joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102401a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1009394
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x1024053
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x10240cd
cmp dword [ebp - 4], edi
jne 0x1024065
mov esi, 0x80004005
jmp 0x10240dc
push ebx
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x1009370
push ebx
push dword [ebp - 4]
call edi
test eax, eax
jle 0x102408c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x10240cc
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 8]
add eax, 2
push eax
call fcn.01023c1d
mov esi, eax
test esi, esi
jl 0x10240cc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0
push 0
push ebx
push dword [ebp - 4]
call edi
test eax, eax
jle 0x10240ca
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop ebx
cmp dword [ebp - 4], 0
je 0x10240dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x10240e9
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x102410e
mov dword [ebp + 0xc], 0x80070057
jmp 0x102419d
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jne 0x102411f
mov dword [ebp + 0xc], 0x80070057
jmp 0x102419c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [esi], ebx
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x102419c
push 1
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.01023ce5
test eax, eax
jl 0x102419c
push dword [ebp - 4]
mov dword [ebp + 0x10], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1024193
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1008cec
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1024193
cmp dword [ebp + 0x10], 0x34
jne 0x1024193
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp + 0xc], ebx
lea eax, [ebp - 4]
push eax
call fcn.01023d2d
pop esi
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
leave
ret 0xc
Function at 0x1024613
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10292ec
call fcn.01022df8
sub esp, 0x18
and dword [ebp - 0x24], 0
push ebx
push esi
push edi
push 0xff
mov esi, ecx
push 0x1001938
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString_1
xor ebx, ebx
lea eax, [ebp - 0x18]
inc ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0102398d
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.01023b90
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.010245f2
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.010245d1
mov ecx, eax
push dword [esi + 0x44]
mov eax, dword [esi + 0x18]
push dword [esi + 0x40]
xor edx, edx
push dword [esi + 0x3c]
mov byte [ebp - 4], 5
push dword [edi]
push dword [esi + 0x38]
push dword [ecx]
mov ecx, 0x5a0
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [esi + 0x2c]
push dword [ebp - 0x14]
push dword [esi + 0x20]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x1c]
push eax
div ecx
mov ecx, dword [esi + 0x14]
push eax
mov eax, 0xffff
and ecx, eax
push ecx
movzx ecx, word [esi + 0x16]
push ecx
push dword [ebp - 0x18]
mov ecx, dword [esi + 0x10]
push dword [esi + 0xc]
and ecx, eax
push dword [esi]
movzx eax, word [esi + 0x12]
push ecx
push eax
push dword [esi + 8]
lea eax, [ebp - 0x10]
push dword [esi + 4]
push 0x10093e0
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x6c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1024b22
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x1029343
call fcn.01022df8
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov edi, ecx
jne 0x1024b42
mov ebx, 0x80070057
jmp 0x1024c27
mov eax, dword [edi + 0x20]
xor ebx, ebx
test eax, eax
jne 0x1024c1f
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0xc]
push eax
push esi
mov ecx, edi
call fcn.0102449c
mov ebx, eax
test ebx, ebx
jl 0x1024c27
lea eax, [esi + 0x10]
push eax
mov ecx, edi
call fcn.01023ded
mov ebx, eax
test ebx, ebx
jl 0x1024c27
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x28]
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, edi
call fcn.010232ca
mov ebx, eax
test ebx, ebx
jl 0x1024c27
lea eax, [esi + 0x30]
push eax
mov ecx, edi
call fcn.01023399
mov ebx, eax
test ebx, ebx
jl 0x1024c27
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esi + 0x38], eax
lea eax, [esi + 0x44]
push eax
lea eax, [esi + 0x40]
push eax
lea eax, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.01024adc
mov ebx, eax
test ebx, ebx
jl 0x1024c27
push 0x48
call sub.MFC42u.DLL_operatornew
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x1024c07
push esi
mov ecx, eax
call fcn.010242e8
jmp 0x1024c09
xor eax, eax
test eax, eax
mov dword [edi + 0x20], eax
jne 0x1024c27
push 8
mov ebx, 0x8007000e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1024c27
push eax
mov ecx, esi
call fcn.01024311
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1024ef4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x1001808
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x1024fa7
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x1024f48
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x1024fa7
cmp dword [ebp - 0xc], ebx
jne 0x1024f5d
mov dword [ebp - 8], 0x80004005
jmp 0x1024fb8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x10098a8
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x1024fa7
cmp eax, ebx
jle 0x1024f8c
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x1024fa7
mov eax, dword [ebp - 0x14]
sub eax, 4
neg eax
sbb eax, eax
test eax, 0x80004005
jl 0x1024fa7
mov byte [ebp - 1], bl
cmp dword [ebp - 0xc], ebx
je 0x1024fb8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0100d194
mov al, byte [ebp - 1]
cmp al, bl
mov byte [esi + 0x3a], al
jne 0x1024fd5
cmp dword [ebp - 0x18], ebx
setne al
mov byte [esi + 0x39], al
mov ecx, esi
call fcn.0100d1aa
xor eax, eax
cmp dword [ebp - 8], ebx
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x102526c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.0100d194
mov al, byte [esi + 0x39]
mov ecx, esi
mov byte [ebp - 1], al
call fcn.0100d1aa
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x20006
push ebx
push 0x1009910
push ebx
push 0x1001808
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x10252ca
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x102530c
cmp dword [ebp - 0xc], ebx
jne 0x10252df
mov dword [ebp - 8], 0x80004005
jmp 0x1025336
xor eax, eax
cmp byte [ebp - 1], bl
push 4
setne al
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push 0x10098a8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jle 0x1025309
and eax, edi
or eax, esi
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], ebx
je 0x102531d
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 8], ebx
jl 0x1025336
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.0100d194
mov ecx, esi
mov byte [esi + 0x3a], bl
call fcn.0100d1aa
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1025343
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x10293a9
call fcn.01022df8
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call sub.MFC42u.DLL_CString::CString_2
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0100d194
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x18], eax
mov al, byte [esi + 0x38]
mov byte [ebp - 0xd], al
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x28], eax
lea eax, [esi + 0x20]
push eax
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::operator
lea eax, [esi + 0x24]
push eax
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::operator
mov ecx, esi
call fcn.0100d1aa
cmp dword [ebp - 0x18], ebx
jne 0x10253f4
push ebx
lea eax, [ebp - 0x18]
push eax
push 1
push 0x1009930
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
cmp eax, ebx
jne 0x10253ea
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10253d8
call esi
mov esi, eax
jmp 0x10253ec
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10253ec
xor esi, esi
cmp esi, ebx
jl 0x10254f0
mov eax, dword [ebp - 0x18]
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x20006
push ebx
push 0x1009910
push ebx
push 0x1001808
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0xc
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jle 0x1025437
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10254f0
cmp dword [ebp - 0x14], ebx
jne 0x1025450
mov esi, 0x80004005
jmp 0x1025501
cmp byte [ebp - 0xd], bl
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x102548b
mov eax, dword [ebp - 0x28]
push 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 4
push ebx
push 0x10098ec
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jle 0x1025483
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10254ef
jmp 0x1025499
push 0x10098ec
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx - 8]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10098dc
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jle 0x10254c0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x10254ef
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 8]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10098c0
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jle 0x10254ed
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
cmp dword [ebp - 0x14], ebx
je 0x1025501
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10265bd
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
push 0x102f7f4
mov dword [ebx], 0x100a33c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.01010b3d
mov dword [ebx + 4], eax
xor esi, esi
mov dword [ebx + 8], esi
xor eax, eax
lea edi, [ebx + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [0x102f7e8], esi
mov dword [0x102f7f0], esi
jne 0x1026610
push esi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x102f7e8], eax
cmp dword [0x102f7ec], esi
jne 0x10266a1
push esi
lea eax, [ebp - 4]
push eax
push 1
push 0x100a2d8
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
mov edi, 0x100a278
push edi
push esi
je 0x1026652
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0xc
push eax
jmp 0x1026653
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp dword [ebp - 4], esi
mov dword [0x102f7ec], eax
je 0x102666c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x102f7ec], esi
jne 0x10266a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x102668e
push edi
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
jmp 0x102669c
cmp eax, 6
jne 0x10266a1
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x102f7ec], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1026c98
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push 8
mov dword [ebp - 8], ebx
call sub.MFC42u.DLL_operatornew
cmp eax, ebx
pop ecx
je 0x1026cc3
mov cl, byte [ebp + 8]
mov byte [eax], cl
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov dword [ebp + 8], eax
jmp 0x1026cc6
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
je 0x1026d73
call fcn.01010b3d
mov esi, eax
call fcn.01010ac9
mov ecx, esi
mov edi, eax
call fcn.0102641e
test al, al
je 0x1026cff
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, esi
call fcn.010257ea
mov ecx, edi
call fcn.010235eb
jmp 0x1026d73
mov eax, dword [0x102f7e8]
cmp eax, ebx
je 0x1026d13
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x1026d73
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x1026bb9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [ebp + 0x10], bl
mov edi, eax
jne 0x1026d73
push dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
test eax, eax
jne 0x1026d4f
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x1026d73
push 0x7d0
call fcn.01026405
push ebx
push edi
call esi
test eax, eax
je 0x1026d73
cmp dword [ebp - 4], ebx
je 0x1026d73
push ebx
push ebx
push 0x12
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1026e76
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x102e77c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x11c
push edi
xor esi, esi
lea eax, [ebp - 0x120]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call edi
test eax, eax
jne 0x1026ed1
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call edi
mov eax, dword [ebp - 0x110]
dec eax
je 0x1026f09
dec eax
jne 0x1026f2f
cmp dword [ebp - 0x11c], 5
jne 0x1026ef7
push 2
pop eax
cmp eax, dword [ebp - 0x118]
sbb esi, esi
and esi, 3
inc esi
jmp 0x1026f2f
push 4
pop eax
cmp eax, dword [ebp - 0x11c]
sbb esi, esi
neg esi
add esi, 3
jmp 0x1026f2f
cmp dword [ebp - 0x11c], 4
jne 0x1026f2f
cmp dword [ebp - 0x118], esi
je 0x1026f2c
cmp dword [ebp - 0x118], 0xa
je 0x1026f2c
cmp dword [ebp - 0x118], 0x5a
jne 0x1026f2f
push 2
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0102222e
leave
ret
Function at 0x1026f44
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102e77c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x102f800], si
jne 0x1026fdc
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x100af10
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1026fdc
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x100afc8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1026fdc
push 3
push dword [esi*8 + 0x100ae30]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x1026fce
inc esi
cmp esi, 0x1c
jl 0x1026fad
jmp 0x1026fdc
mov ax, word [esi*8 + 0x100ae34]
mov word [0x102f800], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x102f800]
xor ecx, ebp
pop esi
call fcn.0102222e
leave
ret
Function at 0x4c78de00
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x4c78de13
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4c78de0f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x4c78de40
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x4c78de7f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4c78de75
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4c78de81
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4c78de65
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c7a2d10
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x254]
test eax, eax
mov ecx, dword [esi + 0x250]
je 0x4c7a2d3f
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
call ecx
mov esi, eax
pop esi
pop ebp
ret 0x10
test dword [esi + 0x14], 0x80000000
je 0x4c7a2d8b
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x4c7a2df2
push 0x42
push 0x4c7824cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
mov eax, esi
pop esi
pop ebp
ret 0x10
cmp dword [esi + 0x268], 0
jne 0x4c7a2d9b
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
je 0x4c7a2dd9
mov ecx, dword [ebp + 0xc]
push 0
push edi
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4c7a2dd9
push 0x50
push 0x4c7824cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [esi + 0x268]
push edi
push ebx
push edx
push eax
push ecx
call fcn.4c7a3380
pop edi
pop ebx
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x4c7a3570
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f8
push esi
push edi
xor esi, esi
push 0x3e6
lea eax, [ebp - 0x3f6]
push esi
push eax
mov byte [ebp - 1], 0
mov byte [ebp - 8], 0
mov word [ebp - 7], si
mov dword [ebp - 0xc], esi
mov word [ebp - 0x3f8], si
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0xc
add ecx, 0x4ba
push ecx
push 0x3e8
lea edx, [ebp - 0x3f8]
push edx
push 0x4c7825ac
push 0x4c782598
push 0x4c78256c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
cmp edi, esi
je 0x4c7a3732
mov ecx, 0x4c7825ac
lea eax, [ebp - 0x3f8]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c7a3616
cmp dx, si
je 0x4c7a3612
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c7a3616
add eax, 4
add ecx, 4
cmp dx, si
jne 0x4c7a35f0
xor eax, eax
jmp 0x4c7a361b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x4c7a3732
push ebx
shr edi, 1
push edi
push 0x40
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp edi, esi
mov ebx, eax
jbe 0x4c7a366c
lea edi, [ebp - 0x3f6]
mov edi, edi
mov al, byte [edi - 2]
mov cl, byte [edi]
push 0x10
lea edx, [ebp - 0xc]
mov byte [ebp - 8], al
push edx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 7], cl
call dword [sym.imp.msvcrt.dll_strtoul]
mov byte [ebx + esi], al
add esi, 1
add esp, 0xc
add edi, 4
cmp esi, dword [ebp - 0x10]
jb 0x4c7a3640
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x45c]
push esi
push ebx
push edx
call fcn.4c7a3000
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c7a36a1
push 0xa90
push 0x4c78254c
call edi
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
test ebx, ebx
je 0x4c7a36ac
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x1000
sub eax, esi
pop ebx
je 0x4c7a36f8
mov esi, eax
jmp 0x4c7a36c0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x45c]
push 1
lea eax, [ebp - 1]
push eax
push edx
call fcn.4c7a3000
test eax, eax
jne 0x4c7a36f3
push 0xa9e
push 0x4c78254c
call edi
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
sub esi, 1
jne 0x4c7a36c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x45c]
push ecx
call fcn.4c7a2e00
test eax, eax
jne 0x4c7a3725
push 0xaa5
push 0x4c78254c
call edi
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4