joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ec18
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x78]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x14], 0
call fcn.10002570
push esi
mov dword [ebp - 4], 0
call fcn.10011a60
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
cmovae eax, dword [ebp - 0x78]
cmp dword [esi + 0x14], 8
jb 0x10004d64
mov esi, dword [esi]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.1014d757
add esp, 0xc
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.100024d0
test esi, esi
je 0x10004d84
xor eax, eax
jmp 0x10004dc1
test ebx, ebx
je 0x10004db1
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x10004db1
push dword [ebp - 0x14]
push edi
push 1
push ebx
call fcn.1014daa2
push dword [ebp - 0x14]
mov esi, eax
call fcn.1014d8d2
xor eax, eax
add esp, 0x14
cmp esi, edi
sete al
jmp 0x10004dc1
push dword [ebp - 0x14]
call fcn.1014d8d2
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100050f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ecab
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0
push 0x8000020
push 3
push 0
push 3
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100051a6
push edi
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x2c], 0x101cd2d8
mov dword [ebp - 0x28], 0
call fcn.10002570
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov ecx, esi
call fcn.10002930
movq xmm0, qword [ebp - 0x2c]
push eax
push str._tasp::library_CreateFile__strfilename:_s__err_lu.
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.10005540
add esp, 0x18
lea ecx, [ebp - 0x8c]
call fcn.100024d0
xor eax, eax
xor edx, edx
jmp 0x100051be
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
Function at 0x100052b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ece0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1010
call fcn.10150280
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ecx], 0
mov dword [ebx], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], edi
jb 0x10005314
mov eax, dword [eax]
push 0
push 0x8000027
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1020], esi
cmp esi, 0xffffffff
jne 0x10005343
xor edi, edi
xor esi, esi
jmp 0x10005419
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
jle 0x10005419
add eax, 2
push eax
call fcn.1002fb37
mov edx, dword [ebp - 0x101c]
mov ecx, eax
add esp, 4
mov dword [edx], ecx
test ecx, ecx
je 0x100053ff
mov eax, dword [ebx]
xor edi, edi
push edi
mov byte [ecx + eax], 0
mov eax, dword [edx]
mov ecx, dword [ebx]
mov byte [ecx + eax + 1], 0
lea eax, [ebp - 0x1018]
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100053f8
mov ecx, dword [ebp - 0x1018]
test ecx, ecx
je 0x100053f8
mov eax, dword [ebx]
cmp eax, edi
je 0x100053f8
push ecx
sub eax, edi
lea ecx, [ebp - 0x1014]
push ecx
push eax
mov eax, dword [ebp - 0x101c]
mov eax, dword [eax]
add eax, edi
push eax
call fcn.1014aae1
add edi, dword [ebp - 0x1018]
lea eax, [ebp - 0x1018]
add esp, 0x10
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100053a4
mov edi, 1
jmp 0x10005419
mov dword [ebx], 0
jmp 0x10005419
test esi, esi
je 0x10005424
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006770
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f1fa
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x101f7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x14], esi
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], eax
mov byte [esi + 0x18], al
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], ax
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], eax
mov byte [esi + 0x48], al
push eax
push 0x101cf8e0
mov byte [ebp - 4], 3
call fcn.1001e640
lea ecx, [esi + 0x64]
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x14], ecx
mov word [ecx], ax
mov dword [ecx + 0x2c], 0xf
mov dword [ecx + 0x28], eax
mov byte [ecx + 0x18], al
mov dword [ecx + 0x44], 7
mov dword [ecx + 0x40], eax
mov word [ecx + 0x30], ax
mov dword [ecx + 0x5c], 0xf
mov dword [ecx + 0x58], eax
mov byte [ecx + 0x48], al
push eax
push 0x101cf8e0
mov byte [ebp - 4], 8
call fcn.1001e640
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100081e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f4e7
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], eax
mov byte [esi + 0x18], al
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], ax
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], eax
mov byte [esi + 0x48], al
push eax
push 0x101cf8e0
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1001e640
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x23
push 0
mov dword [ebp - 0x424], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x100082e1
cmp word [ebp - 0x218], ax
jne 0x100082b8
xor ecx, ecx
lea eax, [ebp - 0x218]
push ecx
push eax
mov ecx, esi
call fcn.1001e640
jmp 0x1000832f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100082c1
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001e640
jmp 0x1000832f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.10150100
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 3
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
call fcn.100125b0
push 0xb
push str.ProgramData
mov ecx, esi
call fcn.100125b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fac8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
jb 0x1000b037
mov eax, dword [esi]
jmp 0x1000b039
mov eax, esi
push eax
push str.CDebugLog::WriteConf_text_s
lea eax, [ebp - 0x2c]
push eax
push 0x10203748
call fcn.10011050
add esp, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x1000b058
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x18], 0x10
jb 0x1000b070
push dword [ebp - 0x2c]
call fcn.1002fb32
add esp, 4
cmp dword [esi + 0x14], 0x10
jb 0x1000b07a
mov edx, dword [esi]
jmp 0x1000b07c
mov edx, esi
cmp byte [edx], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jne 0x1000b097
xor ecx, ecx
jmp 0x1000b0a9
mov ecx, edx
lea edi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b0a0
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.1001ec60
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push 0x101cd0f8
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x10203a28
call fcn.10004d00
mov dword [ebp - 4], 0xffffffff
mov edi, eax
cmp dword [ebp - 0x18], 0x10
jb 0x1000b0f2
push dword [ebp - 0x2c]
call fcn.1002fb32
add esp, 4
cmp esi, 0x10203bdc
je 0x1000b109
push 0xffffffffffffffff
push 0
push esi
mov ecx, 0x10203bdc
call fcn.1001f250
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b400
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
cmp eax, 1
jl 0x1000b43b
cmp eax, dword [0x10203bd4]
jge 0x1000b43b
mov dword [eax*4 + 0x10203bac], 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
push eax
push str.CDebugLog_SetFilterLevelArray
lea eax, [ebp - 0x6c]
push eax
push 0x10203748
call fcn.10010fa0
add esp, 0x10
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x58], 8
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x6c]
call fcn.100024d0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c200
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x102036d4], 0
push ebx
mov ebx, dword [ebp + 8]
je 0x1000c349
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x248
push 0x40
call esi
mov edi, eax
mov dword [ebp - 0x88], 0x248
lea eax, [ebp - 0x88]
push eax
push edi
call dword [0x102036d4]
cmp eax, 0x6f
jne 0x1000c267
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x88]
push 0x40
call esi
mov edi, eax
lea eax, [ebp - 0x88]
push eax
push edi
call dword [0x102036d4]
test eax, eax
je 0x1000c2a5
push eax
push str.Call_to_GetNetworkParams_failed._Return_Value:__08x_n
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.1014db24
add esp, 0x10
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1000c340
mov esi, edi
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000c2b0
sub esi, ecx
mov eax, 0x7f
cmp esi, 0x80
cmovae esi, eax
push esi
push edi
push 0x80
push ebx
call fcn.1014cad7
lea edx, [edi + 0x84]
mov byte [esi + ebx], 0
mov esi, edx
lea ecx, [ebx + 0x80]
add esp, 0x10
lea eax, [esi + 1]
mov dword [ebp - 0x8c], eax
mov al, byte [esi]
inc esi
test al, al
jne 0x1000c2f2
sub esi, dword [ebp - 0x8c]
mov eax, 0x7f
cmp esi, 0x80
cmovae esi, eax
push esi
push edx
push 0x80
push ecx
call fcn.1014cad7
mov byte [esi + ebx + 0x80], 0
add esp, 0x10
lea esi, [edi + 0x10c]
test esi, esi
je 0x1000c340
nop
lea eax, [esi + 4]
push eax
push ebx
call fcn.1000c680
mov esi, dword [esi]
test esi, esi
jne 0x1000c330
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c720
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102036dc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
test eax, eax
je 0x1000c7f3
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0
call eax
test eax, eax
jne 0x1000c774
push ebx
push eax
mov ecx, edi
call fcn.1000bd80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xe8
jne 0x1000c799
push str._CMFLAdapter_:No_adapter_information_exists_for_the_local_computer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x32
jne 0x1000c7bc
push str._CMFLAdapter_:GetAdaptersInfo_is_not_supported_by_the_operating_system_running_on_the_local_computer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x6f
jne 0x1000c7f3
push dword [ebp - 8]
call fcn.1014dd53
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
call dword [0x102036dc]
test eax, eax
jne 0x1000c7f3
push ebx
push esi
mov ecx, edi
call fcn.1000bd80
test esi, esi
je 0x1000c7f3
push esi
call fcn.1014dde5
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4

Function at 0x1000cbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [0x101f87e0]
test edi, edi
jne 0x1000cc05
xor eax, eax
pop edi
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 0xc]
or eax, 0xffffffff
push esi
xor esi, esi
test ebx, ebx
je 0x1000cc2a
mov ecx, dword [ebp + 8]
movzx edx, byte [esi + ecx]
inc esi
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edi + edx*4]
cmp esi, ebx
jb 0x1000cc13
pop esi
pop ebx
not eax
pop edi
pop ebp
ret 8

Function at 0x1000cc40
Capabilities:
Hash data with crc32

Disassembly:
push 0x400
call fcn.1002fb37
mov edx, eax
add esp, 4
test edx, edx
je 0x1000cce9
xor ecx, ecx
lea esp, [esp]
mov eax, ecx
shr eax, 1
test cl, 1
je 0x1000cc6e
xor eax, 0xedb88320
test al, 1
je 0x1000cc7b
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000cc7d
shr eax, 1
test al, 1
je 0x1000cc8a
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000cc8c
shr eax, 1
test al, 1
je 0x1000cc99
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000cc9b
shr eax, 1
test al, 1
je 0x1000cca8
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000ccaa
shr eax, 1
test al, 1
je 0x1000ccb7
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000ccb9
shr eax, 1
test al, 1
je 0x1000ccc6
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000ccc8
shr eax, 1
test al, 1
je 0x1000ccd5
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000ccd7
shr eax, 1
mov dword [edx + ecx*4], eax
inc ecx
cmp ecx, 0x100
jl 0x1000cc60
mov eax, edx
ret
Function at 0x1000cd80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fcb0
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0xd4]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x82c], 0
mov dword [ebp - 4], 1
mov esi, 0x20019
cmp dword [0x102036ec], 0
je 0x1000ce90
mov dword [ebp - 0x814], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
test ebx, ebx
je 0x1000ce14
lea eax, [ebp - 0x814]
push eax
push ebx
call dword [0x102036ec]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x814], 0
je 0x1000ce8a
cmp dword [ebp + 0xd0], 0
je 0x1000ce2d
mov esi, 0x20219
jmp 0x1000ce8a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x102036ec], 0
mov dword [ebp - 0x828], eax
je 0x1000ce85
mov dword [ebp - 0x814], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
test ebx, ebx
je 0x1000ce6d
lea eax, [ebp - 0x814]
push eax
push ebx
call dword [0x102036ec]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x814], 0
je 0x1000ce85
mov ecx, dword [ebp - 0x828]
call fcn.100100e0
test eax, eax
je 0x1000ce8a
mov esi, 0x20119
mov ebx, dword [ebp - 0x820]
cmp dword [ebp + 0x24], 8
lea ecx, [ebp - 0x81c]
push ecx
push esi
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push 0
push eax
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000cef8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x101cf8e0
mov ecx, edi
call fcn.10002570
lea ecx, [ebp + 0x10]
call fcn.100024d0
lea ecx, [ebp + 0x70]
call fcn.100024d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 0xd0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x818], 0x800
push 0
push eax
call fcn.10150100
add esp, 0xc
lea ecx, [ebp - 0x818]
cmp dword [ebp + 0x84], 8
lea eax, [ebp + 0x70]
cmovae eax, dword [ebp + 0x70]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push ebx
push 0
push eax
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x81c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000cebc
mov ecx, dword [ebp - 0x818]
cmp ecx, 0x7fe
ja 0x1000cebc
test ebx, ebx
je 0x1000cf93
cmp dword [ebx], 4
jne 0x1000cf93
push dword [ebp - 0x810]
push 0x101cf758
push edi
push 0x10203748
call fcn.10010fa0
add esp, 0x10
jmp 0x1000cec8
shr ecx, 1
xor eax, eax
dec ecx
test ecx, ecx
jle 0x1000cfb8
lea edx, [eax + 0x20]
nop
cmp word [ebp + eax*2 - 0x810], 0
jne 0x1000cfb3
mov word [ebp + eax*2 - 0x810], dx
inc eax
cmp eax, ecx
jl 0x1000cfa0
lea eax, [ebp - 0x810]
push eax
jmp 0x1000cec1
Function at 0x1000d100
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x102036ec], 0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x1c], eax
mov edi, 0xf003f
je 0x1000d1b1
mov dword [ebp - 8], 0
call ebx
mov esi, eax
test esi, esi
je 0x1000d154
lea eax, [ebp - 8]
push eax
push esi
call dword [0x102036ec]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x1000d1b1
cmp dword [ebp + 0x20], 0
je 0x1000d167
mov edi, 0xf023f
jmp 0x1000d1b1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x102036ec], 0
mov dword [ebp - 0x14], eax
je 0x1000d1ac
mov dword [ebp - 8], 0
call ebx
mov esi, eax
test esi, esi
je 0x1000d19a
lea eax, [ebp - 8]
push eax
push esi
call dword [0x102036ec]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x1000d1ac
mov ecx, dword [ebp - 0x14]
call fcn.100100e0
test eax, eax
je 0x1000d1b1
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedStartupFolder
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000d296
cmp dword [0x102036ec], 0
mov esi, 0x20006
je 0x1000d25c
mov dword [ebp - 8], 0
call ebx
mov edi, eax
test edi, edi
je 0x1000d1ff
lea eax, [ebp - 8]
push eax
push edi
call dword [0x102036ec]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x1000d25c
cmp dword [ebp + 0x20], 0
je 0x1000d212
mov esi, 0x20206
jmp 0x1000d25c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x102036ec], 0
mov dword [ebp - 0x14], eax
je 0x1000d257
mov dword [ebp - 8], 0
call ebx
mov edi, eax
test edi, edi
je 0x1000d245
lea eax, [ebp - 8]
push eax
push edi
call dword [0x102036ec]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x1000d257
mov ecx, dword [ebp - 0x14]
call fcn.100100e0
test eax, eax
je 0x1000d25c
mov esi, 0x20106
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedStartupFolder
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1000d296
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 0x1c
push 0xc
push dword [ebp - 0x1c]
push 3
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1000d7a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fe6f
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x101f7210]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 1
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], eax
mov byte [esi + 0x18], al
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], ax
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], eax
mov byte [esi + 0x48], al
push eax
push 0x101cf8e0
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.1001e640
mov byte [ebp - 4], 1
push 0
mov dword [ebp - 0x478], 1
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0
push eax
push 0x101c5ff0
push 1
push 0
push 0x101c6050
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1000d8f5
mov eax, dword [ebp - 0x470]
lea edx, [ebp - 0x474]
push edx
push 0x101c6090
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x1000d8e9
mov eax, dword [ebp - 0x474]
lea edx, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
push 0
cmovae edx, dword [ebp + 0xc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x1000d8dd
mov eax, dword [ebp - 0x470]
lea edx, [ebp - 0x46c]
push 8
push edx
push 0x104
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
push edx
push eax
call dword [ecx + 0xc]
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.10002620
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x470]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp + 0xc]
call fcn.100024d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 0x64