499500
push edi
cmp edi, 0x7b67bceb
cmove edx, edi
pushf
lea esp, [esp - 4]
mov dword [esp], edx
call 0x474cb5
jnp 0x474cc8
dec eax
inc edi
dec ebp
push esi
push cx
dec ebp
js 0x474cf1
invalid
push esp
inc ebp
inc eax
pop ebp
dec esi
push es
aad 0xc
pop ebp
pop ebx
inc esi
push edx
arpl word [eax + 0x51], bp
push eax
inc eax
dec edi
push ecx
inc esi
push ebx
dec edi
push esp
inc ecx
bound esp, qword [ecx + 0x4d]
arpl word [esi + 0x6e], bp
dec edi
dec ebp
push 0x6741494a
inc esp
outsb dx, byte [esi]
arpl word [edi + 0x66], cx
pop ebx
pop esp
push esp
dec esi
invalid

Function at 0x47a2ab
Capabilities:
Packed with generic packer
Write file on windows

Disassembly:
lock xchg dword [esp], esi
lea esi, [esi - 0x70d28]
lock xchg dword [esp], esi
cmp dword [esp + 0x7c], 0x9db2036f
je 0x444382
call fcn.0047a340
mov dword [esi], edi
cmp edi, ebx
mov eax, dword [esi + ecx*4 + 0x1c]
dec esp
pop esi
dec ebp
add esp, 0x18
movdqa xmmword [edi + 0x50], xmm5
mov cl, byte [esi + eax + 4]
arpl word [ecx + 0x5d], di
inc ebp
outsb dx, byte [esi]
or dword [eax - 8], 0xffffffff
pop ecx
mov edx, esi
mov ecx, dword [ebp - 8]
inc eax
dec esi
and dword [ecx], esi
inc eax
arpl word [esi + 0x48], ax
dec esp
bound eax, qword [ecx + 0x6c]
bound eax, qword [ebp + 0x41]
dec eax
outsd dx, dword [esi]
pop esi
insd dword es:[edi], dx
imul eax, dword [edx + 0x4b], 0xc7f75440
add eax, dword [eax]
add byte [eax], al
leave
dec esp
dec esi
dec edx
push ecx
push ebx
Function at 0x47e7b8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
inc ebp
pop esp
inc esi
pop ecx
inc eax
js 0x47e80e
inc ebp
inc edi
pushal
imul ebp, dword [ebx + eax*2 + 0x6e], 0x79
push 0x4c595446
pop cx
imul ebx, dword [ebp + 0x78], 0x4055444f
push dword [esp]
add dword [esp], 0xffffba5f
add dword [esp + 4], 0xb3
ret
pop edx
imul eax, dword [ebp + 0x47], 0x54694441
pop ebp
dec ebx
dec ecx
push esp
pop eax
inc ebp
inc ebx
inc esi
jnp 0x47e86d
dec ebp
insd dword es:[edi], dx
dec eax
pop ebp
insb byte es:[edi], dx
insd dword es:[edi], dx
bound ebp, qword gs:[ebx + 0x5c]
dec ebp
push ecx
pop edx
insd dword es:[edi], dx
pushal
dec ebx
pushaw
invalid

Function at 0x48656c
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov edx, dword [esp]
lea esp, [esp + 4]
push esi
lea esi, [esp + 0xa]
call 0x486580
mov dword [esp], ebp
call 0x486588
mov dword [esp], ebx
mov ebp, edx
add ebp, 0xfff852f3
push word [esp + 0x10]
popf
mov dword ds:[ebp], eax
mov ebx, dword [esp]
lea esp, [esp + 4]
Function at 0x40c383
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c420
push ebx
push esi
call fcn.0040c34c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c2e0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c3cd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c41f
push edi
push eax
call fcn.0040cfa0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c3ed
call fcn.0040ae41
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c41e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c2e0
add esp, 0x20
test eax, eax
jne 0x40c40c
push edi
call fcn.0040ae41
jmp 0x40c414
push ebx
call fcn.0040ae41
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d71d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x468330
push 0x468328
push str.FlsAlloc
push 0x1f
call fcn.0040d5dc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d751
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
jmp 0x40d757
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d79b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x468340
push 0x468338
push str.FlsGetValue
push 0x21
call fcn.0040d5dc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d7d2
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d7da
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x468348
push 0x468340
push str.FlsSetValue
push 0x22
call fcn.0040d5dc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d814
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10009da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.VirtualAlloc
mov edi, esp
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1000d9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000d9c0
mov dword [0x10157b38], eax
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.1000d9c0
mov esp, ebp
pop ebp
ret

Function at 0x10009f00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.VirtualProtect
mov edi, esp
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1000d9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000d9c0
mov dword [0x10157b30], eax
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.1000d9c0
mov esp, ebp
pop ebp
ret
Function at 0x1002c790
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.100140b0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x1002c85b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x1002c85b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x1002c80e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x1002c819
or bh, 8
and edi, 0x8000000
je 0x1002c834
mov eax, dword [0x1015b9dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x1002c85b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002cc30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1002cc5b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x1002cc7f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x1002cc9a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x1003ad03
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dec39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.100d0430
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable._AFX_DEBUG_STATE.0
push str.AFX.INI
push 1
push str.TraceEnabled
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x10159ad4], eax
push str.AFX.INI
push 0
push str.TraceFlags
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x10159ad0], eax
cmp dword [0x10159ae0], 0
je 0x1003ad8c
push 0x77
push 0x101511d8
call fcn.100bab90
test eax, eax
je 0x1003ad8c
int3
xor ecx, ecx
test ecx, ecx
jne 0x1003ad72
push 0x1003ab34
call fcn.100103a0
add esp, 4
mov dword [0x10159ae0], eax
cmp dword [0x10159ae4], 0
je 0x1003adbe
push 0x7a
push 0x101511e8
call fcn.100bab90
test eax, eax
je 0x1003adbe
int3
xor edx, edx
test edx, edx
jne 0x1003ada4
push 0x1003aca6
call fcn.100141d0
add esp, 4
mov dword [0x10159ae4], eax
push 4
push 2
call fcn.100140f0
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100619c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.1006f1e0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x10061a03
push 0xee
push str.filecore.cpp
call fcn.100bab90
test eax, eax
je 0x10061a03
int3
xor edx, edx
test edx, edx
jne 0x100619e6
cmp dword [ebp + 0xc], 0
jne 0x10061a14
jmp 0x10061ab5
cmp dword [ebp + 8], 0
jne 0x10061a2e
push 0xf3
push str.filecore.cpp
call fcn.100bab90
test eax, eax
je 0x10061a2e
int3
xor eax, eax
test eax, eax
jne 0x10061a14
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100389b6
test eax, eax
jne 0x10061a5b
push 0xf4
push str.filecore.cpp
call fcn.100bab90
test eax, eax
je 0x10061a5b
int3
xor eax, eax
test eax, eax
jne 0x10061a34
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10061a98
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.100b71ba
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1006f8e0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10061ab5
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.100b71ba
push eax
push 0xffffffffffffffff
push 0xd
call fcn.1006fac0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100621fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100622d2
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100622c8
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100622be
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.10060a78
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x10157b58
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.10060bb3
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x100622db
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x1006233c
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x10062343
xor eax, eax
jmp 0x10062473
lea ecx, [ebp - 0x14]
push ecx
push 0x101377e0
push 0
push 0x101377f0
lea ecx, [ebp - 4]
call fcn.10061f77
test eax, eax
jge 0x10062366
xor eax, eax
jmp 0x10062473
lea edx, [ebp - 0x10]
push edx
push 0x1013ee18
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x10062465
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x100623a0
mov dword [ebp - 0x180], 0
jmp 0x100623ee
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.100140b0
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.1000ca90
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x10062459
push 2
mov ecx, dword [ebp + 8]
call fcn.100bd91c
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x10062459
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x10062473
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1006247f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd50d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.100389b6
test eax, eax
jne 0x100624c8
push 0x216
push str.filecore.cpp
call fcn.100bab90
test eax, eax
je 0x100624c8
int3
xor ecx, ecx
test ecx, ecx
jne 0x100624a0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1006251e
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x10062504
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.1003aa35
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x10062611
lea ecx, [ebp - 0x1c]
call fcn.100b7117
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10062624
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.100b71ba
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10062596
lea ecx, [ebp - 0x1c]
call fcn.100b71ba
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.1003aa35
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100602cc
mov eax, dword [ebp - 0x164]
jmp 0x10062611
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x100625aa
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x100625f2
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x100625f2
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100602cc
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8