joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030782
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
test ebx, ebx
je 0x1003085d
xor eax, eax
cmp ax, word [ebx]
je 0x1003085d
xor edx, edx
call fcn.10030a25
mov edi, eax
test edi, edi
je 0x1003082f
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x100307e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push 0x1000e490
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
xor edx, edx
mov ecx, edi
call fcn.10030230
mov ebx, eax
test ebx, ebx
jne 0x1003081a
test esi, esi
jne 0x100307fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1000e518
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, ebx
jmp 0x10030852
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
push 0x1000e598
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x10030867
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1003089d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
xor esi, esi
test ecx, ecx
je 0x1003090b
xor eax, eax
cmp ax, word [ecx]
je 0x1003090b
push ebx
xor edx, edx
call fcn.10030a25
mov ebx, eax
test ebx, ebx
je 0x10030906
push edi
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100308d1
test al, 0x10
je 0x100308d1
inc esi
jmp 0x100308ee
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x100308e6
mov edi, 0x10b
jmp 0x100308ee
cmp edi, 2
jne 0x100308ee
push 3
pop edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebx
mov eax, esi
pop esi
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret

Function at 0x1003091d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
test ecx, ecx
je 0x10030988
xor eax, eax
cmp ax, word [ecx]
je 0x10030988
push esi
push edi
xor edx, edx
call fcn.10030a25
mov edi, eax
test edi, edi
je 0x10030973
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10030959
and esi, 0x10
sete bl
neg esi
sbb esi, esi
and esi, 2
jmp 0x10030961
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003097b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
ret
Function at 0x10030f3d
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov eax, ecx
and dword [ebp - 4], esi
xor ebx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esi
test eax, eax
je 0x10031026
xor ecx, ecx
cmp cx, word [eax]
je 0x10031026
push edi
lea edx, [ebp - 4]
mov ecx, eax
call fcn.10030a25
mov edi, eax
test edi, edi
je 0x10031012
mov esi, dword [ebp - 4]
test esi, esi
je 0x10030f8a
add esi, 2
jmp 0x10030f8c
mov esi, edi
push 0x5c
pop ebx
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
mov ecx, edi
test esi, esi
je 0x10030fbf
xor eax, eax
mov word [esi], ax
call fcn.1003089d
test eax, eax
jne 0x10030fb7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], bx
add esi, 2
jmp 0x10030f8f
call fcn.1003089d
xor esi, esi
inc esi
push 0
pop ebx
cmp eax, esi
je 0x10031000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x10031000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push dword [ebp - 8]
push 0x1000e6c0
push 0x3000000
push 0x1005f83c
call fcn.1002fa5c
mov esi, dword [ebp - 0xc]
add esp, 0x14
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003101a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
jmp 0x10031030
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x10031b69
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x224]
xor ebx, ebx
push eax
push 1
push ebx
mov esi, ecx
push 0x1000e770
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10031c6b
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1000e7e0
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x10031c52
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edi, eax
test edi, edi
js 0x10031c5d
lea eax, [ebp - 0x220]
push eax
push 0x1000e7fc
push 4
push ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x10031c5d
push 0x40
push ebx
push 2
push 4
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x220]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, eax
mov eax, dword [ebp - 0x220]
test edi, edi
js 0x10031c40
mov dword [esi], eax
jmp 0x10031c5d
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x10060380]
call esi
jmp 0x10031c5d
jle 0x10031c5d
movzx edi, di
or edi, 0x80070000
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10031c76
jle 0x10031c76
movzx edi, di
or edi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004f280
leave
ret
Function at 0x10038fcd
Capabilities:
Check if file exists

Disassembly:
push 0x218
mov eax, 0x10052696
call fcn.1004f8f5
mov eax, dword [ebp + 8]
xor edi, edi
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x224], eax
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.1002f6ff
push 0x1000fbd8
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.100393b3
lea eax, [ebp - 0x218]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], edi
test esi, esi
jne 0x10039052
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10039086
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x1000fc18
call fcn.1002b64a
mov edi, eax
jmp 0x10039080
lea edx, [ebp - 0x220]
mov dword [ebp - 0x220], edi
mov ecx, esi
call fcn.10038eab
mov ebx, eax
test ebx, ebx
jns 0x1003908c
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x1000fc18
call fcn.1002b85f
mov edi, ebx
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x100390a4
jmp 0x1003909e
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x220]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push esi
call fcn.100392d9
mov eax, edi
call fcn.1004f892
ret 8

Function at 0x1003cf08
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.1003089d
test eax, eax
jne 0x1003cfc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003cf30
movzx eax, ax
or eax, 0x80070000
lea esi, [eax + 0x7ff8fffd]
neg esi
sbb esi, esi
and esi, eax
jge 0x1003cf5e
push edi
push 0x100112d8
push esi
push 0x10011128
push 0x2cb
push dword [ebp + 4]
call fcn.1002dfef
add esp, 0x18
mov eax, esi
jmp 0x1003cfc6
mov ecx, edi
call fcn.10030f3d
test eax, eax
jne 0x1003cf86
push edi
push 0x10011324
push 0x10011128
push 0x2d1
push dword [ebp + 4]
call fcn.10038242
add esp, 0x14
jmp 0x1003cfc6
xor edx, edx
mov ecx, edi
call fcn.10030a25
test eax, eax
jne 0x1003cfa5
push edi
push 0x1001135c
push 0x10011128
push 0x2d8
jmp 0x1003cf79
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1003cfc4
push edi
push 0x10011398
push 0x10011128
push 0x2dd
jmp 0x1003cf79
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x10046524
Capabilities:
Hash data via bcrypt

Disassembly:
push 0x1c
mov eax, 0x100538a9
call fcn.1004f8bc
mov ebx, edx
mov edi, ecx
push ecx
call fcn.10046f45
xor esi, esi
lea ecx, [ebp - 0x20]
push esi
push esi
push esi
push esi
push esi
push ecx
push eax
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
jns 0x10046555
push 7
pop ecx
int 0x29
mov dword [ebp - 4], esi
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push edi
mov ecx, esi
mov byte [ebp - 4], 1
call dword [0x10060380]
call esi
mov esi, eax
test esi, esi
jns 0x10046584
push esi
push 0x100152f8
push 0x6c
jmp 0x100465ae
mov eax, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0x1c], edi
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov ecx, esi
call dword [0x10060380]
call esi
mov esi, eax
test esi, esi
jns 0x100465bc
push esi
push 0x100152f8
push 0x6f
mov ecx, dword [ebp + 4]
pop edx
call fcn.1002b85f
jmp 0x10046689
cmp dword [ebp - 0x1c], edi
je 0x1004667d
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call dword [0x10060380]
call esi
mov esi, eax
test esi, esi
js 0x100466d4
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x10], edi
mov esi, dword [ecx + 0xc]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
mov ecx, esi
call dword [0x10060380]
call esi
mov esi, eax
test esi, esi
js 0x100466b2
push edi
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x1004663b
push 7
pop ecx
int 0x29
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov ecx, esi
call dword [0x10060380]
call esi
mov esi, eax
test esi, esi
js 0x100466a8
cmp dword [ebp - 0x10], 0
je 0x10046667
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1001a5e0
cmp dword [ebp - 0x1c], 0
jne 0x100465c5
mov edx, ebx
lea ecx, [ebp - 0x20]
call fcn.10046ef6
mov esi, edi
lea ecx, [ebp - 0x18]
call fcn.1001a5e0
cmp dword [ebp - 0x20], 0
je 0x100466a0
push dword [ebp - 0x20]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov eax, esi
call fcn.1004f878
ret
push esi
push 0x100152f8
push 0x7b
jmp 0x100466ba
push esi
push 0x100152f8
push 0x77
mov ecx, dword [ebp + 4]
pop edx
call fcn.1002b85f
cmp dword [ebp - 0x10], 0
je 0x100466e5
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100466e5
mov ecx, dword [ebp + 4]
push esi
push 0x100152f8
push 0x73
pop edx
call fcn.1002b85f
lea ecx, [ebp - 0x14]
call fcn.1001a5e0
jmp 0x10046689
Function at 0x100466f5
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x10046707
sub edx, ecx
sar edx, 1
push 0x5c
pop eax
lea esi, [edi + edx*2]
xor edx, edx
mov bl, dl
cmp esi, edi
jbe 0x1004675f
sub esi, 2
cmp word [esi], ax
jne 0x1004675b
push edx
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1004674a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1004674e
mov bl, 1
jmp 0x10046753
cmp eax, 3
jne 0x1004678a
push 0x5c
pop eax
mov word [esi], ax
xor edx, edx
test bl, bl
je 0x10046720
cmp word [esi], dx
je 0x100467a3
push 0x5c
pop ebx
lea esi, [esi + 2]
movzx ecx, word [esi]
cmp cx, bx
jne 0x1004679e
push edx
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100467ab
mov word [esi], bx
xor edx, edx
jmp 0x10046767
mov edx, 0xaa
mov ecx, dword [ebp + 4]
push 0x100152f8
call fcn.1002b64a
jmp 0x100467a5
test cx, cx
jne 0x10046767
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, 0xbd
jmp 0x1004678f
Function at 0x1004ca75
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
mov dword [ebp - 8], 0x20
mov dword [ebp - 4], edx
mov ebx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
push esi
push edi
mov edi, edx
test ecx, ecx
jne 0x1004caa1
push 0x57
jmp 0x1004cb81
lea eax, [ebp - 4]
push eax
push 0x20019
push edx
push 0x10016d30
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x1004cac5
and dword [ebp - 4], ebx
jmp 0x1004cb82
push 0x40
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1004cb82
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 8]
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
sub ecx, 0
je 0x1004cb51
sub ecx, 0xea
jne 0x1004cb61
cmp dword [ebp - 0x14], ecx
jne 0x1004cb7f
mov eax, dword [ebp - 8]
push edi
add eax, eax
push ecx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
lea eax, [ecx + ecx]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1004cb82
mov dword [ebp - 0x14], 1
xor ecx, ecx
jmp 0x1004cae7
push dword [ebp + 0xc]
push edi
call fcn.1003564a
test eax, eax
je 0x1004cb73
inc ebx
jmp 0x1004cae2
sub ecx, 0x19
je 0x1004cb6e
mov esi, eax
test eax, eax
je 0x1004cb93
jmp 0x1004cb82
xor ebx, ebx
inc ebx
jmp 0x1004cb96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1004cb82
push 0x32
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004cb93
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x1004cba5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1004cbb9
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x1004cbe3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x14], 4
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
push edi
mov edi, ecx
test eax, eax
je 0x1004cd02
test ebx, ebx
je 0x1004cd02
mov dword [eax], ecx
mov edx, SysReAllocString
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.1002d7b4
test eax, eax
jns 0x1004cc3b
mov ebx, dword [ebp + 8]
push 0x32
pop esi
jmp 0x1004cd25
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
add eax, eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1004cc66
mov ebx, dword [ebp + 8]
jmp 0x1004cd07
push ebx
push 0x10016ce8
push dword [ebp - 8]
push edi
call fcn.10019147
add esp, 0x10
test eax, eax
jns 0x1004cc86
mov ebx, dword [ebp + 8]
push 0x32
jmp 0x1004cd06
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1004cc5e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x10016cfc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1004cc5e
cmp dword [ebp - 0xc], 4
jne 0x1004cc7c
push dword [ebp - 0x10]
push ebx
push 0x10016d0c
push dword [ebp - 8]
push edi
call fcn.10019147
mov ebx, dword [ebp + 8]
add esp, 0x14
test eax, eax
jns 0x1004ccea
push 0x32
jmp 0x1004cd06
push ebx
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
jmp 0x1004cd07
push 0x57
mov ebx, eax
pop esi
cmp dword [ebp - 4], 0
je 0x1004cd16
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1004cd21
mov ecx, edi
call fcn.1004cbc8
test esi, esi
je 0x1004cd28
and dword [ebx], 0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x1004d278
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
xor ebx, ebx
push edi
xor edx, edx
call fcn.10030a25
mov edi, eax
test edi, edi
je 0x1004d2e2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp esi, 0xffffffff
je 0x1004d2ba
test esi, 0x400
je 0x1004d2ba
xor eax, eax
inc eax
jmp 0x1004d2bc
xor eax, eax
mov edx, dword [ebp - 4]
xor ebx, ebx
test ecx, ecx
push edi
push 0
mov dword [edx], eax
sete bl
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1004e4e8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
mov ebx, ecx
lea esi, [ebp + 8]
pop ecx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1c]
xor edi, edi
mov eax, esi
mov dword [ebp - 0x2c], edi
shr eax, 0x10
push 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 4
push 0x10017fd8
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x1004e549
push eax
push 0x10018058
push 0x41
mov ecx, dword [ebp + 4]
pop edx
call fcn.1002dc3c
jmp 0x1004e612
push 4
movzx eax, si
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push 0x10017fcc
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x1004e572
push eax
push 0x10018058
push 0x4c
jmp 0x1004e53b
movzx eax, byte [ebp - 0x18]
mov edx, dword [eax*4 + 0x10002a80]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1004e582
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0x10017fe4
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x1004e5b7
push eax
push 0x10018058
push 0x57
jmp 0x1004e53b
mov esi, edi
movzx edx, word [ebp + esi*2 - 0x17]
mov eax, edx
test dl, dl
je 0x1004e610
shr eax, 8
mov edi, dword [eax*4 + 0x10002a80]
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x30], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2c]
jne 0x1004e5d6
sub ecx, dword [ebp - 0x30]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
movzx eax, dl
push 7
push dword [eax*4 + 0x10002a80]
xor eax, eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x1004e623
inc esi
cmp esi, 4
jb 0x1004e5b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004f280
leave
ret 0x14
push eax
push 0x10018058
push 0x6a
jmp 0x1004e53b

Function at 0x1004f9e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1004fa1e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1004fa16
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1004fa20
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1004fa06
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1004fb00
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004fb2f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004fb2f
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x490980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x45b015
lea edi, [esi - 0x5a015]
push edi
or ebp, 0xffffffff
jmp 0x4909a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4909a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x490998
mov eax, 1
add ebx, ebx
jne 0x4909bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4909cc
jne 0x4909eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4909eb
dec eax
add ebx, ebx
jne 0x4909d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4909b0
add ebx, ebx
jne 0x4909e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x490a3d
xor ecx, ecx
sub eax, 3
jb 0x490a03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x490a72
sar eax, 1
mov ebp, eax
jmp 0x490a0e
add ebx, ebx
jne 0x490a0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4909dc
inc ecx
add ebx, ebx
jne 0x490a1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4909dc
add ebx, ebx
jne 0x490a29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x490a1e
jne 0x490a3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x490a1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x490a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x490a4e
jmp 0x49099e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x490a5c
add edi, ecx
jmp 0x49099e
pop esi
mov edi, esi
mov ecx, 0x2c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x490a7a
cmp byte [edi], 0
jne 0x490a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x490a7f
lea edi, [esi + 0x8e000]
mov eax, dword [edi]
or eax, eax
je 0x490aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x901e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9026c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x490aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x90274]
or eax, eax
je 0x490ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x490ac9
call dword [esi + 0x90270]
mov ebp, dword [esi + 0x90278]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x490b22
sub esp, 0xffffff80
jmp 0x401d2a