joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100413ea
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10041452
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10041416
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10041450
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10041438
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xe
je 0x10041450
mov dword [ebp - 8], 0xfffffff6
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
jmp 0x1004142d
jmp 0x10041466
push 1
push 0x7222
push 0x2693
call fcn.1002be9f
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100417f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10041827
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004181b
push 0x1631
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10041825
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10041868
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x5820
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push 0x5262
push dword [ebp - 0x18]
call fcn.1002aadd
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10041d6a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10041e53
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10041e35
mov dword [ebp - 0x14], 0x1d25
cmp dword [ebp - 0x14], 0xf2e
jge 0x10041e22
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10008a70
call fcn.1005cc6b
add esp, 0xc
imul eax, dword [ebp - 0xc], 6
dec eax
imul eax, dword [ebp - 8]
push eax
push 0x10007840
call fcn.1005d2b3
pop ecx
pop ecx
and dword [ebp - 4], 0
jmp 0x10041dde
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x10041e22
imul eax, dword [ebp - 4], 6
add eax, 5
imul eax, dword [ebp - 8]
push eax
imul eax, dword [ebp - 4], 6
add eax, 3
imul eax, dword [ebp - 8]
push eax
imul eax, dword [ebp - 4], 6
inc eax
inc eax
imul eax, dword [ebp - 8]
push eax
imul eax, dword [ebp - 4], 6
inc eax
imul eax, dword [ebp - 8]
push eax
push 0x10008a7c
call fcn.1005d2b3
add esp, 0x14
jmp 0x10041dd7
push 0x1c29
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10041e51
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10041e51
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x10041e8b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x670b
push 0x6181
push dword [ebp - 0x30]
call fcn.1002ff2d
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x100422c9
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10042323
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10042306
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x10042321
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10042321
push 0
push 0x2468
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10042392
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10042347
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10042392
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10042375
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10042392
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1000f696
mov dword [eax], 0xdbf0cf86
jmp 0x1004236a
mov esp, ebp
pop ebp
ret
Function at 0x10048ac7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10048bbe
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10048b13
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10048b0e
push 0x2455
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10048bbc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0xaed6b657
mov dword [ebp - 0x14], 0x2530a9bc
mov dword [ebp - 0x18], 0xfff9
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xc5674fa7
mov byte [ebp - 2], 0
push 0
push 0x5829
push 0x72b4
push 0x4eca
lea eax, [ebp - 2]
push eax
call fcn.10049179
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push 0x59c4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x34e8
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0xcc8
push 0x23c9
call fcn.100491a1
add esp, 0x30
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
sub eax, 0xf
cdq
mov ecx, 0x414
idiv ecx
sub eax, 0xf
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x10048bcc
jmp 0x10048bcc
push 0x1819
push 0
call fcn.1004bfc1
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004c6a6
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004c6ed
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004c6e1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004c6df
push 0
push 0
push 0x1c7
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1004c6eb
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1004c70a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x6038
push 1
push dword [ebp - 0xc]
push 0x4492
call fcn.1004946d
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10051e11
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10051e81
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10051e6d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10051e6b
push 0x327d
push 1
push 1
push 0x5f8a
push 0x177e
push 0x3cfa
call fcn.1004fe96
add esp, 0x18
jmp 0x10051e7f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10051e7f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10051ed0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10051eb9
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10051eb7
push 0x3765
push 0
push 0x45dc
call fcn.10051fa8
add esp, 0xc
jmp 0x10051ed0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x10052a42
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10052a88
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x2e95
push 0x3dc2
push 0x1b35
push 0x4fcc
push dword [ebp - 4]
push 1
push 0x8b3
push 0xeb6
push 0xc8a
call fcn.10052ad8
add esp, 0x24
jmp 0x10052ad4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10052aac
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10052ad4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
shr eax, 1
push eax
mov ecx, dword [ebp - 0x20]
call fcn.1002a174
mov esp, ebp
pop ebp
ret
Function at 0x100535c6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10053602
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 0x3f6b
push dword [ebp - 0x18]
push 0x6a80
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 1
call fcn.10053708
add esp, 0x14
jmp 0x10053703
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100536e0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x10053667
mov dword [ebp - 0xc], 1
jmp 0x1005366b
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
jne 0x1005369b
push 2
mov ecx, dword [ebp - 8]
call fcn.1000f696
push 2
mov ecx, dword [ebp - 8]
call fcn.1000f696
mov eax, 0x7647f1a9
add eax, 0x3267e6aa
jne 0x1005369b
and dword [ebp - 0x10], 0
jmp 0x100536a2
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jge 0x100536b5
mov dword [ebp - 0x14], 1
jmp 0x100536b9
and dword [ebp - 0x14], 0
push 2
mov ecx, dword [ebp - 8]
call fcn.1000f696
mov ecx, dword [ebp - 0x14]
imul ecx, dword [eax]
imul esi, ecx, 3
push 2
mov ecx, dword [ebp - 8]
call fcn.1000f696
imul esi, dword [eax]
mov eax, dword [ebp - 0x3c]
mov dword [eax], esi
jmp 0x10053703
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x10053703
push 0xc75
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10070315
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007a748]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100611b8
mov dword [ebp - 0x14], eax
cmp dword [0x1061de94], esi
jne 0x10070408
push 0x800
push esi
push 0x100075b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10070395
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100704e8
push esi
push esi
push 0x100075b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100704e8
push 0x100075cc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100704e8
push eax
call ebx
push 0x100075d8
push edi
mov dword [0x1061de94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075e8
push edi
mov dword [0x1061de98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075fc
push edi
mov dword [0x1061de9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061dea4], eax
test eax, eax
je 0x10070405
push 0x10007618
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061dea0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007042d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10070420
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10070442
push 4
pop eax
jmp 0x100704ea
cmp dword [ebp - 0x14], esi
je 0x10070442
push dword [0x1061de94]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10070427
mov eax, dword [0x1061dea0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100704a0
cmp dword [0x1061dea4], edi
je 0x100704a0
push eax
call ebx
push dword [0x1061dea4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100704a0
test eax, eax
je 0x100704a0
call ecx
test eax, eax
je 0x10070495
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10070495
test byte [ebp - 8], 1
jne 0x100704a0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100704d0
mov eax, dword [0x1061de98]
cmp eax, edi
je 0x100704cd
push eax
call ebx
test eax, eax
je 0x100704cd
call eax
mov esi, eax
test esi, esi
je 0x100704cd
mov eax, dword [0x1061de9c]
cmp eax, edi
je 0x100704cd
push eax
call ebx
test eax, eax
je 0x100704cd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1061de94]
call ebx
test eax, eax
je 0x100704e8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100704ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005e225
mov esp, ebp
pop ebp
ret
Function at 0x9041b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00904140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00904140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00904140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00904140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x904bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x904c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x91687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x904c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x904c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4035da
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x4daca0], 0x594
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jne 0x403614
push 0x402d04
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [str._Bo_]
mov edi, dword [0x42a6bc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x28], 0x9e3779b9
call fcn.004035d3
mov eax, dword [0x42a6c0]
add dword [ebp - 8], 0x23f
mov ebx, dword [0x42a6c4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl ecx, 4
cmp dword [0x4daca0], 0xc
mov dword [ebp - 4], ecx
jne 0x4036b8
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc44]
push eax
push esi
push 0x402d24
push 0x402d50
push 0x402d74
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
add dword [ebp - 4], ecx
mov ecx, dword [0x4daca0]
cmp ecx, 0xfa9
jne 0x4036d6
mov dword [0x4da23c], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4036e4
mov dword [0x4d9bec], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x4da238], 0xf4ea3dee
add eax, ebx
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x4daca0], 0x213
mov dword [ebp - 0x18], ecx
jne 0x40371f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], 0x64
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x10], 0x64
cmp dword [0x4daca0], 0xc
jne 0x403752
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0x444]
push eax
push 0x402da8
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, edi
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
dec dword [ebp - 0x1c]
jne 0x403650
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4037a0
Capabilities:
Create pipe
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4daca0]
mov ecx, dword [0x4d9bf0]
sub esp, 0x42c
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x403895
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x4daca0], 0x959
jne 0x403881
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402db8
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402e1c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402e30
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.004035da
add ebx, 8
dec dword [ebp - 4]
jne 0x4037c9
pop edi
pop ebx
pop esi
leave
ret