joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf04b0ce
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
test al, al
jne 0xf04b0fc
mov eax, 0x80070003
jmp 0xf04b1bf
mov eax, dword [ebp - 0x18]
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp - 4]
cmp cx, ax
je 0xf04b116
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0xf04b119
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntdll.dll_NtQueryFullAttributesFile]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp esi, ebx
jge 0xf04b16f
mov eax, esi
jmp 0xf04b1bd
mov eax, dword [ebp + 8]
sub eax, 4
je 0xf04b189
dec eax
dec eax
je 0xf04b184
dec eax
dec eax
jne 0xf04b18e
lea eax, [ebp - 0x68]
jmp 0xf04b191
lea eax, [ebp - 0x60]
jmp 0xf04b191
lea eax, [ebp - 0x58]
jmp 0xf04b191
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0f04a667
neg eax
sbb eax, eax
and eax, 0x10
push eax
call fcn.0f04a35e
cmp eax, ebx
jge 0xf04b1bd
cmp eax, 0x8007000d
jne 0xf04b1bd
cmp dword [ebp + 8], 4
jne 0xf04b1bd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xf04b1c9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword fs:[0x18]
push edi
mov edi, dword [ebp + 0x10]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
add esi, 0xbf8
call sym.ntvdm.exe_RedirectShortFileName
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [0xf0ae238]
mov ebx, eax
test ebx, ebx
jl 0xf04b2bc
push esi
call fcn.0f048402
mov eax, dword [ebp + 8]
cmp eax, 8
ja case.default.0xf04b23c
jmp dword [eax*4 + 0xf04b2cd]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0xf04b27b
and eax, 0x3f
mov word [edi], ax
jmp 0xf04b2ba
movzx eax, word [edi]
test eax, 0xffffffd0
je 0xf04b26a
mov ebx, 0x80070005
jmp 0xf04b2ba
and eax, 0x27
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0xf04b2ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, 0x80070000
jmp 0xf04b2ba
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
cmp eax, 0xffffffff
je 0xf04b27b
mov dword [edi], eax
jmp 0xf04b2ba
push edi
push esi
push eax
call fcn.0f04a504
mov ebx, eax
jmp 0xf04b2ba
push edi
push esi
push eax
call fcn.0f04b0ce
jmp 0xf04b2a7
mov ebx, 0x80070001
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0xc
Function at 0xf04e00b
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
or edi, 0xffffffff
cmp eax, edi
jne 0xf04e03d
push edi
push esi
call fcn.0f046730
xor eax, eax
jmp 0xf04e07c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
test eax, eax
je 0xf04e032
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, edi
je 0xf04e032
cmp dword [ebp - 4], 0
jne 0xf04e032
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0x10

Function at 0xf04ec64
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
pop esi
lea eax, [ebp - 0x10]
push eax
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xf0043a8
push 0x80000002
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf04ed08
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0xf004394
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf04ecff
cmp dword [ebp - 0x14], esi
je 0xf04ece0
push 0xf00438c
push esi
push 0xf0ae648
call fcn.0f00a32c
add esp, 0xc
jmp 0xf04ecfc
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0xf0ae648
call fcn.0f00b4ab
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov byte [eax + 0xf0ae647], bl
mov dword [ebp - 0x18], edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret
Function at 0xf04ed85
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3d
push edi
mov dword [ebp - 0xc], edi
call fcn.0f05ef00
pop ecx
pop ecx
push 0x15
mov dword [ebp - 4], eax
sub dword [ebp - 4], edi
pop esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], esi
mov edi, 0xf089768
mov ebx, 0xf0ae540
mov ecx, dword [esi*4 + 0xf0769f8]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf04edc8
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jne 0xf04eef4
push eax
push ecx
push dword [ebp + 8]
call fcn.0f00d1bf
add esp, 0xc
test eax, eax
jne 0xf04eef4
mov eax, dword [ebp - 0x14]
push 0x104
push edi
inc eax
push eax
push dword [esi*4 + 0xf0769f8]
call fcn.0f04ed1f
test eax, eax
je 0xf04eef4
cmp dword [0xf07df54], 0
jne 0xf04eef1
cmp dword [0xf089874], 0
je 0xf04eef1
test esi, esi
je 0xf04ee36
cmp esi, 1
jne 0xf04eef1
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf04ee3b
sub eax, edx
cmp eax, 0x14
jbe 0xf04eef1
lea eax, [esi*4 + 0xf0769f8]
mov esi, dword [eax]
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0xf04ee59
sub esi, eax
mov eax, 0x104
push eax
lea ecx, [esi + 0xf089769]
push ecx
push eax
push ebx
call fcn.0f00b4ab
mov eax, ebx
add esp, 0x10
mov byte [0xf0ae643], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf04ee85
sub eax, ecx
mov dword [0xf0ae658], eax
mov eax, dword [ebp - 8]
lea eax, [eax*4 + 0xf0769f8]
push dword [eax]
push 0x105
push edi
call fcn.0f00a32c
mov byte [esi + 0xf089768], 0x3d
inc esi
mov eax, 0x105
sub eax, esi
push 0xf0ae650
push eax
lea eax, [esi + 0xf089768]
push eax
call fcn.0f00a32c
push edi
push 0xf0043f0
mov dword [0xf089870], 1
call sub.ntdll.dll_DbgPrint
push ebx
push 0xf0043dc
call sub.ntdll.dll_DbgPrint
mov esi, dword [ebp - 8]
add esp, 0x28
mov dword [ebp - 0xc], edi
dec esi
mov dword [ebp - 8], esi
jns 0xf04edb9
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf04ef0d
Capabilities:
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
call fcn.0f04ec64
test eax, eax
je 0xf04f045
push esi
push edi
lea eax, [ebp - 0x310]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test edi, edi
je 0xf04f041
cmp edi, 0x208
jae 0xf04f041
push 0xf004450
call sub.ntdll.dll_DbgPrint
pop ecx
xor eax, eax
mov word [ebp + edi*2 - 0x312], ax
push esi
lea eax, [ebp - 0x310]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0xf04f041
cmp eax, esi
jae 0xf04f041
push 0xf00441c
call sub.ntdll.dll_DbgPrint
lea eax, [ebp - 0x108]
mov dword [ebp - 0x314], eax
mov eax, esi
mov word [ebp - 0x316], ax
pop ecx
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
test eax, eax
jl 0xf04f041
lea eax, [ebp - 0x108]
push eax
push 0xf004404
call sub.ntdll.dll_DbgPrint
lea eax, [ebp - 0x108]
push eax
push esi
push 0xf0ae540
call fcn.0f00a32c
movzx eax, word [ebp - 0x318]
mov dword [0xf0ae658], eax
push 3
lea eax, [ebp - 0x108]
push eax
push 8
push 0xf0ae650
call fcn.0f00b4ab
push 0xf0ae648
push 5
push 0xf0ae653
call fcn.0f00a32c
xor eax, eax
add esp, 0x30
inc eax
mov dword [0xf089874], eax
mov ebx, eax
pop edi
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret

Function at 0xf04f057
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0xf0ae658]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp + 8], edi
cmp dword [0xf07df54], esi
jne 0xf04f139
cmp dword [0xf089870], esi
je 0xf04f139
push edi
push 0xf0044c4
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
cmp dword [ebp + 0xc], esi
je 0xf04f11b
cmp edi, esi
je 0xf04f11b
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf04f0a4
sub eax, edx
mov esi, eax
cmp esi, 7
jb 0xf04f11b
push 7
push edi
push 0xf0ae650
call fcn.0f00d1bf
add esp, 0xc
test eax, eax
jne 0xf04f11b
lea eax, [esi + ebx + 2]
add esi, 2
cmp eax, esi
jb 0xf04f11b
cmp dword [ebp + 0x10], eax
jbe 0xf04f11b
mov esi, dword [ebp + 0xc]
push 0xf0ae540
push dword [ebp + 0x10]
push esi
call fcn.0f00a32c
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0x10]
call fcn.0f04674b
test eax, eax
jl 0xf04f139
cmp byte [edi], 0
je 0xf04f114
lea eax, [edi + 7]
push eax
push dword [ebp + 0x10]
add ebx, esi
push ebx
call fcn.0f00a32c
add esp, 0xc
mov dword [ebp + 8], esi
cmp esi, edi
jne 0xf04f127
push 0xf0044a0
call sub.ntdll.dll_DbgPrint
jmp 0xf04f133
push esi
push 0xf004480
call sub.ntdll.dll_DbgPrint
pop ecx
mov eax, dword [ebp + 8]
pop ecx
jmp 0xf04f13b
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0xf04f147
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0xf07df54], 0
push ebx
push esi
push edi
jne 0xf04f1fb
cmp dword [0xf089870], 0
je 0xf04f1fb
mov edi, dword [ebp + 8]
test edi, edi
je 0xf04f1f7
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0xf04f1f7
push edi
push 0xf004518
call sub.ntdll.dll_DbgPrint
push 5
mov esi, 0xf004510
push esi
push edi
call fcn.0f00d1bf
add esp, 0x14
test eax, eax
jne 0xf04f19f
push 5
jmp 0xf04f1b6
push 4
mov esi, 0xf004508
push esi
push edi
call fcn.0f00d1bf
add esp, 0xc
test eax, eax
jne 0xf04f1f7
push 4
mov ecx, dword [0xf0ae658]
mov eax, esi
pop esi
lea ecx, [ecx + esi + 2]
cmp ecx, dword [ebp + 0x10]
jae 0xf04f1f7
push eax
mov edi, 0x104
push edi
push ebx
call fcn.0f00a32c
push 0xf0ae540
sub edi, esi
push edi
add esi, ebx
push esi
call fcn.0f00a32c
push ebx
push 0xf0044e8
call sub.ntdll.dll_DbgPrint
add esp, 0x20
mov eax, ebx
jmp 0xf04f1fe
mov eax, edi
jmp 0xf04f1fe
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0xf04f20a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0xf07df54], 0
push esi
push edi
mov edi, dword [0xf0ae658]
jne 0xf04f295
cmp dword [0xf089870], 0
je 0xf04f295
mov esi, dword [ebp + 8]
test esi, esi
je 0xf04f295
push esi
push 0xf004554
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
cmp dword [ebp + 0xc], edi
jb 0xf04f295
push edi
push 0xf0ae540
push esi
call fcn.0f00d1bf
add esp, 0xc
test eax, eax
jne 0xf04f295
push 7
pop eax
sub eax, edi
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
inc eax
cmp eax, dword [ebp + 0x10]
ja 0xf04f298
push 7
push 0xf0ae650
push esi
call fcn.0f05f550
lea eax, [edi + esi]
lea ecx, [esi + 7]
add esp, 0xc
sub ecx, eax
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0xf04f27e
push esi
push 0xf004534
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0xf04fa43
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, 0xf0045ac
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], eax
je 0xf04fad5
cmp dword [ebp + 0x10], 1
je 0xf04fadc
cmp dword [ebp + 0x10], 2
jne 0xf04fb8a
lea ecx, [ebp + 0x10]
push ecx
push 1
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionTerminal_Server
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf04faed
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push 0
push str.RootDrive
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], 0
jne 0xf04fb8a
cmp dword [ebp + 8], 1
jne 0xf04fb8a
dec dword [ebp - 4]
jmp 0xf04faed
mov eax, 0xf0045a0
jmp 0xf04fae1
mov eax, 0xf004594
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xf04fb8a
cmp dword [ebp - 4], edi
jae 0xf04fb8a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf04fb05
mov ecx, dword [ebp - 4]
sub eax, edx
add eax, ecx
cmp eax, edi
jae 0xf04fb8a
cmp byte [ecx + ebx - 1], 0x5c
jne 0xf04fb25
mov dword [ebp - 0xc], 0xf0045ad
push dword [ebp - 0xc]
push edi
push ebx
call fcn.0f00a2b3
add esp, 0xc
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
test eax, eax
jbe 0xf04fb54
cmp eax, edi
jae 0xf04fb54
push ebx
call esi
cmp eax, 0xffffffff
jne 0xf04fb7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0xf04fb64
cmp eax, 2
jne 0xf04fb85
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
test eax, eax
je 0xf04fb85
push ebx
call esi
cmp eax, 0xffffffff
je 0xf04fb85
shr eax, 4
and eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0xf04fb8c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xf04fb98
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
xor ebx, ebx
push 0x20019
push ebx
push 0xf0045ec
push 0x80000002
mov dword [ebp - 0x218], ebx
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x20c], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, 0x104
test eax, eax
jne 0xf04fc80
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xf00426c
push dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
call ebx
test eax, eax
jne 0xf04fc46
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0xf04fd25
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0xf004268
push dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
call ebx
push dword [ebp - 0x210]
test eax, eax
je 0xf04fc3b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf0045d8
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0f00a32c
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0xf04fccb
test byte [ebp - 0x248], 0x10
jne 0xf04fd25
push 0xf0045c4
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0f00a32c
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0xf04fd10
test byte [ebp - 0x248], 0x10
jne 0xf04fd25
push 0xf0045b4
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0f00a32c
add esp, 0xc
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp dword [ebp - 0x220], 0
je 0xf04fd92
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax]
cmp eax, esi
jb 0xf04fd92
lea ecx, [ebp - 0x108]
push ecx
push eax
push dword [ebp - 0x220]
call fcn.0f00a32c
add esp, 0xc
mov dword [ebp - 0x218], 1
jmp 0xf04fd9a
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 0x218]
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 8
Function at 0xf050874
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0xf004658
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf0508cb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf004638
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf0508cb
cmp dword [ebp - 0xc], 1
jne 0xf0508cb
inc edi
cmp dword [ebp - 4], 0
je 0xf0508da
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret

Function at 0xf0508e4
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0f0060e0
add esp, 0xc
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf050941
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x10c], eax
je 0xf050972
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x21
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x152
mov byte [ebp - 0xc9], bl
call fcn.0f02c9f5
call fcn.0f02d021
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0xc
Function at 0xf051602
Capabilities:
Delete file
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0xf051732
mov ecx, dword [edi + 0x20]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
test ecx, ecx
je 0xf0516c8
mov eax, dword [0xf0899b8]
cmp ecx, eax
jne 0xf05163a
mov esi, ecx
mov eax, dword [esi]
mov dword [0xf0899b8], eax
jmp 0xf051658
mov esi, eax
test eax, eax
je 0xf0516c8
cmp esi, ecx
je 0xf051650
mov eax, esi
mov esi, dword [esi]
test esi, esi
jne 0xf051644
test esi, esi
je 0xf0516c8
mov ecx, dword [esi]
mov dword [eax], ecx
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xf051687
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xffffffffffffffff
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 8]
call ebx
push dword [esi + 0xc]
call ebx
push dword [esi + 0x10]
call ebx
push dword [esi + 0x14]
call ebx
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x18]
call fcn.0f00996a
push esi
call fcn.0f00996a
pop ecx
pop ecx
mov eax, dword [edi + 0x24]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0xf0516fa
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffc17
add eax, 0x3e8
push eax
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x18]
call ebx
mov eax, dword [edi + 0x28]
test eax, eax
je 0xf051729
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
neg esi
sbb esi, esi
and esi, 0xfffffc17
add esi, 0x3e8
push esi
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x1c]
call ebx
push edi
call fcn.0f00996a
pop ecx
pop esi
pop ebx
xor eax, eax
inc eax
pop edi
pop ebp
ret 8