joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ca50
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x1000ca7d
xor ecx, ecx
jmp 0x1000ca89
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x1000cb3d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x1000cab0
mov dword [esp + 0xc], esi
jmp 0x1000cb10
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x1000cb09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000cafc
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x1000cb10
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000cb10
push 0x10054190
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000cb10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x1000cb33
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x1000caa2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x1000cb51
mov ecx, dword [ebx]
add ecx, 8
call fcn.1000cc90
test eax, eax
je 0x1000cb51
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x1000cb60
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x1001bfdb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100571b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.1000e5e0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x1000cbf8
push 0x10054f88
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.1000e0ab
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x1000d1af
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100571b0]
jne 0x1000d1b9
repz ret
jmp fcn.1000f51d
Function at 0x1001864d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000f7ca
and dword [ebp - 4], 0
cmp dword [0x10059280], 0
mov ebx, eax
jne 0x100186fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100187af
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100187af
push eax
call fcn.1000f758
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10059280], eax
call esi
push eax
call fcn.1000f758
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10059284], eax
call esi
push eax
call fcn.1000f758
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10059288], eax
call esi
push eax
call fcn.1000f758
pop ecx
mov dword [0x10059290], eax
test eax, eax
je 0x100186fe
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000f758
pop ecx
mov dword [0x1005928c], eax
mov eax, dword [0x1005928c]
cmp eax, ebx
je 0x10018756
cmp dword [0x10059290], ebx
je 0x10018756
push eax
call fcn.1000f7d3
push dword [0x10059290]
mov esi, eax
call fcn.1000f7d3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10018756
test edi, edi
je 0x10018756
call esi
test eax, eax
je 0x1001874d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001874d
test byte [ebp - 0xc], 1
jne 0x10018756
or dword [ebp + 0x10], 0x200000
jmp 0x1001878f
mov eax, dword [0x10059284]
cmp eax, ebx
je 0x1001878f
push eax
call fcn.1000f7d3
pop ecx
test eax, eax
je 0x1001878f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001878f
mov eax, dword [0x10059288]
cmp eax, ebx
je 0x1001878f
push eax
call fcn.1000f7d3
pop ecx
test eax, eax
je 0x1001878f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10059280]
call fcn.1000f7d3
pop ecx
test eax, eax
je 0x100187af
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100187b1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
mov ebx, 0x40915c
nop
mov ecx, 0x2b097fd9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2a4b0d22
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x404292
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404de1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x408460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
mov cl, byte [ebp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], edi
test cl, cl
jne 0x404365
mov dword [ebp + 0x28], edi
test eax, eax
je 0x404332
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x40431c
mov edi, eax
add ecx, 0x10
dec edx
jne 0x404314
mov dword [ebp + 0x28], edi
mov eax, 0x406784
cmp edi, 0x100000
ja 0x404335
lea eax, [ebp + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00404a32
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x40435b
push eax
call fcn.00404ac8
add esp, 4
mov dword [esi + 0x24], edi
push 0
call fcn.00404ac8
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00404a32
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4043b1
push 0x402640
push 0x402600
push ebx
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebx
call fcn.00404b8f
jmp 0x4043b3
xor edi, edi
mov eax, dword [esi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x4043e2
test eax, eax
je 0x4043df
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402640
push ecx
push 0x44
push eax
call fcn.00404b2c
push ebx
call fcn.00404ac8
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.00403ed2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x10001a20
Capabilities:
Find taskbar

Disassembly:
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x10001a32
ret
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
ret

Function at 0x10001a50
Capabilities:
Shutdown system

Disassembly:
jmp 0x10005650
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x128], eax
push 0x114
lea eax, [esp + 0x18]
push 0
push eax
call fcn.1000a0a0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x24], 2
jne 0x100056fd
lea edx, [esp]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100056c0
xor eax, eax
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1000669a
add esp, 0x12c
ret
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [esp]
push 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push edx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100056a9
xor eax, eax
cmp dword [esp + 0x130], eax
setne al
inc eax
cmp dword [esp + 0x134], 0
je 0x10005717
or eax, 4
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1000669a
add esp, 0x12c
ret

Function at 0x10001c90
Capabilities:
Check os version

Disassembly:
mov ecx, dword [esp + 4]
jmp fcn.10003dd0
Function at 0x100026a0
Capabilities:
Log keystrokes

Disassembly:
jmp 0x100062e0
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebx
call fcn.10006160
add esp, 4
test eax, eax
jne 0x100062f6
pop ebx
pop ecx
ret
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, ebx
test ebx, ebx
je 0x1000633b
mov ebp, dword [sym.imp.USER32.dll_GetParent]
jmp 0x10006310
push 0xfffffffffffffff0
push esi
call edi
mov ecx, eax
and ecx, 0xc00000
cmp ecx, 0xc00000
je 0x10006337
test eax, 0x40000000
je 0x10006337
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x10006310
jmp 0x1000633b
test esi, esi
jne 0x1000633d
mov esi, ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, eax
je 0x100063ce
push 0xffffffffffffffec
push esi
call edi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
test edi, edi
je 0x100063d9
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test ebx, ebx
je 0x100063d9
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp ebx, edi
je 0x10006383
push 1
push edi
push ebx
call ebp
test eax, eax
je 0x100063d9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, eax
je 0x100063af
mov edx, dword [esp + 0x10]
push 3
and dl, 8
xor eax, eax
cmp dl, 8
push 0
setne al
push 0
push 0
push 0
dec eax
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
je 0x100063c4
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp ebx, edi
je 0x100063ce
push 0
push edi
push ebx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10003290
Capabilities:
Get file version info

Disassembly:
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
mov ebp, dword [esp + 0x224]
push esi
push edi
push 0x206
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x22]
xor eax, eax
push edi
push ecx
mov word [esp + 0x28], ax
call fcn.1000a0a0
add esp, 0xc
push esi
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x10003313
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1000669a
add esp, 0x21c
ret
push esi
call fcn.100066f8
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x100032f9
push eax
push esi
push edi
lea edx, [esp + 0x28]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000336a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x1000e52c
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000336a
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov word [ebx], cx
mov dx, word [eax + 8]
mov word [ebp], dx
mov edi, 1
mov eax, dword [esp + 0x10]
push eax
call fcn.100067c2
mov ecx, dword [esp + 0x228]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1000669a
add esp, 0x21c
ret
Function at 0x100033a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x628
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push ebp
mov ebp, dword [esp + 0x634]
push esi
push edi
push 0x206
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x22]
xor eax, eax
push edi
push ecx
mov ebx, edx
mov word [esp + 0x28], ax
call fcn.1000a0a0
add esp, 0xc
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
cmp esi, edi
je 0x10003501
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10003501
cmp ebx, edi
je 0x10003501
cmp ebp, edi
je 0x10003501
push 0x1000e530
lea edx, [esp + 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
lea eax, [esp + 0x430]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x438]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003501
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.Path
push eax
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100034f0
cmp dword [esp + 0x14], eax
je 0x100034f0
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esp + eax*2 + 0x224], 0x5c
je 0x100034b7
push 0x1000e52c
lea edx, [esp + 0x228]
push edx
call edi
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea edx, [esp + 0x20]
push edx
call edi
push ebp
lea ecx, [esp + 0x20]
call fcn.10003290
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10003503
mov eax, dword [esp + 0x10]
push eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10003503
xor eax, eax
mov ecx, dword [esp + 0x634]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000669a
add esp, 0x628
ret
Function at 0x10003520
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
test eax, eax
je 0x10003594
test edi, edi
je 0x10003594
test esi, esi
je 0x10003594
lea edx, [esp]
push edx
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0xc]
push edx
push 0
push ecx
push eax
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003594
mov eax, dword [esp + 4]
sub eax, 1
je 0x100035ab
sub eax, 1
jne 0x10003594
mov eax, dword [esi]
shr eax, 1
push eax
push edi
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10003594
cmp dword [esi], eax
mov dword [esi], eax
jae 0x100035c0
xor eax, eax
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000669a
add esp, 0x110
ret
mov eax, dword [esp]
cmp dword [esi], eax
mov dword [esi], eax
jb 0x10003594
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x10c]
xor ecx, esp
mov eax, 1
call fcn.1000669a
add esp, 0x110
ret

Function at 0x10003830
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
push esi
lea eax, [esp + 0xc]
push eax
push ecx
push 0x100126c0
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.ComFnutl.dll:
call esi
push 0x100126c0
call esi
push 0x1000e5d8
call esi
pop esi
ret

Function at 0x10003870
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov dword [esp + 0x14], 0
mov word [esp + 0x1c], ax
call fcn.1000a0a0
add esp, 0xc
test esi, esi
je 0x100038bf
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call ebp
test eax, eax
je 0x100038bf
test edi, edi
jne 0x100038d8
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000669a
add esp, 0x214
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1000e430
push edi
call ebx
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000391d
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000669a
add esp, 0x214
ret
mov edx, dword [esp + 0x224]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
push edx
push eax
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10003960
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
je 0x10003960
mov esi, 1
jmp 0x10003962
xor esi, esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10003979
lea eax, [esp + 0x14]
push eax
push edi
call ebx
mov ecx, dword [esp + 0x21c]
pop ebx
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.1000669a
add esp, 0x214
ret
Function at 0x10003dd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x320
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x31c], eax
push ebx
mov ebx, ecx
mov ecx, str.SoftwareClientsMail
call fcn.100039a0
test eax, eax
je 0x10003e10
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x31c]
xor ecx, esp
call fcn.1000669a
add esp, 0x320
ret
push 0x114
lea eax, [esp + 8]
push 0
push eax
call fcn.1000a0a0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10003e51
pop ebx
mov ecx, dword [esp + 0x31c]
xor ecx, esp
call fcn.1000669a
add esp, 0x320
ret
mov eax, dword [esp + 8]
push ebp
push esi
push edi
cmp eax, 6
jne 0x10003e7f
cmp dword [esp + 0x18], 1
jae 0x10003e81
xor eax, eax
mov ecx, dword [esp + 0x32c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000669a
add esp, 0x320
ret
jbe 0x10003e64
push 0x1e4
lea edx, [esp + 0x14c]
push 0
mov ecx, 9
mov esi, str.Windows_Live_Mail
lea edi, [esp + 0x12c]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.1000a0a0
add esp, 0xc
xor ebp, ebp
lea ecx, [ecx]
push ebp
mov edi, ebx
mov ecx, str.SoftwareClientsMail
call fcn.10003870
add esp, 4
mov esi, eax
lea eax, [esp + 0x124]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10003edc
inc ebp
test esi, esi
jne 0x10003eb0
jmp 0x10003e64
test esi, esi
je 0x10003e64
mov eax, 1
jmp 0x10003e66
Function at 0x10004b80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x424
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x420], eax
push ebp
push esi
push edi
xor ebp, ebp
push 0x206
mov edi, ecx
lea ecx, [esp + 0x22a]
xor eax, eax
push ebp
push ecx
mov esi, edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], ebp
mov word [esp + 0x230], ax
call fcn.1000a0a0
add esp, 0xc
test ebx, ebx
je 0x10004d6a
cmp dword [esp + 0x434], ebp
je 0x10004d6a
lea edx, [esp + 0xc]
push edx
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x10004c91
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x224]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10004c91
cmp dword [esp + 0xc], ebp
je 0x10004c3c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x10004c3c
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x224]
push eax
call esi
cmp eax, dword [esp + 0x434]
jge 0x10004c91
lea ecx, [esp + 0x224]
push ecx
mov ebp, 1
call esi
test eax, eax
je 0x10004c91
lea edx, [esp + 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.1000669a
add esp, 0x424
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.1000a0a0
mov eax, edi
add esp, 0xc
sub eax, 0x24
je 0x10004d20
sub eax, 1
je 0x10004d0e
sub eax, 1
jne 0x10004d30
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004d30
mov eax, dword [esp + 0x10]
push eax
lea esi, [esp + 0x1c]
lea edi, [esp + 0x20]
mov ecx, str.ProgramFilesDir
call fcn.10003520
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004d30
push 0x104
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10004d30
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10004d50
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, 1
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.1000669a
add esp, 0x424
ret
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1000669a
add esp, 0x424
ret