joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41057a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x446408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408fef
and dword [ebp - 0x14], 0
cmp dword [0x44ced0], 0
mov dword [ebp - 0x18], eax
jne 0x41062d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4106d5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4106d5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44ced0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44ced4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44ced8], eax
call edi
push eax
call esi
mov dword [0x44cee0], eax
test eax, eax
je 0x41062d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44cedc], eax
mov eax, dword [0x44cedc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410686
cmp dword [0x44cee0], ecx
je 0x410686
push eax
call esi
push dword [0x44cee0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410686
test ebx, ebx
je 0x410686
call edi
test eax, eax
je 0x41067d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41067d
test byte [ebp - 8], 1
jne 0x410686
or dword [ebp + 0x10], 0x200000
jmp 0x4106b9
mov eax, dword [0x44ced4]
cmp eax, dword [ebp - 0x18]
je 0x4106b9
push eax
call esi
test eax, eax
je 0x4106b9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4106b9
mov eax, dword [0x44ced8]
cmp eax, dword [ebp - 0x18]
je 0x4106b9
push eax
call esi
test eax, eax
je 0x4106b9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44ced0]
call esi
test eax, eax
je 0x4106d5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4106d7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405420
leave
ret
Function at 0x10001110
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
call fcn.100010b0
test eax, eax
jne 0x10001126
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1000116b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1000116b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.1000cf1a
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.1000cf1a
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x100011b0
test esi, esi
je 0x100011c1
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x100011bd
push esi
call fcn.1000cf0f
add esp, 4
test ebx, ebx
jne 0x100011d0
mov edi, dword [edi]
test edi, edi
je 0x100011d0
push edi
call fcn.1000cf0f
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10002ed0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x410
push ebx
push ebp
push esi
mov esi, dword [esp + 0x420]
test esi, esi
push edi
je 0x10002fa3
mov ecx, dword [esp + 0x428]
test ecx, ecx
je 0x10002fa3
mov eax, dword [esp + 0x42c]
test eax, eax
je 0x10002fa3
mov ax, word [esi]
test ax, ax
je 0x10002fa3
cmp word [esi + 2], 0
lea ebx, [esi + 2]
je 0x10002fa3
mov dx, word [esi + 4]
lea ebp, [esi + 4]
test dx, dx
je 0x10002fa3
mov di, word [esi + 6]
test di, di
jne 0x10002f5c
mov word [ecx], ax
mov ax, word [ebx]
mov word [ecx + 2], ax
mov dx, word [ebp]
mov word [ecx + 6], di
pop edi
pop esi
pop ebp
mov word [ecx + 4], dx
mov eax, 1
pop ebx
add esp, 0x410
ret
cmp ax, 0x5c
jne 0x10003018
cmp word [ebx], ax
jne 0x10003018
cmp dx, 0x2e
jne 0x10002f7a
cmp di, ax
je 0x10002f86
cmp dx, 0x3f
jne 0x10002fb0
cmp di, 0x5c
jne 0x10002fb0
add esi, 8
cmp word [esi], 0
je 0x10002fa3
cmp word [esi + 2], 0x3a
lea ebx, [esi + 2]
jne 0x10002fa3
cmp word [esi + 4], 0x5c
lea ebp, [esi + 4]
je 0x10003018
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret
push 0x5c
push ebp
call fcn.1000dcac
add esp, 8
test eax, eax
je 0x10002fa3
push 6
push str.pipe_
push eax
call fcn.1001a395
add esp, 0xc
test eax, eax
je 0x10002fa3
mov edi, dword [esp + 0x42c]
lea eax, [edi - 1]
push eax
push esi
mov esi, dword [esp + 0x430]
push esi
call fcn.1000d4d9
push esi
mov word [esi + edi*2 - 2], 0
call fcn.1000e45f
push esi
call fcn.1000d3cc
add esp, 0x14
mov ecx, 3
cmp ecx, eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x410
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
cmp word [ebx], 0x3a
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x100030c4
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10002fa3
cmp eax, 0x104
jae 0x10002fa3
lea eax, [esp + 0x10]
push eax
call fcn.1000d3cc
mov edi, eax
mov ax, word [esi]
add esp, 4
cmp ax, 0x2e
jne 0x10003092
cmp word [ebx], 0x5c
jne 0x1000307d
mov esi, ebp
jmp 0x10003092
cmp ax, 0x2e
jne 0x10003092
cmp word [ebx], ax
jne 0x10003092
cmp word [ebp], 0x5c
jne 0x10003092
add esi, 6
push esi
call fcn.1000d3cc
lea ecx, [eax + edi + 1]
add esp, 4
cmp ecx, 0x104
jae 0x10002fa3
lea edx, [esp + 0x10]
push esi
push edx
mov word [esp + edi*2 + 0x18], 0x5c
call fcn.1000cf6d
add esp, 8
lea esi, [esp + 0x10]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
push 0x7e
push esi
stosw word es:[edi], ax
call fcn.1000dcac
add esp, 8
test eax, eax
je 0x10003128
lea eax, [esp + 0x218]
push 0x104
push eax
push esi
call fcn.10004760
add esp, 0xc
test eax, eax
jne 0x10003121
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10003128
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret
lea esi, [esp + 0x218]
mov edi, dword [esp + 0x42c]
lea ecx, [edi - 1]
push ecx
push esi
mov esi, dword [esp + 0x430]
push esi
call fcn.1000d4d9
add esp, 0xc
mov word [esi + edi*2 - 2], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x100051e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1001aab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1000bdc0
xor ebx, ebx
lea ecx, [esi + 0x50]
mov dword [esp + 0x18], ebx
call fcn.10006430
or eax, 0xffffffff
mov ecx, 8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esi], 0x1001c268
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov word [esi + 0x44], bx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x30], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10005b10
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x1002f80c]
sub esp, 0x94
test eax, eax
jne 0x10005b75
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [0x1002f80c], 1
push eax
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
pop edi
cmp eax, 2
jne 0x10005b69
cmp dword [esp + 4], 5
jb 0x10005b69
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x1002f810], ecx
jmp 0x10005b75
mov edx, dword [0x10021080]
mov dword [0x1002f810], edx
mov eax, dword [esp + 0x98]
test eax, eax
mov eax, dword [0x10021080]
jne 0x10005b8a
mov eax, dword [0x1002f810]
add esp, 0x94
ret
Function at 0x10008310
Capabilities:
Connect pipe
Create pipe

Disassembly:
sub esp, 0x11c
push ebp
push esi
mov ebp, ecx
call fcn.10008490
call fcn.100082a0
mov edx, eax
test edx, edx
je 0x10008482
push edi
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
lea esi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov edx, esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x12c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
pop edi
je 0x10008388
push 0x104
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1000e060
add esp, 0xc
mov esi, dword [esp + 0x12c]
test esi, esi
jne 0x100083b3
call fcn.10001670
push eax
push esi
push 0x8000
push 0x8000
push 1
push esi
lea ecx, [esp + 0x24]
push 0x40000003
push ecx
jmp 0x100083d6
call fcn.10001670
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 6
lea edx, [esp + 0x24]
push 0x40000003
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
mov dword [ebp + 4], eax
jne 0x100083f8
mov dword [ebp + 4], 0
pop esi
xor eax, eax
pop ebp
add esp, 0x11c
ret 8
push 0
push 0
mov dword [ebp + 0x18], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [ebp + 8], eax
call esi
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x1000847b
test eax, eax
je 0x1000847b
lea eax, [ebp + 0x1c]
xor ecx, ecx
mov edx, eax
push eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push edx
mov dword [ebp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10008464
cmp eax, 0x3e5
je 0x10008464
cmp eax, 0x217
jne 0x10008482
mov dword [ebp + 0x10], 1
pop esi
mov eax, 1
pop ebp
add esp, 0x11c
ret 8
mov ecx, ebp
call fcn.10008490
pop esi
xor eax, eax
pop ebp
add esp, 0x11c
ret 8
Function at 0x10008580
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov ebx, dword [esi + 4]
cmp ebx, ebp
je 0x100086aa
cmp dword [esi + 8], ebp
je 0x100086aa
mov eax, dword [esp + 0x38]
push eax
call fcn.100084e0
test eax, eax
je 0x100086b1
mov edx, dword [esi + 8]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
cmp edi, ebp
je 0x1000861b
cmp dword [esp + 0x10], ebp
je 0x1000861b
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebp
jne 0x10008637
cmp eax, ebp
je 0x10008637
cmp eax, 0x3e5
je 0x10008637
cmp eax, 0x217
jne 0x100086aa
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebp
je 0x1000866f
push ebx
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x100086aa
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
lea edx, [esp + 0x14]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [esi + 8]
mov edi, eax
push ecx
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x14]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x1c
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x100086c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov ebx, dword [esi + 4]
cmp ebx, ebp
je 0x100087ea
cmp dword [esi + 0xc], ebp
je 0x100087ea
mov eax, dword [esp + 0x38]
push eax
call fcn.100084e0
test eax, eax
je 0x100087f1
mov edx, dword [esi + 0xc]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebp
je 0x1000875b
cmp dword [esp + 0x10], ebp
jbe 0x1000875b
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebp
jne 0x10008777
cmp eax, ebp
je 0x10008777
cmp eax, 0x3e5
je 0x10008777
cmp eax, 0x217
jne 0x100087ea
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebp
je 0x100087af
push ebx
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x100087ea
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
lea edx, [esp + 0x14]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [esi + 0xc]
mov edi, eax
push ecx
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x14]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x1c
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x10009290
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x2001f
push esi
push ecx
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009308
mov eax, dword [esp + 4]
cmp eax, esi
je 0x10009308
cmp dword [esp + 0x20], esi
je 0x100092e1
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
inc ecx
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 1
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100092ed
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
jne 0x100092f6
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret 0x18
xor eax, eax
pop esi
pop ecx
ret 0x18
Function at 0x1000ad80
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x1000ad97
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1000adeb
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x1000adeb
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x1000adeb
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x18]
mov dword [esp + 0x18], 0
not ecx
dec ecx
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1000ae1e
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
push ecx
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
pop edi
pop esi
pop ebx
ret 4
Function at 0x10019950
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x10030c28]
test eax, eax
jne 0x10019a0e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x10030ac8
mov dword [0x10030c28], 1
mov dword [0x10030ac8], 0x94
call esi
mov edx, dword [0x10030ad8]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x100244e0], eax
je 0x10019a02
push 0x10030b60
mov dword [0x10030b60], 0x9c
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x10030c24], eax
push 0x10030c00
je 0x100199d0
call eax
jmp 0x100199d6
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x10030b64]
cmp eax, 6
jae 0x100199ee
cmp eax, 5
jne 0x10019a02
cmp dword [0x10030b68], 2
jb 0x10019a02
cmp word [0x10030c00], 9
jne 0x10019a02
mov dword [0x10030abc], 1
call fcn.10019a20
mov eax, 1
pop esi
ret
mov eax, 1
ret
Function at 0x1001a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1001b18f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1001dd90]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov edi, dword [ecx]
test eax, eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], edi
je 0x1001a147
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1001a149
mov esi, edi
test esi, esi
je 0x1001a231
mov ebx, dword [esp + 0x38]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push 0
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001a219
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x1001a18f
cmp eax, 2
je 0x1001a18f
cmp eax, 6
je 0x1001a18f
cmp eax, 7
jne 0x1001a219
mov ecx, dword [esp + 0x34]
add ecx, 2
push ecx
call fcn.1000cf1a
mov edx, dword [esp + 0x38]
mov ebp, eax
xor eax, eax
mov edi, ebp
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x1001a1ff
lea ecx, [esp + 0x14]
call fcn.10019f40
cmp esi, dword [esp + 0x14]
je 0x1001a1f4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1001a1f4
push 0
push 0
call fcn.1000d392
push ebp
call fcn.1000cf0f
add esp, 4
jmp 0x1001a243
call fcn.1000cf0f
add esp, 4
lea ecx, [esp + 0x10]
push 0x10030c38
call fcn.10019f40
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x1001a231
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1001a231
push 0
push 0
call fcn.1000d392
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1001a243
push eax
lea ecx, [esp + 0x14]
call fcn.10019f40
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.10019d10
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.10019e30
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x1001a5e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x10030db4]
test eax, eax
jne 0x1001a6ba
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x10030c50
mov dword [0x10030db4], 1
mov dword [0x10030c50], 0x94
call esi
mov edx, dword [0x10030c60]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x10024558], eax
je 0x1001a6ae
push edi
push 0x10030ce8
mov dword [0x10030ce8], 0x9c
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x10030dac], eax
call edi
mov dword [0x10030db0], eax
mov eax, dword [0x10030dac]
pop edi
test eax, eax
push 0x10030d88
je 0x1001a67c
call eax
jmp 0x1001a682
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x10030cec]
cmp eax, 6
jae 0x1001a69a
cmp eax, 5
jne 0x1001a6ae
cmp dword [0x10030cf0], 2
jb 0x1001a6ae
cmp word [0x10030d88], 9
jne 0x1001a6ae
mov dword [0x10030c44], 1
call fcn.1001a6c0
mov eax, 1
pop esi
ret
mov eax, 1
ret
Function at 0x705f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x705f2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x705f2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret