joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028571
Capabilities:
Write file on windows

Disassembly:
mov ch, byte [edi]
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x1b], ch
mov edx, dword [eax*4 + 0x10046a38]
mov cl, byte [edx + ebx + 0x2d]
test cl, 4
je 0x100284f1
mov al, byte [edx + ebx + 0x2e]
and cl, 0xfb
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push 2
mov byte [ebp - 0xb], ch
mov byte [edx + ebx + 0x2d], cl
push eax
jmp 0x1002852b
call 0x1004b741
movzx ecx, byte [edi]
mov edx, 0x8000
test word [eax + ecx*2], dx
je 0x10028528
cmp edi, dword [ebp - 0x24]
jae 0x100285ce
push 2
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.10027528
add esp, 0xc
cmp eax, 0xffffffff
je 0x100285f7
inc edi
jmp 0x10028540
push 1
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.10027528
add esp, 0xc
cmp eax, 0xffffffff
je 0x100285f7
xor ecx, ecx
lea eax, [ebp - 0x14]
push ecx
push ecx
push 5
push eax
push 1
lea eax, [ebp - 0x18]
lcall 0xffc8, 0x75ff53c9
adc eax, sym.imp.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100285f7
push 0
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100285ef
mov eax, dword [esi + 8]
sub eax, dword [ebp - 0x30]
add eax, edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], eax
jb 0x100285f7
cmp byte [ebp - 0x1b], 0xa
jne 0x100285c3
push 0xd
pop eax
push 0
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100285ef
cmp dword [ebp - 0x20], 1
jb 0x100285f7
inc dword [esi + 8]
inc dword [esi + 4]
cmp edi, dword [ebp - 0x24]
jb 0x100284ba
jmp 0x100285f7
mov edx, dword [ebp - 0x2c]
mov al, byte [edi]
mov ecx, dword [edx*4 + 0x10046a38]
mov byte [ecx + ebx + 0x2e], al
mov eax, dword [edx*4 + 0x10046a38]
add al, 0x10
or byte [eax + ebx + 0x2d], 4
inc dword [esi + 4]
jmp 0x100285f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
invalid
sahf
push edi

Function at 0x100286fb
Capabilities:
Write file on windows

Disassembly:
add byte [ecx + 0x10045070], ah
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, ecx
sar eax, 6
and ecx, 0x3f
imul ecx, ecx, 0x30
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [eax*4 + 0x10046a38]
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [eax + ecx + 0x18]
mov eax, dword [ebp + 0x14]
and dword [esi], 0
add eax, ebx
and dword [esi + 4], 0
and dword [esi + 8], 0
mov dword [ebp - 0x1410], ecx
mov dword [ebp - 0x1408], eax
jmp 0x100287ab

Function at 0x10028960
Capabilities:
Write file on windows

Disassembly:
push ebx
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
rcl ecx, 0xf8
push eax
mov eax, ecx
push eax
push ebx
push 0x27e6be9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1418], eax
test eax, eax
invalid
je 0x100289cc
push 0
invalid
invalid
Function at 0x1002c584
Capabilities:
Enumerate files on windows

Disassembly:
add byte [eax], al
mov eax, dword [0x10045070]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x148], esi
jmp 0x1002c5bd
mov al, byte [ecx]
cmp al, 0x2f
je 0x1002c5c1
cmp al, 0x5c
je 0x1002c5c1
cmp al, 0x3a
je 0x1002c5c1
push ecx
push ebx
call 0x1005d889
pop ecx
pop ecx
mov ecx, eax
cmp ecx, ebx
jne 0x1002c5a4
mov dl, byte [ecx]
cmp dl, 0x3a
jne 0x1002c5df
lea eax, [ebx + 1]
cmp ecx, eax
je 0x1002c5df
push esi
xor edi, edi
push edi
push edi
push ebx
call 0x10057ebf
add esp, 0x10
jmp fcn.1002c659
xor edi, edi
cmp dl, 0x2f
je 0x1002c5f4
cmp dl, 0x5c
je 0x1002c5f4
cmp dl, 0x3a
je 0x1002c5f4
mov eax, edi
jmp 0x1002c5f7
invalid
xor eax, eax
inc eax
movzx eax, al
sub ecx, ebx

Function at 0x1002ec23
Capabilities:
Get geographical location

Disassembly:
add eax, 0x50fffff0
add ecx, 0x1002
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1002ec3f
and dword [edi], eax
inc eax
jmp 0x1002ec72
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x54]
jae 0x1002ec9d

Function at 0x1002edff
Capabilities:
Get geographical location

Disassembly:
cld
add byte [eax], al
add byte [ecx + 0x10045070], ah
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call 0x10053fbc
mov ebx, eax
call 0x10053fc3
push esi
mov edi, dword [eax + 0x34c]
call 0x1005d34b
pop ecx
mov ecx, dword [ebx + 0x64]
mov esi, eax
neg ecx
lea eax, [ebp - 0xf4]

Function at 0x1002ee39
Capabilities:
Get geographical location

Disassembly:
push 0x78
sbb ecx, ecx
and ecx, 0xfffff005
push eax
add ecx, 0x1002
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1002ee61
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x54]
call 0x1005a401
and dword [ebp - 0xf8], 0
invalid
pop ecx

Function at 0x1002ee76
Capabilities:
Get geographical location

Disassembly:
push 0x78
sbb ecx, ecx
and ecx, 0xfffff005
push eax
add ecx, 0x1002
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1002ee61
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x54]
call 0x1005a401
and dword [ebp - 0xf8], 0
invalid
pop ecx
Function at 0x1002eecd
Capabilities:
Get geographical location

Disassembly:
and dword [edi], 0
xor eax, eax
inc eax
jmp 0x1005d296
pop ecx
test eax, eax
jne 0x1002ef2e
push 0x78
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebx + 0x60]
neg eax
sbb eax, eax
and eax, 0xfffff002
add eax, 0x1001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002ee56
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1005a447
pop ecx
pop ecx
test eax, eax
jne 0x1002eec7
invalid
or dword [edi], 0x304
mov dword [edi + 4], esi
jmp 0x1002ef2b
test byte [edi], 2
jne 0x1002ef2e
cmp dword [ebx + 0x5c], 0
je 0x1002ef14
push dword [ebx + 0x5c]
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1005f676
add esp, 0xc
test eax, eax
jne 0x1002ef14
or dword [edi], 2
mov dword [edi + 8], esi
mov ecx, dword [ebx + 0x50]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xf8]
jne 0x1002eef7
sub ecx, edx
sar ecx, 1
cmp ecx, dword [ebx + 0x5c]
jne 0x1002ef2e
mov dword [edi + 4], esi
jmp 0x1002ef2e
mov edx, dword [edi]
test dl, 1
jne 0x1002ef2e
push esi
call 0x1005d575
pop ecx
test eax, eax
je 0x1002ef2e
or edx, 1
mov dword [edi], edx
mov dword [edi + 8], esi
mov eax, dword [edi]
mov ecx, 0x300
and eax, ecx
cmp eax, ecx
je 0x1002f02b
mov ecx, dword [ebx + 0x60]
lea eax, [ebp - 0xf4]
neg ecx
push 0x78
sbb ecx, ecx
and ecx, 0xfffff002
push eax
add ecx, 0x1001
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1002ef6e
mov dword [edi], eax
jmp 0x1005d1c7
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
push eax
call 0x1005a50e
pop ecx
pop ecx
test eax, eax
jne 0x1002efeb
or dword [edi], 0x200
mov edx, dword [edi]
cmp dword [ebx + 0x60], eax
xor eax, eax
cmp dword [ebx + 0x60], eax
jne 0x1002f02b
cmp dword [ebx + 0x5c], eax
je 0x1002f02b
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1005a597
pop ecx
pop ecx
test eax, eax
jne 0x1002f02b
push edi
xor ebx, ebx
push ebx
push esi
call 0x1005d68e
add esp, 0xc
test eax, eax
je 0x1002f02b
or dword [edi], 0x100
cmp dword [edi + 4], ebx
jne 0x1002f02b
mov dword [edi + 4], esi
mov eax, dword [edi]
shr eax, 2
not eax
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x100447e0
mov esp, ebp
pop ebp
ret 4
Function at 0x1002f05a
Capabilities:
Get geographical location

Disassembly:
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call 0x1005420c
mov ebx, eax
call 0x10054213
push esi
mov edi, dword [eax + 0x34c]
call 0x1005d59b
pop ecx
mov ecx, dword [ebx + 0x60]
mov esi, eax
neg ecx
lea eax, [ebp - 0xf4]
push 0x78
sbb ecx, ecx
and ecx, 0xfffff002
push eax
add ecx, 0x1001
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1002f0ab
and dword [edi], eax
inc eax
jmp 0x1002f10d
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1005a64b
pop ecx
pop ecx
test eax, eax
jne 0x1002f0ca
cmp dword [ebx + 0x60], eax
jne 0x1002f0fa
push edi
push 1
jmp 0x1002f0ed
cmp dword [ebx + 0x60], 0
jne 0x1002f103
cmp dword [ebx + 0x5c], 0
je 0x1002f103
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1005a676
pop ecx
pop ecx
test eax, eax
jne 0x1002f103
push edi
push eax
push esi
call 0x1005d76b
add esp, 0xc
test eax, eax
je 0x1002f103
or dword [edi], 4
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov eax, dword [edi]
shr eax, 2
not eax
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
invalid

Function at 0x1002f28b
Capabilities:
Get geographical location

Disassembly:
add cl, byte [ebp - 0x317403bb]
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add edx, dword [eax]
test eax, eax
jne 0x1002f2b2
xor eax, eax
jmp 0x1002f2e2
cmp esi, dword [ebp - 4]
je fcn.1002f2df
cmp dword [ebp + 0xc], 0
je fcn.1002f2df
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002f2c3
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call 0x1005d4a6
pop ecx
cmp eax, esi
je 0x1002f2ae
Function at 0x401370
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40b00c
push 0x80000002
call dword [0x43526c]
test eax, eax
jne 0x40139c
mov eax, 0xd903
jmp 0x401446
mov dword [0x435264], 0x24e1
mov ecx, dword [0x435264]
sub ecx, 0x24e1
mov dword [0x435264], ecx
mov edx, 1
test edx, edx
je 0x401446
mov eax, dword [0x435264]
cmp eax, dword [ebp + 0xc]
jb 0x4013d1
jmp 0x401446
cmp dword [0x435264], 0
jne 0x4013ef
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x4013ef
xor eax, eax
jmp 0x401446
mov ecx, dword [ebp + 8]
add ecx, dword [0x435264]
mov edx, dword [ecx]
add edx, dword [0x435264]
mov eax, dword [ebp + 8]
add eax, dword [0x435264]
mov dword [eax], edx
mov dword [ebp - 8], 0x3b7a27d
mov ecx, dword [0x435264]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 2]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x435264]
push ecx
call fcn.00401140
add esp, 8
mov edx, dword [0x435264]
add edx, 4
mov dword [0x435264], edx
jmp 0x4013b8
mov esp, ebp
pop ebp
ret
Function at 0x10001527
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x100389dc
push eax
call fcn.1003360c
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10001671
push dword [ebp - 0x78]
jmp 0x10001676
push 0x100389e4
push 0x20
push eax
call fcn.1003360c
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14
Function at 0x10007dfb
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x10039320
push eax
call fcn.1003360c
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10007f45
push dword [ebp - 0x78]
jmp 0x10007f4a
push 0x10039328
push 0x20
push eax
call fcn.1003360c
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14

Function at 0x10008ee6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f34
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10008f45
push 0xd
pop eax
jmp 0x10008f6f
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10008f48
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x1000c26f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1003360c
mov ebx, eax
cmp ebx, esi
je 0x1000c2e2
lea ecx, [ebp - 0x74]
call fcn.1000135a
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000c2fa
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000c26f
cmp eax, esi
jne 0x1000c32c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000c2ea
lea ecx, [ebp - 0x74]
call fcn.1000135a
push dword [ebp - 0x78]
mov ecx, edi
call fcn.10008dd7
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.1000135a
mov eax, esi
jmp 0x1000c2c8
Function at 0x1000dbda
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0xac], eax
mov eax, dword [ebp + 0xb8]
push esi
mov esi, dword [ebp + 0xbc]
push 0x10039ee8
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.1003360c
add esp, 0xc
test eax, eax
jne 0x1000dd31
push esi
call fcn.1003360c
pop ecx
test eax, eax
jne 0x1000dd31
push edi
xor edi, edi
inc edi
jmp 0x1000dd04
cmp dword [ebp - 0x78], 0x4034b50
jne 0x1000dd27
cmp word [ebp - 0x70], 0
jne 0x1000dd27
push dword [ebp - 0x7c]
movzx eax, word [ebp - 0x5e]
movzx esi, word [ebp - 0x5e]
push eax
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.1003360c
add esp, 0x10
cmp eax, esi
jne 0x1000dd27
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + esi - 0x58], 0
call fcn.1003360c
cmp word [ebp - 0x5c], 0
pop ecx
jbe 0x1000dc9c
movzx eax, word [ebp - 0x5c]
push edi
push eax
push dword [ebp - 0x7c]
call fcn.1002011f
add esp, 0xc
test eax, eax
jne 0x1000dd27
movzx eax, word [ebp - 0x5e]
cmp byte [ebp + eax - 0x59], 0x2f
je 0x1000dd04
push 0x10039eec
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.1003360c
add esp, 0xc
test eax, eax
jne 0x1000dd27
push dword [ebp - 0x62]
call fcn.1003360c
push dword [ebp - 0x7c]
mov esi, eax
push dword [ebp - 0x62]
push edi
push esi
call fcn.1003360c
add esp, 0x14
cmp eax, dword [ebp - 0x62]
jne 0x1000dd20
push dword [ebp - 0x80]
push dword [ebp - 0x62]
push edi
push esi
call fcn.1002001b
add esp, 0x10
push esi
cmp eax, dword [ebp - 0x62]
jne 0x1000dd21
call fcn.1003360c
push dword [ebp - 0x80]
call fcn.1001fe50
pop ecx
pop ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push edi
push 0x1e
push eax
call fcn.1003360c
add esp, 0x10
cmp eax, edi
je 0x1000dc34
jmp 0x1000dd27
push esi
call fcn.1003360c
pop ecx
push dword [ebp - 0x7c]
call fcn.1001fe50
pop ecx
pop edi
mov ecx, dword [ebp + 0xac]
xor ecx, ebp
pop esi
call fcn.1001d742
add ebp, 0xb0
leave
ret
Function at 0x1000dd47
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x10d0]
mov eax, 0x1150
call fcn.1001e5c0
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x10cc], eax
mov eax, dword [ebp + 0x10d8]
push ebx
push esi
push edi
mov esi, 0x7ff
xor edi, edi
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x8cd]
push edi
push eax
mov dword [ebp - 0x78], edi
mov byte [ebp + 0x8cc], 0
call fcn.1001d760
push esi
lea eax, [ebp + 0xcd]
push edi
push eax
mov byte [ebp + 0xcc], 0
call fcn.1001d760
inc esi
push str.SOFTWAREMozillaMozilla_Firefox
lea eax, [ebp + 0x8cc]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.1003360c
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0x24
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8cc]
push eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
test eax, eax
je 0x1000dde3
xor eax, eax
jmp 0x1000decd
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
push 0
push 0x10039f14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
test eax, eax
je 0x1000de0f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000dddc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xcc]
push eax
lea eax, [ebp + 0x8cc]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8cc]
push eax
push ebx
call edi
test eax, eax
jne 0x1000dddc
mov ebx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0
push 0
push 0x10039f50
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
test eax, eax
jne 0x1000de07
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000de72
sub eax, esi
cmp byte [eax + ebx - 1], 0x5c
je 0x1000de94
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000de85
mov esi, 0x10039f64
movsw word es:[edi], word [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000de97
mov esi, str.extensions
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x74]
push eax
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1000dee5
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x1000dddc
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x10d0
leave
ret
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [ebp - 0x74], 0x10
jmp 0x1000dec4