joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4597ad
Capabilities:
Delete file

Disassembly:
sub esp, 0x21c
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x230]
mov edi, dword [esp + 0x234]
add esp, 0xfffffff8
push 0
push 0
push edi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov ebx, eax
add esp, 8
cmp ebx, 0x104
jg 0x459810
add esp, 0xfffffff8
push ebx
lea esi, [esp + 0x1c]
push esi
push edi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [esi + ebx*2], 0
add esp, 0xfffffffc
push esi
call fcn.00419d64
add esp, 0x10
test eax, eax
jne 0x459810
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_DeleteFileW
add esp, 0xc
test eax, eax
je 0x459810
mov eax, 1
jmp 0x45981d
mov eax, dword [0x505a70]
mov eax, dword [eax + 0x140]
call eax
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x21c
ret

Function at 0x459aad
Capabilities:
Move file

Disassembly:
sub esp, 0x42c
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x440]
mov esi, dword [esp + 0x444]
add esp, 0xfffffff8
push 0
push 0
push esi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov ebx, eax
add esp, 8
cmp ebx, 0x104
jg 0x459b70
add esp, 0xfffffff8
push ebx
lea edi, [esp + 0x22c]
push edi
push esi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [edi + ebx*2], 0
push 0
push 0
mov eax, dword [esp + 0x45c]
push eax
mov eax, dword [esp + 0x45c]
push eax
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov ebx, eax
add esp, 8
cmp ebx, 0x104
jg 0x459b70
add esp, 0xfffffff8
push ebx
lea esi, [esp + 0x1c]
push esi
mov eax, dword [esp + 0x45c]
push eax
mov eax, dword [esp + 0x45c]
push eax
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [esi + ebx*2], 0
add esp, 0xfffffffc
push edi
call fcn.00419d64
add esp, 0x10
test eax, eax
jne 0x459b70
add esp, 0xfffffff8
push esi
push edi
call sub.KERNEL32.dll_MoveFileW
add esp, 8
test eax, eax
je 0x459b70
mov eax, 1
jmp 0x459b7d
mov eax, dword [0x505a70]
mov eax, dword [eax + 0x140]
call eax
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x42c
ret

Function at 0x459df0
Capabilities:
Clear file content

Disassembly:
sub esp, 0x18
push ebx
add esp, 0xfffffff4
mov ebx, dword [esp + 0x2c]
dec ebx
push ebx
call sub.KERNEL32.dll_SetEndOfFile
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
pop ebx
add esp, 0x18
ret
Function at 0x459f94
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebp
push edi
push esi
push ebx
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
add esp, 0xfffffff4
push ebp
call fcn.00459f18
mov dword [esp + 0x38], eax
add esp, 0xfffffff4
push 0
lea ebx, [esp + 0x4c]
push ebx
imul esi, edi
push esi
mov eax, dword [esp + 0x68]
push eax
jmp 0x45a024
call sub.KERNEL32.dll_GetLastError
add esp, 0xfffffff4
push esi
push dword [esp + 0x3c]
push 0x459f50
push 0x459f82
push 2
call fcn.0041f7b0
add esp, 0x20
cmp eax, 3
je 0x45a036
add esp, 0xfffffffc
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], edx
sar edx, 0x1f
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push edx
push eax
push ebp
call fcn.0045a048
add esp, 0xfffffff4
push 0
push ebx
push esi
mov edx, dword [esp + 0x68]
push edx
lea eax, [ebp - 1]
push eax
call sub.KERNEL32.dll_ReadFile
add esp, 0x1c
cmp dword [esp + 0x2c], esi
jne 0x459fd0
mov eax, dword [esp + 0x2c]
xor edx, edx
div edi
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x2c
ret

Function at 0x45a084
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x34]
add esp, 0xfffffff4
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, ebx
imul eax, dword [esp + 0x4c]
push eax
push dword [esp + 0x48]
mov eax, dword [esp + 0x58]
dec eax
push eax
call sub.KERNEL32.dll_WriteFile
mov eax, dword [esp + 0x28]
xor edx, edx
div ebx
add esp, 0xc
pop ebx
add esp, 0x28
ret

Function at 0x491f2c
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
push 6
lea ebx, [esp + 0x14]
push ebx
push 0x5a
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
dec eax
push eax
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x24
ret

Function at 0x491f60
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
push 6
lea ebx, [esp + 0x14]
push ebx
push 0x59
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
dec eax
push eax
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x24
ret

Function at 0x491f8f
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x28
push ebx
push 6
lea ebx, [esp + 0x14]
push ebx
push 0x1b
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jne 0x491fa4
xor eax, eax
jmp 0x491fa9
mov eax, 1
pop ebx
add esp, 0x28
ret

Function at 0x491fba
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
push 6
lea eax, [esp + 4]
push eax
push 0x14
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
dec eax
add esp, 0x1c
ret

Function at 0x491fdc
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
push 6
lea ebx, [esp + 0x14]
push ebx
push 0x14
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
dec eax
push eax
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x24
ret
Function at 0x49200c
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push edi
push esi
push 2
lea esi, [esp + 0x22]
push esi
push 0xd
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
je 0x492034
mov edi, 0x491ffd
mov ecx, 2
cld
test al, 0
repe cmpsb byte [esi], byte es:[edi]
je 0x492034
xor eax, eax
jmp 0x492039
mov eax, 1
pop esi
pop edi
add esp, 0x24
ret

Function at 0x492050
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
push 4
lea ebx, [esp + 0x20]
push ebx
push 0xf
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
push 1
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x24
ret

Function at 0x492084
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
push 4
lea ebx, [esp + 0x20]
push ebx
push 0xe
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
push 1
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x24
ret

Function at 0x492117
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc
push 0
push 0
push 0x20
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
dec eax
add esp, 0xc
ret

Function at 0x492138
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x64
push esi
push ebx
mov esi, dword [esp + 0x70]
push 0x50
lea ebx, [esp + 0x14]
push ebx
push 0x20
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
dec eax
push eax
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x64
ret

Function at 0x492163
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc
push 0
push 0
push 0x1f
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
dec eax
add esp, 0xc
ret

Function at 0x492184
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x64
push esi
push ebx
mov esi, dword [esp + 0x70]
push 0x50
lea ebx, [esp + 0x14]
push ebx
push 0x1f
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
add esp, 0xfffffffc
dec eax
push eax
push ebx
push esi
call sub.crtdll.dll_strncpy
add esp, 0x10
pop ebx
pop esi
add esp, 0x64
ret
Function at 0x493279
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x28
push ebx
add esp, 0xfffffff8
push 0x1c0
push 1
call sub.crtdll.dll_calloc
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x49326b
xor eax, eax
jmp 0x49334d
cmp dword [esp + 0x30], 0
je 0x493336
add esp, 0xfffffff8
push 8
push 0x401
call sub.crtdll.dll_calloc
mov dword [ebx + 0x48], eax
add esp, 0xfffffff8
push 0x201
push 1
call sub.crtdll.dll_calloc
mov dword [ebx + 0x50], eax
add esp, 0x20
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 0x40], eax
add esp, 0xfffffffc
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
mov dword [ebx + 0x3c], eax
add esp, 0xfffffffc
lea eax, [esp + 0x24]
push eax
push 4
push ebx
push 0x492d4c
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebx + 0x44], eax
add esp, 8
test eax, eax
jne 0x4932f1
add esp, 0xfffffff4
push 0x493200
call fcn.0041f898
add esp, 0x10
add esp, 0xfffffff8
push 0xf
push dword [ebx + 0x44]
call sub.KERNEL32.dll_SetThreadPriority
add esp, 8
test eax, eax
jne 0x493315
add esp, 0xfffffff4
push 0x493216
call fcn.0041f898
add esp, 0x10
add esp, 0xfffffff4
push dword [ebx + 0x44]
call sub.KERNEL32.dll_ResumeThread
add esp, 0xc
test eax, eax
jne 0x49334b
add esp, 0xfffffff4
push 0x493231
call fcn.0041f898
jmp 0x493348
add esp, 0xfffffff8
push 8
push 0x401
call sub.crtdll.dll_calloc
mov dword [ebx + 0x64], eax
add esp, 0x10
mov eax, ebx
pop ebx
add esp, 0x28
ret

Function at 0x4a0fcc
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push edi
push esi
push ebx
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
cmp dword [esi + 0x414], 0
je 0x4a1027
mov eax, dword [esi + 0x418]
lea ebx, [edi + eax]
mov edx, dword [esi + 0x41c]
cmp ebx, edx
jle 0x4a1004
mov ebx, edx
sub ebx, eax
jmp 0x4a1006
mov ebx, edi
add esp, 0xfffffffc
push ebx
add eax, dword [esi + 0x414]
push eax
push ecx
call sub.crtdll.dll_memmove
add dword [esi + 0x418], ebx
add esp, 0x10
test ebx, ebx
sete al
jmp 0x4a103a
push dword [esi]
push edi
push 1
push ecx
call sub.crtdll.dll_fread
add esp, 0x10
test eax, eax
sete al
and eax, 0xff
add dword [esi + 0x408], edi
xor edx, edx
test eax, eax
je 0x4a1053
test edi, edi
setne al
movzx edx, al
mov eax, edx
pop ebx
pop esi
pop edi
add esp, 0x10
ret
Function at 0x4c9c78
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
add esp, 0xfffffff8
push 0xffffffffffffffff
push dword [esi + 0x30]
call sub.KERNEL32.dll_WaitForSingleObject
add esp, 8
cmp eax, 0xffffffff
jne 0x4c9ca6
add esp, 0xfffffff4
push 0x4c9c47
call fcn.0041f898
add esp, 0x10
mov eax, dword [esi + 0x50]
dec eax
mov dword [esi + 0x50], eax
mov ebx, dword [esi + 0x50]
add esp, 0xfffffff4
push dword [esi + 0x30]
call sub.KERNEL32.dll_ReleaseMutex
add esp, 0xc
test eax, eax
jne 0x4c9cd2
add esp, 0xfffffff4
push 0x4c9c5d
call fcn.0041f898
add esp, 0x10
test ebx, ebx
jg 0x4c9d6b
add esp, 0xfffffff4
push dword [esi + 0x30]
call sub.KERNEL32.dll_CloseHandle
push dword [esi + 0x3c]
call sub.KERNEL32.dll_CloseHandle
push dword [esi + 0x48]
call sub.KERNEL32.dll_CloseHandle
push dword [esi + 0x40]
call sub.KERNEL32.dll_CloseHandle
push dword [esi + 0x4c]
call sub.KERNEL32.dll_CloseHandle
jmp 0x4c9d56
mov ebx, dword [esi + 0x34]
mov eax, dword [ebx]
mov dword [esi + 0x34], eax
mov word [esp + 0x1c], 1
movzx eax, word [esp + 0x1c]
mov dword [esp + 0x1c], eax
add esp, 0xfffffff4
push 4
lea eax, [esp + 0x2c]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebx + 0x14]
call sub.WSOCK32.DLL_setsockopt
push dword [ebx + 0x14]
call sub.WSOCK32.DLL_closesocket
mov dword [ebx + 0x14], 0
push ebx
call sub.KERNEL32.dll_GlobalHandle
push eax
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
cmp dword [esi + 0x34], 0
jne 0x4c9d07
add esp, 0xfffffff4
push esi
call sub.crtdll.dll_free
add esp, 0x10
pop ebx
pop esi
add esp, 0x24
ret

Function at 0x4c9d74
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x24
push esi
push ebx
mov esi, dword [esp + 0x30]
add esp, 0xfffffffc
push 0
push 0
push dword [esi + 4]
call sub.WSOCK32.DLL_accept
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
jne 0x4c9da4
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [esi + 0x10], eax
jmp 0x4c9e15
mov word [esp + 0x1c], 1
movzx eax, word [esp + 0x1c]
mov dword [esp + 0x1c], eax
add esp, 0xfffffff4
push 4
lea eax, [esp + 0x2c]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [esi + 4]
call sub.WSOCK32.DLL_setsockopt
add esp, 0xfffffff8
push 0x4ebed8
push 0x8004667e
push ebx
call sub.WSOCK32.DLL_ioctlsocket
add esp, 0xfffffff8
push dword [esi + 4]
call sub.WSOCK32.DLL_closesocket
mov dword [esi + 4], 0
add esp, 0xfffffff8
push 0x4ebedc
push 0x8004667e
push ebx
call sub.WSOCK32.DLL_ioctlsocket
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0x10002
add esp, 0x24
mov eax, 1
pop ebx
pop esi
add esp, 0x24
ret
Function at 0x4d77f4
Capabilities:
Create thread

Disassembly:
sub esp, 0x50
push edi
push esi
push ebx
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x18], 0
cmp dword [0x4ec4d0], 0
je 0x4d77dc
call fcn.004d9f28
cmp dword [0x4ec4cc], 0
jne 0x4d7835
add esp, 0xfffffff4
push 0x4ec4cc
push 0x41a990
push 1
push 0
push 0x41a940
call sub.OLE32.dll_CoCreateInstance
mov ebx, eax
add esp, 0xc
test ebx, ebx
jl 0x4d782e
add esp, 0xfffffff8
mov eax, dword [0x4ec4cc]
mov edx, dword [eax]
push 0
push eax
mov eax, dword [edx + 0x14]
call eax
mov ebx, eax
add esp, 8
test ebx, ebx
jge 0x4d7835
mov dword [0x4ec4cc], 0
xor eax, eax
jmp 0x4d79fd
mov dword [0x4ec4a0], 1
mov eax, dword [esp + 0x68]
mov dword [0x4ec4f0], eax
add esp, 0xfffffff8
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x4d71fc
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [0x4ec4d8], eax
add esp, 8
test eax, eax
jne 0x4d788a
add esp, 0xfffffff4
push 0x4d7794
call fcn.0041f898
call fcn.004d9f28
xor eax, eax
add esp, 0x10
jmp 0x4d79fd
add esp, 0xfffffff8
push 2
push eax
call sub.KERNEL32.dll_SetThreadPriority
add esp, 8
test eax, eax
jne 0x4d78ac
add esp, 0xfffffff4
push 0x4d735c
call fcn.0041f898
add esp, 0x10
mov dword [0x4ec4e0], 1
mov edx, 2
test edi, edi
je 0x4d78c4
mov edx, 4
mov eax, edx
shl eax, 0xa
mov dword [0x4ec4dc], eax
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x34], 0x80000000
add eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov word [0x5247b0], 1
test edi, edi
je 0x4d7904
mov word [0x5247b2], 2
jmp 0x4d790d
mov word [0x5247b2], 1
mov dword [0x5247b4], esi
imul esi, edx
mov dword [0x5247b8], esi
mov word [0x5247bc], dx
mov word [0x5247be], 0x10
mov dword [esp + 0x40], 0x5247b0
mov edx, dword [0x4ec4cc]
mov ecx, dword [edx]
push 0
push 0x4ec4d0
lea eax, [esp + 0x38]
push eax
push edx
mov eax, dword [ecx + 0xc]
call eax
mov ebx, eax
test ebx, ebx
jl 0x4d782e
add esp, 0xfffffffc
mov edx, dword [0x4ec4d0]
mov ecx, dword [edx]
lea eax, [esp + 0x1c]
push eax
push 0x41a9b0
push edx
mov eax, dword [ecx]
call eax
mov ebx, eax
add esp, 4
test ebx, ebx
jl 0x4d79cd
mov eax, dword [0x4ec4dc]
lea edx, [eax - 1]
mov dword [esp + 0x20], edx
lea eax, [eax*2 - 1]
mov dword [esp + 0x28], eax
mov eax, dword [0x4ec4d4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
add esp, 0xfffffffc
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx]
lea eax, [esp + 0x24]
push eax
push 2
push edx
mov eax, dword [ecx + 0xc]
call eax
mov ebx, eax
add esp, 0xfffffff8
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
add esp, 0xc
test ebx, ebx
jge 0x4d79d7
call fcn.004d9f28
jmp 0x4d782e
add esp, 0xfffffff8
mov eax, dword [0x4ec4d0]
mov edx, dword [eax]
push 1
push eax
mov eax, dword [edx + 0x24]
call eax
mov ebx, eax
add esp, 8
test ebx, ebx
jge 0x4d782e
call fcn.004d9f28
xor eax, eax
pop ebx
pop esi
pop edi
add esp, 0x50
ret
Function at 0x4d7ec8
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
mov dword [ebx + 0xc], 0
add esp, 0xfffffffc
push 0x20
push ebx
push dword [0x4ec4f8]
call sub.WINMM.DLL_waveInPrepareHeader
add esp, 4
test eax, eax
jne 0x4d7f14
add esp, 0xfffffffc
push 0x20
push ebx
push dword [0x4ec4f8]
call sub.WINMM.DLL_waveInAddBuffer
add esp, 4
test eax, eax
jne 0x4d7f14
mov eax, 1
jmp 0x4d7f16
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x4d9378
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0xc
add esp, 0xfffffff4
push dword [0x501080]
call fcn.004d7ec8
add esp, 0x10
test eax, eax
je 0x4d93f5
add esp, 0xfffffff4
push dword [0x501084]
call fcn.004d7ec8
add esp, 0x10
test eax, eax
je 0x4d93f5
add esp, 0xfffffff4
push dword [0x501088]
call fcn.004d7ec8
add esp, 0x10
test eax, eax
je 0x4d93f5
add esp, 0xfffffff4
push dword [0x50108c]
call fcn.004d7ec8
add esp, 0x10
test eax, eax
je 0x4d93f5
mov dword [0x4ec504], 0
add esp, 0xfffffff4
push dword [0x4ec4f8]
call sub.WINMM.DLL_waveInStart
add esp, 0xc
test eax, eax
jne 0x4d93f5
mov eax, 1
jmp 0x4d93f7
xor eax, eax
add esp, 0xc
ret
Function at 0x4dbe64
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
call fcn.004dbf84
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
je 0x4dbed0
jmp 0x4dbe8d
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4dbe8c
cmp al, 9
je 0x4dbe8c
mov al, byte [ebx]
cmp al, 0x22
jne 0x4dbeb7
lea esi, [esi]
inc ebx
mov al, byte [ebx]
cmp al, 0x22
je 0x4dbec5
test al, al
jne 0x4dbea4
jmp 0x4dbec6
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4dbec5
cmp al, 9
je 0x4dbec6
test al, al
jne 0x4dbeb4
jmp 0x4dbec6
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4dbec5
cmp al, 9
je 0x4dbec5
mov eax, 0xa
test byte [ebp - 0x24], 1
je 0x4dbedf
movzx eax, word [ebp - 0x20]
push eax
push ebx
push 0
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
push eax
call fcn.0041d2e0
mov ebx, dword [ebp - 0x68]
leave
ret
Function at 0x10044c6
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x100f05c]
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x808], edi
mov byte [ebp - 0x404], 0
je 0x100462f
cmp dword [esi + 4], 0
jne 0x1004505
xor eax, eax
inc eax
jmp 0x1004631
mov eax, dword [esi + 8]
test eax, eax
je 0x100461e
cmp byte [eax], 0
je 0x100461e
push 0x10011f0
push eax
call fcn.0100718e
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x1004559
test edi, edi
je 0x100462f
push dword [0x100f7b4]
call fcn.010073a8
push eax
push dword [0x100fa68]
push 0x1001388
push edi
call fcn.01006e1a
add esp, 0x14
jmp 0x100462f
mov edi, 0x400
jmp 0x10045b7
lea eax, [ebp - 0x804]
push eax
call fcn.01004885
cmp byte [eax], 0
je 0x10045b7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.01003ee5
cmp eax, 1
jne 0x10045b7
mov edx, dword [ebp - 0x80c]
push edx
push esi
call fcn.01004028
push dword [edx + 0x10]
push dword [edx + 0xc]
push dword [edx + 8]
push dword [edx]
push 0x1001370
push 2
call fcn.010043ba
add esp, 0x18
push ebx
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0100747a
add esp, 0xc
test eax, eax
jne 0x1004560
push ebx
call fcn.01006f5a
cmp dword [esi + 0xc], 0
pop ecx
je 0x10045eb
cmp byte [ebp - 0x404], 0
jne 0x10045f4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [ebp - 0x404], 0
je 0x1004611
lea eax, [ebp - 0x404]
push eax
push dword [esi + 8]
push 0x1001344
push dword [ebp - 0x808]
call fcn.01006e1a
add esp, 0x10
xor eax, eax
cmp byte [ebp - 0x404], al
sete al
jmp 0x1004631
test edi, edi
je 0x100462f
push 0x1001330
push edi
call fcn.01006e1a
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006af2
leave
ret 8
Function at 0x1004bd5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x100f05c]
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1a0]
push eax
mov dword [ebp - 0x1a0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1004c6d
xor eax, eax
inc eax
cmp dword [ebp - 0x190], eax
jne 0x1004d78
cmp dword [ebp - 0x19c], 4
jne 0x1004d78
cmp dword [ebp - 0x198], 0
jne 0x1004d78
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x1ac]
push eax
push 0x1001974
push 0x80000001
call esi
test eax, eax
jne 0x1004c6d
lea eax, [ebp - 0x1b0]
push eax
push 0x1001944
push 0x80000002
call esi
test eax, eax
je 0x1004c74
push dword [ebp - 0x1ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1004d78
push ebx
push edi
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x10c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x1b8]
push eax
push 0
mov esi, 0x1001938
push esi
push dword [ebp - 0x1ac]
mov dword [ebp - 0x1a4], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 8], 0
jne 0x1004ced
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x10c]
push eax
xor edi, edi
inc edi
push edi
push 0
push esi
push dword [ebp - 0x1b0]
call ebx
test eax, eax
jne 0x1004ced
mov dword [ebp - 0x1b4], edi
jmp 0x1004cf4
and dword [ebp - 0x1b4], 0
xor eax, eax
lea edi, [ebp - 0x1a8]
stosw word es:[edi], ax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1b8]
push eax
xor edi, edi
push edi
mov esi, 0x1001928
push esi
push dword [ebp - 0x1ac]
mov dword [ebp - 0x1a4], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x1004d4f
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a8]
push eax
push 1
push edi
push esi
push dword [ebp - 0x1b0]
call ebx
cmp dword [ebp - 0x1b4], edi
je 0x1004d5e
cmp eax, edi
jne 0x1004d5e
xor edi, edi
inc edi
push dword [ebp - 0x1ac]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x1b0]
call esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01006af2
leave
ret
Function at 0x1005206
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100f05c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x310], eax
je 0x10052f3
push 0x104
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1005291
cmp edi, ebx
je 0x10052f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 0x100
mov esi, eax
lea eax, [ebp - 0x208]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x208]
push eax
push esi
push 0x1001ae8
push dword [ebp + 0x14]
push edi
call fcn.01007522
add esp, 0x14
jmp 0x10052f3
lea eax, [ebp - 0x30c]
push eax
push 0x1001ad4
lea eax, [ebp - 0x108]
push 0x103
push eax
mov byte [ebp - 5], 0
call fcn.01007522
lea eax, [ebp - 0x108]
push 0x10011c4
push eax
call fcn.0100718e
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10052f7
test edi, edi
je 0x10052f3
push dword [0x100f7b4]
call fcn.010073a8
push eax
push dword [ebp - 0x310]
push 0x1001ab0
push dword [ebp + 0x14]
push edi
call fcn.01007522
add esp, 0x18
xor eax, eax
jmp 0x1005365
mov esi, dword [esi + 0x20]
jmp 0x1005339
push dword [esi + 4]
call fcn.010075cd
mov eax, dword [esi + 0x10]
test eax, eax
pop ecx
pop ecx
je 0x1005329
cmp byte [eax], 0
je 0x1005329
push ebx
push 0x1001aac
call fcn.010075cd
push ebx
push dword [esi + 0x10]
call fcn.010075cd
add esp, 0x10
push ebx
push 0x1001198
call fcn.010075cd
mov esi, dword [esi + 0x14]
pop ecx
pop ecx
test esi, esi
push ebx
jne 0x10052fc
call fcn.01006f5a
mov edx, dword [ebp - 0x310]
test edx, edx
pop ecx
je 0x1005362
lea eax, [ebp - 0x108]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1005358
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006af2
leave
ret 0x10