joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7294bb70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x7294bce6
cmp byte [eax], 0
je 0x7294bce6
mov ebx, dword [ebp + 8]
push eax
mov ecx, ebx
call fcn.7294432d
test eax, eax
je 0x7295c0cb
mov ecx, ebx
call fcn.7294bced
test eax, eax
je 0x7294bbbe
mov ecx, ebx
call fcn.7294bd37
cmp byte [eax], 0
jne 0x7295c0c4
push 1
xor edi, edi
pop esi
push esi
push ebx
call fcn.7294bdb3
test eax, eax
je 0x7295c0c4
xor eax, eax
test esi, esi
sete al
inc edi
mov esi, eax
cmp edi, 2
jl 0x7294bbc3
push 0x72a4e450
mov ecx, ebx
call fcn.7294bf35
test eax, eax
je 0x7295c0cb
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.7294c007
test eax, eax
je 0x7295c0cb
mov ecx, ebx
call fcn.7294beaf
push eax
call fcn.7294c109
test eax, eax
jne 0x7295c0c4
mov al, byte [0x729599f1]
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x104
lea eax, [ebp - 0x104]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x104]
push eax
call esi
cmp byte [ebp + eax - 0x105], 0x5c
je 0x7294bc85
lea eax, [ebp - 0x104]
push eax
call esi
mov ecx, edi
sub ecx, eax
lea eax, [ebp - 0x104]
push ecx
push 0x7295b236
push eax
call fcn.7294c202
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call esi
sub edi, eax
lea eax, [ebp - 0x104]
push edi
push 0x7295b230
push eax
call fcn.7294c202
add esp, 0xc
lea eax, [ebp - 0x104]
mov ecx, ebx
push eax
call fcn.7294bf63
test eax, eax
je 0x7295c0cb
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.7294c007
test eax, eax
je 0x7295c0cb
mov ecx, ebx
call fcn.7294beaf
push eax
call fcn.7294c109
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80004005
jmp 0x7294bcdf
xor eax, eax
jmp 0x7294bcdf
mov eax, 0x8007000e
jmp 0x7294bcdf
Function at 0x7294bdb3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push 0x105
push esi
push dword [0x72a4e7cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.7294beaf
push eax
call fcn.7294bee0
cmp dword [ebp - 4], esi
mov dword [ebp - 8], eax
je 0x7295c098
cmp eax, esi
je 0x7295c098
lea eax, [ebp - 0x10]
mov edi, 0x20019
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x7295b244
push 0x80000002
call esi
mov ebx, eax
test ebx, ebx
jne 0x7294be51
cmp dword [ebp + 0xc], eax
mov eax, 0x7295b238
jne 0x7294be27
mov eax, 0x7295b230
lea ecx, [ebp - 0xc]
push ecx
push edi
push 0
push eax
push dword [ebp - 0x10]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
je 0x7295c05f
push dword [ebp - 0x10]
call esi
test ebx, ebx
je 0x7295c089
push 0x7295b268
push 0x104
push dword [ebp - 4]
push 0x72950aa0
push dword [ebp - 8]
push 0x7295b260
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x7295c089
push 1
pop esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x7294be95
push dword [ebp - 4]
push ebx
push dword [0x72a4e7cc]
call edi
cmp dword [ebp - 8], ebx
je 0x7294bea6
push dword [ebp - 8]
push ebx
push dword [0x72a4e7cc]
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
push dword [ebp - 4]
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov ebx, eax
call esi
jmp 0x7294be44
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.7294bf63
test eax, eax
jne 0x7295c0a2
mov esi, 0x8007000e
jmp 0x7294be7c
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
call fcn.7294c007
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
jmp 0x7294be7c

Function at 0x7294c166
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x72961fae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.7294c18d
add esp, 4
or eax, 0xffffffff
ret
test al, 1
je 0x72961fd3
test byte [esp + 8], 2
je 0x72961fd3
call fcn.7294c1f9
mov dword [eax], 0xd
call fcn.7294c1c4
mov dword [eax], 5
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x7294c1cd
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x72a4c050]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x72962743
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x74
push 1
call fcn.72941e81
mov esi, eax
add esp, 8
test esi, esi
je 0x7296278b
mov ecx, dword [0x72a4c050]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x7296278b
push esi
call fcn.7294207b
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.72a2c5b9
add esp, 4
jmp 0x7294c1ed

Function at 0x7294d00b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
lea eax, [ebp - 0x268]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
push 0x20
call fcn.72949133
xor esi, esi
push esi
push eax
call fcn.729491a9
pop ecx
cmp eax, esi
pop ecx
jne 0x729610cb
push edi
mov edi, dword [ebp + 8]
push ebx
push 1
push edi
call fcn.7294af72
push esi
push edi
call fcn.7294af72
mov eax, dword [edi + 4]
push dword [0x72a4ef9c]
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x7294d0ae
mov eax, dword [ebp - 8]
cmp dword [esi + 0x14], eax
jne 0x729610e0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x729610d5
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call fcn.7294d14e
mov esi, dword [ebp - 4]
test esi, esi
jne 0x729610e0
mov esi, dword [ebx + 0x48]
test esi, esi
jne 0x729610e0
cmp dword [0x72a4efa0], 0
jne 0x729610eb
mov eax, dword [edi + 0x14]
cmp dword [eax + 0xc], 0
je 0x7294d0e0
push 0
push edi
call fcn.7294d167
cmp dword [0x72a4efa0], 0
jne 0x729610f7
mov eax, dword [edi + 0x14]
and dword [eax + 0xc], 0
xor esi, esi
cmp word [edi + 0x2a], si
jbe 0x7294d104
push esi
mov ecx, edi
call fcn.7294d1be
test eax, eax
je 0x7294d0fb
push esi
push edi
call fcn.7294d1e8
movzx eax, word [edi + 0x2a]
inc esi
cmp esi, eax
jb 0x7294d0e8
call fcn.72949665
pop ebx
pop edi
pop esi
leave
ret 4
call fcn.72949665
jmp 0x7294d10b
mov ecx, dword [esi + 0x18]
mov dword [eax + 0x18], ecx
jmp 0x7294d089
mov dword [ebp - 4], esi
mov esi, dword [esi + 0x18]
jmp 0x7294d068
mov ecx, edi
call fcn.72a168b9
jmp 0x7294d0be
mov ecx, edi
call fcn.72a168b9
jmp 0x7294d0dc
Function at 0x7294d249
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x72960cfa
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x72960cfa
mov eax, dword [ecx + 0x10]
xor edx, edx
test eax, eax
je 0x72960cfa
mov esi, dword [eax + 0xc]
mov edi, dword [esp + 0xc]
cmp edi, dword [esi + 8]
jne 0x72960cf1
test eax, eax
je 0x72960cfa
test edx, edx
jne 0x72960d01
mov edx, dword [eax]
mov dword [ecx + 0x10], edx
push eax
call fcn.7294d2aa
push 1
pop eax
pop edi
pop esi
ret 4
mov edx, eax
mov eax, dword [eax]
jmp 0x7294d26f
xor eax, eax
jmp 0x7294d2a5
mov ecx, dword [eax]
mov dword [edx], ecx
jmp 0x7294d29c

Function at 0x7294d2aa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x7294d2eb
test byte [esi + 0x14], 1
push edi
push ebx
je 0x72960c3a
mov eax, dword [esi + 8]
test eax, eax
je 0x7294d2e3
add eax, 0x248
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esi + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call fcn.7294d14e
pop ebx
pop edi
pop esi
leave
ret 4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x72960c54
mov eax, dword [eax + 0xc]
test eax, eax
je 0x72960c54
push eax
mov eax, dword [esi + 8]
push dword [eax + 0xc]
call fcn.7294d167
mov eax, dword [esi + 8]
mov eax, dword [eax + 0xc]
mov ax, word [eax + 0x2a]
test ax, ax
jbe 0x72960c7b
lea edi, [esi + 0x20]
movzx ebx, ax
mov eax, dword [edi]
test eax, eax
je 0x72960c75
push eax
call fcn.7294d14e
add edi, 0x14
dec ebx
jne 0x72960c69
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x72960cdb
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x20
call fcn.72949133
push 0
push eax
call fcn.729491a9
mov esi, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
jne 0x72960cd1
mov eax, dword [esi + 0x10]
test eax, eax
je 0x72960cd1
push eax
mov eax, dword [esi + 8]
push 0x72a1676b
mov ecx, dword [eax + 0x24c]
call fcn.72949622
push dword [esi + 0x10]
call fcn.7294d14e
call fcn.72949665
jmp 0x7294d2c7
mov eax, dword [esi + 0x10]
test eax, eax
je 0x7294d2c7
push eax
call fcn.7294d14e
jmp 0x7294d2c7
Function at 0x7294e2c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [0x72a4ee48], 1
mov esi, eax
mov ebx, 0x72a4edd0
jne 0x7294e2e6
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp esi, edi
je 0x7294e361
mov eax, dword [esp + 0x10]
not eax
and word [esi + 0x30], ax
cmp word [esi + 0x30], di
jne 0x7294e361
push esi
call fcn.7294e377
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x7294e312
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x20], edi
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x7294e322
push eax
call fcn.7294e413
mov dword [esi + 0x1c], edi
mov eax, dword [0x72a4ef98]
mov ecx, dword [0x72a4f40c]
add ecx, eax
test ecx, ecx
jne 0x7294e338
call fcn.7294e41f
mov ecx, esi
call fcn.7294e4b0
cmp dword [0x72a4efa0], edi
jne 0x7294e34d
mov dword [0x72a4efa4], edi
push esi
call fcn.7294d14e
mov eax, dword [0x72a4ef9c]
cmp eax, 0xffffffff
jne 0x729603af
cmp dword [0x72a4ee48], 1
jne 0x7294e371
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x7294e361

Function at 0x7294f123
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 4]
lea eax, [esi + 0x68]
push eax
call fcn.72943554
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x7294f164
cmp dword [esi + 0x20], edi
je 0x7295ed5a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
dec dword [esi + 8]
mov eax, dword [esi + 8]
dec dword [esi + 0x10]
cmp eax, 1
je 0x7295ed62
cmp byte [ebp + 0xc], bl
je 0x7294f1a5
xor eax, eax
cmp dword [edi + 0x30], 2
sete al
test al, al
jne 0x7295eda3
mov ecx, edi
call fcn.7294f1b6
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
jne 0x7294f198
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp edi, ebx
je 0x7294f1a5
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x20]
lea ecx, [ebp - 4]
call fcn.72943587
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
mov dword [esi + 0x20], ebx
jmp 0x7294f14b
cmp byte [esi], bl
jne 0x7294f164
cmp dword [esi + 0xc], 0xffffffff
jne 0x7294f164
xor eax, eax
cmp dword [edi + 0x30], 1
sete al
test al, al
jne 0x7294f164
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x14]
call dword [eax + 0x10]
push ebx
push ebx
push 0x1069
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
jmp 0x7294f164
cmp dword [edi + 0x34], 4
jne 0x7294f17a
mov ecx, dword [edi + 0xfc]
cmp ecx, ebx
je 0x7295edc7
mov edx, dword [edi + 0xf8]
lea eax, [edi + 0xf8]
mov dword [ecx], edx
mov dword [eax], ebx
push dword [edi + 0xf8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x7294f17a
Function at 0x7294f2fe
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.72942dcd
mov eax, dword [0x72a4f6f0]
mov ebp, dword [esp + 0x10]
cmp eax, 1
je 0x7296233b
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x72a4a020], 1
mov byte [0x72a4f6ec], bl
jne 0x7294f372
mov ecx, dword [0x72a4c7dc]
test ecx, ecx
je 0x7294f360
mov esi, dword [0x72a4c7d8]
sub esi, 4
cmp esi, ecx
jb 0x7294f360
mov eax, dword [esi]
test eax, eax
je 0x7294f359
call eax
mov ecx, dword [0x72a4c7dc]
sub esi, 4
cmp esi, ecx
jae 0x7294f34b
push 0x72a4f6e0
push 0x72a4f6d8
call fcn.729429a4
add esp, 8
push 0x72a4f6e8
push 0x72a4f6e4
call fcn.729429a4
add esp, 8
test ebx, ebx
je 0x7296234e
call fcn.72942e1f
pop esi
pop ebp
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x7294f318
push ebp
mov dword [0x72a4f6f0], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x72985ae9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
or byte [esi + 0x166], 4
call fcn.72984700
xor ebx, ebx
cmp eax, 1
jle 0x72985b11
push ebx
push 1
mov ecx, esi
call fcn.729864d1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
mov ecx, esi
call fcn.72984ff5
push ebx
mov ecx, esi
call fcn.72986025
cmp dword [esi + 0x144], ebx
je 0x72985bc6
mov eax, dword [esi + 0x12c]
lea edx, [ebp - 4]
push edx
push 0x72970520
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x72985b5d
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0x144]
lea edx, [ebp - 0x4c]
push ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [esi + 0x144]
cmp eax, ebx
je 0x72985b84
mov ecx, dword [eax]
push eax
mov dword [esi + 0x144], ebx
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov ecx, eax
shr ecx, 0x10
test cx, cx
je 0x72985bb1
push eax
call fcn.72a2b57a
lea eax, [eax + eax + 1]
pop ecx
add eax, 3
and al, 0xfc
call fcn.7295b2e8
mov eax, esp
push dword [ebp - 0x4c]
push eax
call fcn.729b122f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x72a4e7d0]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [esi + 0x14c]
cmp ecx, ebx
je 0x72985be5
mov eax, dword [ecx]
cmp ecx, ebx
mov dword [esi + 0x14c], eax
je 0x72985bc6
push 1
call fcn.72985c9f
jmp 0x72985bc6
xor edi, edi
push edi
mov ecx, esi
call fcn.72985efe
inc edi
cmp edi, 5
jl 0x72985be7
mov ecx, esi
call fcn.7298469d
mov eax, dword [esi + 0x12c]
cmp eax, ebx
je 0x72985c2a
push eax
call fcn.729a10ff
test eax, eax
je 0x72985c97
mov eax, dword [esi + 0x12c]
cmp eax, ebx
je 0x72985c2a
mov ecx, dword [eax]
push eax
mov dword [esi + 0x12c], ebx
call dword [ecx + 8]
push ebx
mov ecx, esi
call fcn.729846e4
cmp dword [esi + 0x118], ebx
je 0x72985c55
mov al, byte [esi + 0x167]
lea ecx, [esi + 0x167]
test al, 1
jne 0x72985c55
or al, 1
mov byte [ecx], al
mov ecx, esi
call fcn.729a5485
cmp dword [esi + 0x124], ebx
je 0x72985c6b
or byte [esi + 0x167], 2
mov ecx, esi
call fcn.729a5485
mov eax, dword [esi + 0x128]
lea edi, [esi + 0x128]
cmp eax, ebx
je 0x72985c86
mov ecx, dword [eax]
push eax
mov dword [eax + 4], ebx
call dword [ecx + 8]
mov dword [edi], ebx
and byte [esi + 0x166], 0xfb
lea esp, [ebp - 0x58]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov dword [esi + 0x12c], ebx
jmp 0x72985c2a

Function at 0x7298f387
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x7298f3a5
push edi
call fcn.729f2975
pop edi
ret 4
push esi
mov esi, dword [edi + 0x3c]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x7298f3c1
push esi
call fcn.7298f5a1
push eax
push edi
call fcn.7298f557
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
jmp 0x7298f3a1
Function at 0x72990ad7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov ebx, dword [ebp + 0xc]
push edi
push esi
and byte [ebp + 0xf], 0
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebx], 2
mov byte [ebp + 0xc], 0x3f
mov byte [ebp + 0xd], 0x5f
mov byte [ebp + 0xe], 3
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x72990b37
lea ecx, [ebp - 8]
push esi
push ecx
lea ecx, [ebp - 0xc]
push 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x72990b37
cmp dword [ebp - 8], 4
je 0x72990b5d
call fcn.72991cfa
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xffffffff
je 0x72990b53
cmp dword [ebp + 8], esi
je 0x72990b53
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
push 4
lea edi, [ebp + 0xc]
pop ecx
lea esi, [ebp - 0xc]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x72990b71
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebx], ecx
xor esi, esi
jmp 0x72990b3f

Function at 0x72991675
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x72a4e474]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp ecx, 0xffffffff
jne 0x729916a7
xor eax, eax
test al, al
je 0x729916bc
cmp ecx, 0xffffffff
je 0x729916b8
push ecx
call esi
xor ecx, ecx
cmp dword [eax + 0x3c], 2
setge cl
test cl, cl
je 0x729916bc
push 1
pop eax
pop esi
ret
push ecx
call esi
mov ecx, dword [0x72a4e474]
neg eax
sbb eax, eax
neg eax
jmp 0x72991689
xor eax, eax
jmp 0x72991695
xor eax, eax
pop esi
ret

Function at 0x729935d3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x72a4e88c]
push ebx
push esi
mov ecx, eax
mov esi, 0x3ff
push edi
and ecx, esi
xor edi, edi
cmp cx, di
mov bl, 1
je 0x729935f9
cmp cx, 9
jne 0x729935ff
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp dword [0x72a4e80c], 0x400
jb 0x7299363e
lea ecx, [ebp - 0x20]
push 0x20
movzx eax, ax
push ecx
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x40]
push 3
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x72993637
mov bl, byte [ebp - 0x40]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
mov edx, eax
mov ecx, 0x729689a4
and edx, esi
cmp word [ecx - 4], dx
jne 0x72993661
cmp bl, 1
jne 0x72993654
mov bl, byte [ecx]
mov si, ax
shr si, 0xa
cmp word [ecx - 2], si
je 0x7299366f
add ecx, 6
inc edi
cmp ecx, 0x72968a9a
jae 0x72993637
jmp 0x72993647
lea eax, [edi + edi*2]
mov bl, byte [eax*2 + 0x729689a4]
jmp 0x72993637
Function at 0x72994130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x8000
test dword [ebp + 0xc], edi
mov dword [ebp - 4], 1
je 0x72994150
and byte [ebp + 0xd], 0x7f
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
push esi
call fcn.729941fc
mov ax, word [esi + 0x10]
and ax, 0xff00
cmp ax, 0x600
jne 0x72994191
mov eax, dword [esi + 0x24]
shl eax, 0x1f
sar eax, 0x1f
test al, al
je 0x72994180
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 4], eax
and dword [esi + 0x24], 0xfffffffb
and dword [esi + 0x14], 0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
cmp ax, 0x800
jne 0x729941a2
push dword [ebp + 0xc]
push esi
call fcn.72993ffe
jmp 0x7299418a
cmp ax, 0x200
jne 0x729941b0
push dword [esi + 0xc]
call fcn.72995081
mov eax, dword [ebp + 0xc]
lea ebx, [esi + 0x28]
or eax, edi
xor edi, edi
push eax
push ebx
push edi
call fcn.72945791
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x729941dc
mov ecx, dword [esi + 0xc]
call fcn.729950d4
push eax
push dword [ebx]
call fcn.7299141d
jmp 0x7299418a
cmp dword [ebp - 4], edi
je 0x72994188
cmp dword [ebp + 0xc], edi
jne 0x72994188
push esi
call fcn.72993b8e
mov ebx, eax
cmp ebx, edi
jge 0x72994188
push esi
call fcn.729941fc
mov eax, ebx
jmp 0x7299418a

Function at 0x72995042
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x7299505b
test al, 0x10
je 0x7299505b
push 1
pop eax
ret 4
xor eax, eax
jmp 0x72995058
Function at 0x729951d6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov edi, ecx
call fcn.7294bced
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x72995350
mov al, byte [eax]
cmp al, bl
je 0x72995350
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x72995350
cmp eax, 5
je 0x72995350
cmp eax, 6
je 0x72995350
cmp eax, 2
je 0x72995350
mov dword [ebp - 0x10], 0x100
call fcn.729af216
cmp eax, ebx
jne 0x72995305
xor eax, eax
cmp eax, ebx
jl 0x729952fe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0xc]
call dword [0x72a50a64]
test eax, eax
jne 0x72995350
push dword [ebp - 0x114]
mov esi, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
call esi
test eax, eax
jne 0x72995350
cmp byte [ebp - 0x114], 0x5c
jne 0x72995350
push dword [ebp - 0x113]
call esi
test eax, eax
jne 0x72995350
cmp byte [ebp - 0x113], 0x5c
jne 0x72995350
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
push dword [edi + 4]
call fcn.7294bac0
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov edx, eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x14], edx
call esi
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax + 1]
push eax
push ebx
push dword [0x72a4e7cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x72995310
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push eax
call fcn.7299146b
jmp 0x72995252
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [edi + 8], ebx
push esi
mov ecx, edi
je 0x72995349
call fcn.7294bf63
push esi
push ebx
push dword [0x72a4e7cc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x72995300
call fcn.7294432d
jmp 0x72995335
push 1
pop eax
jmp 0x72995300
Function at 0x7299f591
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov eax, dword [ebx + 0x28]
push edi
mov dword [esp + 0x10], 1
mov edi, 0x202
mov ecx, dword [eax]
test byte [ecx + 1], 1
je 0x7299f5bb
test byte [eax + 0x29], 0x80
jne 0x7299f5bb
mov ebx, dword [ebx + 0x50]
mov ebp, dword [esp + 0x1c]
xor eax, eax
cmp dword [ebx + 0x3c], ebp
mov esi, 0x80018001
sete al
mov dword [esp + 0x18], eax
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x7299f5f1
xor ecx, ecx
cmp dword [esp + 0x18], ecx
jne 0x7299f634
push esi
push ecx
push edi
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
and eax, 2
inc eax
inc eax
mov dword [esp + 0x10], eax
xor eax, eax
cmp edi, 0x202
setne al
dec eax
and al, 0xfd
add eax, 0x208
cmp dword [esp + 0x10], 4
mov edi, eax
jne 0x7299f5d0
push 0
push 0
push 0x1f
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 0xc]
cmp eax, ecx
jne 0x7299f643
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push esi
push ecx
push edi
push ebp
push eax
call dword [sym.imp.USER32.dll_CallWindowProcA]
jmp 0x7299f5f1