joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445f2f
Capabilities:
Get disk information

Disassembly:
push 8
mov eax, 0x44d917
call fcn.0042ec8d
mov esi, ecx
cmp word [esi], 0
je 0x445fcf
push 0x5c
push esi
call fcn.0042cd99
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x445fcf
mov edi, ebx
sub edi, esi
sar edi, 1
push esi
inc edi
lea esi, [ebp - 0x14]
call fcn.00403fdd
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 1
je 0x445fc7
cmp eax, 5
je 0x445fc7
add ebx, 2
push ebx
lea eax, [ebp - 0x10]
push eax
call fcn.00401015
push str._:____
push dword [ebp - 0x10]
call fcn.0042d288
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
test eax, eax
jne 0x445fa7
or esi, 0xffffffff
jmp 0x445fad
sub eax, ecx
sar eax, 1
mov esi, eax
lea eax, [ecx - 0x10]
call fcn.004015fa
lea eax, [edi - 0x10]
call fcn.004015fa
xor eax, eax
cmp esi, 0xffffffff
sete al
jmp 0x445fd1
lea eax, [edi - 0x10]
call fcn.004015fa
xor eax, eax
call fcn.0042ed65
ret
Function at 0x449911
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.0042e560
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
add esp, 0xc
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x40
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test esi, esi
je 0x44997d
test edi, edi
je 0x44997d
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
jne 0x44997d
and dword [esi], eax
mov eax, edi
pop edi
leave
ret

Function at 0x449b40
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x463060]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
push ebx
push esi
xor esi, esi
push esi
push esi
lea ebx, [ebp - 0x44]
call fcn.0044be19
test eax, eax
jne 0x449bc0
push 0x45ad70
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449bc0
push 0x38
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0042e560
mov eax, ebx
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x7c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov ecx, dword [ebp + 0x1c4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bd77
add ebp, 0x1c8
leave
ret
Function at 0x449bd9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push 2
mov edi, eax
lea edx, [eax + 2]
pop ebx
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x449bec
sub eax, edx
sar eax, 1
push esi
mov esi, eax
xor ecx, ecx
lea eax, [esi + 1]
mov edx, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042bc17
lea ecx, [esi + esi + 2]
push ecx
push 0
push eax
mov dword [ebp - 8], eax
call fcn.0042e560
movzx ecx, word [edi]
add esp, 0x10
mov eax, edi
test cx, cx
je 0x449c43
movzx ecx, cx
cmp cx, 0x20
je 0x449c43
add eax, ebx
movzx ecx, word [eax]
test cx, cx
jne 0x449c33
sub eax, edi
sar eax, 1
push eax
push edi
mov edi, dword [ebp - 8]
push edi
call fcn.0042cd4f
add esp, 0xc
push 0x10
pop esi
call fcn.004439ba
lea ecx, [ebp - 4]
push ecx
push ebx
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x449cba
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x449c7a
sub eax, edx
sar eax, 1
add eax, eax
push eax
push edi
xor ebx, ebx
inc ebx
push ebx
push 0
push 0x45acec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x449cb1
push edi
call fcn.0042cb0a
pop ecx
pop edi
mov al, bl
pop ebx
leave
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x449ca4

Function at 0x44a06e
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
push eax
push eax
push eax
push 0x44a004
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
ret
Function at 0x44bc07
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x463060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x46536c]
push esi
push edi
mov ecx, 0x46536c
call dword [eax + 0xc]
and dword [ebp - 0x230], 0
mov esi, eax
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
add esi, 0x10
call fcn.0042e560
add esp, 0xc
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x44bc75
xor edi, edi
lea eax, [esi - 0x10]
call fcn.004015fa
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0042bd77
leave
ret
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.DLL_Process32FirstW
jmp 0x44bca6
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x228]
je 0x44bcb3
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x44bc8e
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x44bc5b
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 0x218]
jmp 0x44bc5d

Function at 0x44bcc2
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x44d8e7
call fcn.0042ecf6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x240], eax
mov eax, dword [0x46536c]
mov ecx, 0x46536c
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x244], ebx
xor esi, esi
push 0x228
lea eax, [ebp - 0x238]
push esi
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x23c], esi
call fcn.0042e560
add esp, 0xc
push esi
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x44bd2f
lea eax, [ebx - 0x10]
call fcn.004015fa
mov eax, esi
call fcn.0042ed79
ret
lea eax, [ebp - 0x23c]
push eax
push edi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.DLL_Process32FirstW
jmp 0x44bd60
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x234]
je 0x44bd6d
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x44bd48
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x44bd1f
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x240]
push 0x45a3fc
call fcn.00405c83
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor esi, esi
inc esi
jmp 0x44bd1f
Function at 0x44bd92
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10
pop esi
mov edi, eax
call fcn.004439ba
xor ebx, ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x44bdc8
xor eax, eax
inc eax
jmp 0x44be14
cmp dword [edi + 0x18], 8
mov eax, dword [edi + 0x14]
jb 0x44bdd6
mov ecx, dword [edi + 4]
jmp 0x44bdd9
lea ecx, [edi + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
push ecx
push 1
push ebx
push str.path
push dword [ebp - 4]
call esi
cmp dword [edi + 0x34], 8
mov eax, dword [edi + 0x30]
jb 0x44bdfe
mov edi, dword [edi + 0x20]
jmp 0x44be01
add edi, 0x20
add eax, eax
push eax
push edi
push 1
push ebx
push 0x45a45c
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44be19
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x463060]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push esi
push edi
push 0x10
pop esi
mov dword [ebp - 0x80], eax
call fcn.004439ba
lea ecx, [ebp - 0x78]
push ecx
push 0x20019
xor esi, esi
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44beaf
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp ebx, esi
je 0x44bf0a
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push esi
push eax
call fcn.0042e560
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push esi
push 0x45a41c
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x208
call edi
test eax, eax
je 0x44becb
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop esi
call fcn.0042bd77
add ebp, 0x198
leave
ret 8
lea eax, [ebp - 0x74]
push eax
push 0x104
push ebx
call fcn.0042c2c6
add esp, 0xc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44beed
mov word [ebx], ax
jmp 0x44bea6
push 0x45a428
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44bea6
cmp dword [ebp - 0x80], esi
je 0x44bf36
mov eax, dword [ebp + 0x1a4]
cmp eax, esi
je 0x44bf36
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
push esi
push esi
push 0x45a440
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x44bf36
xor esi, esi
inc esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x44beb2
Function at 0x44c0f0
Capabilities:
Get file size
Hash data with crc32
Read file on windows

Disassembly:
push 0x40c
mov eax, 0x44d81b
call fcn.0042ec8d
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileSize]
xor edi, edi
push edi
push edi
call esi
push edi
push 0x8000000
push 3
push edi
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push edi
push eax
mov dword [ebp - 0x14], eax
call esi
mov ebx, eax
mov eax, dword [0x46536c]
mov ecx, 0x46536c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
cmp ebx, edi
mov dword [ebp - 4], edi
jle 0x44c17c
push ebx
lea esi, [ebp - 0x10]
call fcn.004015c9
cmp ebx, edi
mov edx, eax
jle 0x44c172
push 0x20
pop eax
mov edi, edx
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, ebx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor edi, edi
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.004014e0
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
lea esi, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.004015c9
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x10]
push dword [esi - 8]
push esi
call fcn.0042cd30
pop ecx
pop ecx
lea edx, [ebp - 0x10]
call fcn.004014e0
xor eax, eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x44c1d1
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x44c1d3
shr ecx, 1
dec edx
jne 0x44c1c2
mov dword [ebp + eax*4 - 0x418], ecx
inc eax
cmp eax, 0x100
jl 0x44c1bd
or dword [ebp - 0x10], 0xffffffff
mov eax, esi
jmp 0x44c20d
movzx edx, byte [eax]
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
xor ecx, edx
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ebp + ecx*4 - 0x418]
dec ebx
mov dword [ebp - 0x10], edx
inc eax
cmp ebx, edi
jne 0x44c1ed
lea eax, [esi - 0x10]
call fcn.004015fa
mov eax, dword [ebp - 0x10]
not eax
call fcn.0042ed65
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
push ebx
push esi
push edi
lea edi, [ebp - 0x3b0]
mov ecx, 0xec
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x44a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x44c011
call fcn.00401688
mov esi, esp
push 0
push 0x80000000
push 3
push 0
push 3
push 0x10000000
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.00401659
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x22c], 0
jmp 0x401079
mov eax, dword [ebp - 0x22c]
add eax, 1
mov dword [ebp - 0x22c], eax
push 0x200
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x214]
push ecx
call fcn.00403290
add esp, 0xc
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x22c]
shl eax, 9
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, esp
call fcn.00401659
mov esi, esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x200
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.00401659
test eax, eax
je 0x4010fa
mov eax, dword [ebp - 0x22c]
push eax
push str._d___Overwritting_successfull__n
call fcn.00401490
add esp, 8
jmp 0x40110e
mov eax, dword [ebp - 0x22c]
push eax
push str._d___Overwritting_failed_n
call fcn.00401490
add esp, 8
jmp 0x40106a

Function at 0x42ae9e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ac7d

Function at 0x42d034
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042c82e

Function at 0x42d03f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ca69
Function at 0x100015c5
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x40]
xor edi, edi
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
call dword [fcn.1001396c]
cmp dword [esi + 0x3c], edi
jne 0x100015f4
push 4
call dword [0x1000b3b4]
mov dword [esi + 0x3c], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp dword [esi + 0x3c], edi
je 0x10001626
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0xc], eax
add eax, 0x3c
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x1000b838
mov dword [ebp - 4], 0x8007000e
mov ecx, dword [ebp - 0xc]
mov dword [ebx], esi
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0x3c]
mov dword [ebx + 0x18], edi
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 8]
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1000b8c6
or dword [ebx + 0x24], 0x10
mov eax, dword [edi]
push edi
call dword [eax + 4]
push 0x10012f86
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push fcn.10006e74
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebx + 0x14], eax
je 0x1000b8e7
lea esi, [edi + 0x40]
push esi
call dword [fcn.1001396c]
push ebx
push 0x7fffffff
push dword [edi + 0x3c]
call dword [fcn.1000f888]
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000162d
test byte [edi + 0xe], 4
je 0x1000b86c
lea ecx, [ebp + 0x10]
call fcn.1000b08a
push 1
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea ecx, [edi + 0x78]
call fcn.1000a896
jmp 0x1000b86c
mov esi, dword [fcn.1001396c]
call esi
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push eax
call fcn.100023f2
push eax
push dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
push 0x61
push 3
push dword [ebp + 8]

Function at 0x100016f4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push 4
mov eax, 0x10012bfc
call fcn.1000f12d
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x10001746
mov dword [ebp - 0x10], edi
push edi
push edi
push dword [esi]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100066e2
push dword [esi]
mov ebx, eax
push dword [esi + 4]
call dword [fcn.10013be7]
cmp ebx, edi
mov dword [esi], eax
jge 0x100118b1
push dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
call fcn.100114cc
cmp dword [esi], edi
jne 0x10001709
mov eax, dword [ebp + 8]
mov dword [eax], edi
call fcn.10002c54
ret 4
Function at 0x100017f0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x10004524
call fcn.100110e4
sub esp, 0x830
push ebx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x83c]
push 0x400
push eax
mov esi, fcn.10001caf
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0x3ff
jne 0x10001844
push 0x80040602
lea ecx, [ebp - 0x2c]
call fcn.10007044
push 0x1000e889
lea eax, [ebp - 0x2c]
jmp 0x100018f8
lea eax, [ebp + 0x1b]
push eax
lea eax, [ebp - 0x83c]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x3e], bx
call fcn.100028d0
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.1000b05c
test eax, eax
je 0x100018de
mov esi, fcn.100089e8
push esi
lea ecx, [ebp - 0x1c]
call fcn.1000b05c
test eax, eax
je 0x100018de
push edi
mov edi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.1000a534
lea ecx, [ebp - 0x1c]
call fcn.10006fb0
mov eax, dword [ebp - 0x18]
push ebx
mov dword [ebp + 0x18], eax
push edi
lea eax, [ebp + 0x18]
push eax
call fcn.10012790
push edi
call fcn.100019b4
push esi
mov ecx, edi
call fcn.1000b05c
test eax, eax
pop edi
jne 0x100018c1
push 0x80040600
jmp 0x1000182f
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
je 0x100018d0
push 0x80040600
jmp 0x100018e8
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004d84
mov al, 1
jmp 0x1000190a
cmp byte [ebp + 0x18], bl
jne 0x100018fe
push 0x80040601
lea ecx, [ebp - 0x3c]
call fcn.10007044
push 0x1000e889
lea eax, [ebp - 0x3c]
push eax
call fcn.10001fc8
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004d84
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14

Function at 0x1000191c
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push 0x48
lea eax, [ebp - 0x48]
push 0
push eax
call sub.KERNEL32.dll_GetCommandLineA
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
add esp, 0xc
mov dword [ebp - 0x48], 0x48
call dword [eax + 0x50]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp - 0x40], 0x14
jne 0x10001960
mov dword [ebp - 0x40], 0x95
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100127a3
leave
ret 0xc
Function at 0x10001f1e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor ebx, ebx
mov byte [eax], bl
movzx eax, byte [esi]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push ebx
push 0x1000aa3f
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jle 0x10001f60
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
call fcn.10002a80
mov cl, byte [esi]
cmp eax, ebx
setne al
cmp cl, al
je 0x10001fb6
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x13]
mov byte [ebp - 0xc], cl
push eax
push dword [ebp - 0xc]
mov ecx, edi
mov byte [ebp + 0x13], bl
mov dword [ebp + 8], ebx
call fcn.1001345c
test al, al
je 0x100023c0
cmp byte [ebp + 0x13], bl
je fcn.10001459
push ebx
push ebx
push 0x46a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100026dc
Capabilities:
Accept command line arguments

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, esi
pop esi
ret

Function at 0x10002ede
Capabilities:
Access the windows event log
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [ebp - 0x24]
mov eax, ecx
lea edi, [ebp - 0x334]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
shr word [ebp - 0x24], 1
mov ecx, eax
lea eax, [ebx + 0x44]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [ebp - 0x24]
xor esi, esi
mov word [ebp + ecx*2 - 0x334], si
mov edi, dword [eax]
mov edx, dword [eax + 4]
cmp edi, 0x610050
jne 0x10002f36
cmp edx, 0x740072
jne 0x10002f36
cmp dword [ebx + 0x4c], 0x67006d
jne 0x10002f36
cmp dword [ebx + 0x50], 0x200072
je 0x100033ef
cmp edi, 0x680050
jne 0x10002f5c
cmp edx, 0x730079
jne 0x10002f5c
cmp dword [ebx + 0x4c], 0x690044
jne 0x10002f5c
cmp dword [ebx + 0x50], 0x6b0073
je 0x100033ef
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x38], 0x104
push edx
push dword [ebx + 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x334]
push dword [0x1001e7a4]
push dword [0x10032060]
push ecx
push eax
call fcn.10007f3b
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x10002fba
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je fcn.10002fcd
cmp dword [eax + 0x320], esi
jne 0x100033ef