joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002eb6f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ebb1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002ebac
push 0x20e9
push 0x8e4
push 0
push 0x76e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002ec36
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002ebeb
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 5
jge 0x1002ec36
mov dword [ebp - 0x24], 0x5eb91548
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002ec10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1002ec2d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1001b8b2
mov dword [eax], 0xe582b275
jmp 0x1002ec05
mov dword [ebp - 0x24], 3
jmp 0x1002ebe0
mov esp, ebp
pop ebp
ret

Function at 0x1003014a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10030175
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10030173
push 0xe0a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x100301a0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x100314f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003151d
push 0
push 0x1117
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10031568
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003154b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10031568
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001b8b2
mov dword [eax], 1
jmp 0x10031540
mov esp, ebp
pop ebp
ret
Function at 0x10033666
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100336be
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100336bc
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x6740
push 1
push 0x2c8a
mov eax, dword [ebp - 4]
push dword [eax]
push 0x7a37
push 0x65f9
call fcn.1002ec91
add esp, 0x1c
jmp 0x100336ed
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100336ed
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1878
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esp, ebp
pop ebp
ret

Function at 0x1003373c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x5596
push 1
lea eax, [ebp - 0x10]
push eax
push 0x7d93
push 0x2ca7
push 0x6a66
push 0x1ec1
lea eax, [ebp + 8]
push eax
push 0x749d
call fcn.10033419
add esp, 0x24
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003378a
xor eax, eax
jmp 0x100338b2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
push 0x4814
push 0x3832
call fcn.1003352d
add esp, 0x18
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100337bc
xor eax, eax
jmp 0x100338b2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
call fcn.10033599
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x100337db
xor eax, eax
jmp 0x100338b2
lea eax, [ebp - 0x24]
push eax
push 0x669a
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100335dd
add esp, 0x1c
push dword [ebp - 8]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.10031aa9
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x4dfd
call fcn.10033666
add esp, 0x10
push dword [ebp - 4]
call fcn.10032a23
pop ecx
test eax, eax
jne 0x10033845
xor eax, eax
jmp 0x100338b2
push 0x3781
push 1
lea eax, [ebp - 4]
push eax
call fcn.100336f1
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003389a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x10033877
xor eax, eax
jmp 0x100338b2
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10033890
xor eax, eax
jmp 0x100338b2
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100338ab
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x100338af
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10046b97
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10046bb7
push 0
push 0x1e52
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10046d04
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, 0x369029ef
test eax, eax
je 0x10046cda
push 1
mov ecx, dword [ebp - 0x18]
call fcn.1001b8b2
mov eax, dword [eax]
add eax, 0x5dda
mov ecx, dword [ebp - 4]
imul eax, dword [ecx]
test eax, eax
jne 0x10046c5c
push 0
mov ecx, dword [ebp - 0x44]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10046c5c
and dword [ebp - 8], 0
jmp 0x10046c63
mov dword [ebp - 8], 1
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1001b8b2
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
je 0x10046c7d
mov dword [ebp - 0xc], 1
jmp 0x10046c81
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x10046c90
mov dword [ebp - 0x10], 1
jmp 0x10046c94
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jne 0x10046ca7
mov dword [ebp - 0x4c], 1
jmp 0x10046cab
and dword [ebp - 0x4c], 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1001b8b2
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
push 2
mov ecx, dword [ebp - 0x54]
call fcn.1001b8b2
imul eax, dword [eax], 0xffff
test eax, eax
je 0x10046cda
mov dword [ebp - 0x1c], 1
jmp 0x10046cde
and dword [ebp - 0x1c], 0
push 1
mov ecx, dword [ebp - 0x18]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
jne 0x10046cf8
mov dword [ebp - 0x20], 1
jmp 0x10046cfc
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10046e06
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10046f5a
mov dword [ebp - 0xc], 0xb9f9b319
mov dword [ebp - 0x14], 0xed99ea7
mov dword [ebp - 0xc], 0xffffffe8
jmp 0x10046e36
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffee
jl 0x10046f58
mov dword [ebp - 8], 0xfe5f36f6
mov dword [ebp - 0x10], 0
jmp 0x10046e57
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10046e6a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c], 0xfffffff8
jmp 0x10046e50
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10046e85
mov dword [ebp - 0x2c], 1
jmp 0x10046e89
and dword [ebp - 0x2c], 0
cmp dword [ebp - 8], 0
jne 0x10046ea1
mov eax, 0x1510
test eax, eax
je 0x10046ea1
mov dword [ebp - 0x18], 1
jmp 0x10046ea5
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0xbd13d8c5
ja 0x10046eb7
mov dword [ebp - 0x1c], 1
jmp 0x10046ebb
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 0x14], 0x8e13
cmp dword [ebp - 0xc], eax
jg 0x10046edf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3c], 0
jne 0x10046edf
and dword [ebp - 0x20], 0
jmp 0x10046ee6
mov dword [ebp - 0x20], 1
imul eax, dword [ebp - 0x20], 0x11c3
cmp eax, dword [ebp - 0xc]
jl 0x10046efb
mov dword [ebp - 0x24], 1
jmp 0x10046eff
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0x42bb
jne 0x10046f11
mov dword [ebp - 0x28], 1
jmp 0x10046f15
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
dec eax
cmp dword [ebp - 0x2c], eax
jne 0x10046f3f
mov dword [ebp - 8], 3
jmp 0x10046f2e
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x10046f3d
mov dword [ebp - 0x14], 0x617a9413
jmp 0x10046f27
jmp 0x10046f53
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10046f53
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10046e2f
jmp 0x10046f77
push 0
push 0
push 0
push 0
push 0xd64
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x100494ed
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004961e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10049581
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub eax, 0x34bea37b
jne 0x10049578
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
je 0x10049581
mov dword [ebp - 8], 1
jmp 0x10049585
and dword [ebp - 8], 0
mov esi, dword [ebp - 8]
add esi, 0xa1d0
push 3
mov ecx, dword [ebp - 0x48]
call fcn.1001b8b2
cmp esi, dword [eax]
jge 0x100495a5
mov dword [ebp - 0xc], 1
jmp 0x100495a9
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
je 0x100495bc
mov dword [ebp - 0x10], 1
jmp 0x100495c0
and dword [ebp - 0x10], 0
push 0
mov ecx, dword [ebp - 0x4c]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jl 0x100495da
mov dword [ebp - 0x18], 1
jmp 0x100495de
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jg 0x100495f1
mov dword [ebp - 0x1c], 1
jmp 0x100495f5
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x50]
mov dword [eax], 0x83d52604
cmp dword [ebp - 0x1c], 0x83d52604
jle 0x10049610
mov dword [ebp - 0x24], 1
jmp 0x10049614
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
jmp 0x10049643
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x10049643
push 0x18bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004a5a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1004a5d7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1004a5d2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1004a6ec
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.1001b8b2
cmp dword [eax], 0xa5ef
jl 0x1004a652
mov dword [ebp - 0x10], 1
jmp 0x1004a656
and dword [ebp - 0x10], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.1001b8b2
cmp dword [eax], 1
jg 0x1004a66e
mov dword [ebp - 0xc], 1
jmp 0x1004a672
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jge 0x1004a685
mov dword [ebp - 8], 1
jmp 0x1004a689
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push 0
mov ecx, dword [ebp - 4]
call fcn.1001b8b2
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x94b2
jg 0x1004a6b7
mov dword [ebp - 0x18], 1
jmp 0x1004a6bb
and dword [ebp - 0x18], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.1001b8b2
mov eax, dword [eax]
imul eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x1004ab97
Capabilities:
Get file system object information
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004abbd
push 0x20e9
push 0x8e4
push 0
push 0x76e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1004abcf
push 1
push 0x1b30
push 0x8fb
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret
Function at 0x1004b664
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004b689
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x1459f451
jmp 0x1004b6c9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x1004b6ab
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1004b6c9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004b6c7
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1004b6a0
mov esp, ebp
pop ebp
ret

Function at 0x1004ba9a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004bb0a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, ecx
push eax
mov ecx, dword [ebp - 0x28]
call fcn.10050922
jmp 0x1004bb10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret

Function at 0x1004bcfd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004bd44
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1004bd64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1004bd64
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret
Function at 0x1004be1f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004be8d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
mov dword [ecx + eax], edx
jmp 0x1004be9f
push 1
push 0x1b30
push 0x8fb
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esp, ebp
pop ebp
ret

Function at 0x1004bfe4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004c02b
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1004c044
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004c044
push 0x50b
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x100506af
Capabilities:
Query environment variable
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
mov dword [ebp - 8], 0x68ec0ae9
push esi
mov esi, ecx
mov dword [ebp - 8], ebx
jmp 0x100506d5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x100506c7
mov dword [ebp - 8], ebx
jmp 0x1005071e
mov dword [ebp - 0xc], 7
mov dword [ebp - 0xc], ebx
jmp 0x10050715
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x10], 1
dec dword [ebp - 0x10]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10050712
push ebx
push 0xb14
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jne 0x100506ec
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xb
jl 0x100506e0
mov eax, dword [ebp - 8]
mov ecx, 0xcd76
mov eax, dword [ebp - 8]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x14]
jg 0x10050749
cmp dword [ebp - 8], ebx
jne 0x10050749
mov eax, ebx
jmp 0x1005074c
xor eax, eax
inc eax
push esi
push 0x5d31
mov dword [ebp - 0x14], eax
push 1
call fcn.1004c12b
mov dword [ebp - 0xc], 0xf6af1124
add esp, 0xc
mov dword [ebp - 0xc], 6
jmp 0x10050796
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10050784
push 0x18bc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10050793
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffef
jg 0x1005076f
push esi
call fcn.1003373c
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret