joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b1d6
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1005481c]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x10054820]
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x3c], eax
xor esi, esi
xor eax, eax
inc eax
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0x3c]
test ecx, eax
je 0x1000b27f
lea eax, [esi + 0x41]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1000b27f
inc dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000b27f
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
adc dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
adc dword [ebp - 0x24], eax
inc esi
cmp esi, 0x1a
jl 0x1000b219
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
je 0x1000b29c
cmp dword [ebp - 0x14], 0x14
ja 0x1000b29a
jb 0x1000b29c
cmp dword [ebp - 0x18], ebx
jb 0x1000b29c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10032a69
leave
ret
Function at 0x1000b2ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push edi
lea eax, [ebp - 0x7c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
push 0x80000002
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b38c
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.10035680
add esp, 0xc
xor edi, edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x1000b383
cmp eax, 0xea
je 0x1000b37d
cmp eax, esi
jne 0x1000b37d
lea eax, [ebp - 0x78]
push eax
call fcn.1003431a
lea eax, [ebp - 0x78]
mov dword [esp], str._virtual
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b3a5
lea eax, [ebp - 0x78]
push str._virtualbox
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b3a5
lea eax, [ebp - 0x78]
push str._vmware
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b3a5
inc edi
cmp edi, 0x64
jl 0x1000b307
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.10032a69
add ebp, 0x194
leave
ret
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b38e

Function at 0x1000b3b3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b489
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10035680
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000b480
cmp eax, 0xea
je 0x1000b47a
test eax, eax
jne 0x1000b47a
lea eax, [ebp - 0x7c]
push eax
call fcn.1003431a
lea eax, [ebp - 0x7c]
mov dword [esp], str.virtual
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a1
lea eax, [ebp - 0x7c]
push str.vbox
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a1
lea eax, [ebp - 0x7c]
push str.vmware
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a1
inc esi
cmp esi, 0x64
jl 0x1000b40e
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.10032a69
add ebp, 0x190
leave
ret
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b48b
Function at 0x1000b4af
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetEnumIDE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b585
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10035680
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000b57c
cmp eax, 0xea
je 0x1000b576
test eax, eax
jne 0x1000b576
lea eax, [ebp - 0x7c]
push eax
call fcn.1003431a
lea eax, [ebp - 0x7c]
mov dword [esp], str.virtual
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b59d
lea eax, [ebp - 0x7c]
push str.vbox
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b59d
lea eax, [ebp - 0x7c]
push str.vmware
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b59d
inc esi
cmp esi, 0x64
jl 0x1000b50a
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.10032a69
add ebp, 0x190
leave
ret
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b587

Function at 0x1000b5ab
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetEnumSCSI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b681
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10035680
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000b678
cmp eax, 0xea
je 0x1000b672
test eax, eax
jne 0x1000b672
lea eax, [ebp - 0x7c]
push eax
call fcn.1003431a
lea eax, [ebp - 0x7c]
mov dword [esp], str.virtual
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b699
lea eax, [ebp - 0x7c]
push str.vbox
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b699
lea eax, [ebp - 0x7c]
push str.vmware
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b699
inc esi
cmp esi, 0x64
jl 0x1000b606
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.10032a69
add ebp, 0x190
leave
ret
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b683
Function at 0x1000b6a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x7c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SYSTEMCurrentControlSet_servicesDiskEnum
push 0x80000002
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b781
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.10035680
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x100533bc
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b778
lea eax, [ebp - 0x78]
push eax
call fcn.1003431a
lea eax, [ebp - 0x78]
mov dword [esp], str.virtual
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
je 0x1000b750
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b783
lea eax, [ebp - 0x78]
push str.vbox
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b742
lea eax, [ebp - 0x78]
push str.vmware
push eax
call fcn.1003388c
pop ecx
pop ecx
test eax, eax
jne 0x1000b742
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop esi
call fcn.10032a69
add ebp, 0x194
leave
ret

Function at 0x1000ba09
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x50], ax
lea edi, [ebp - 0x4e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push 0x3a
push eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push eax
call fcn.10035680
add esp, 0xc
push 0x1000bace
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov edi, 0x104
push edi
mov esi, 0x10060270
push esi
mov dword [0x1006026c], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Minidump
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x44]
push eax
movzx eax, word [ebp - 0x46]
push eax
movzx eax, word [ebp - 0x48]
push eax
movzx eax, word [ebp - 0x4a]
push eax
movzx eax, word [ebp - 0x4e]
push eax
movzx eax, word [ebp - 0x50]
push eax
push str.MINI__04d__02d__02d__02d__02d__02d.dmp
lea eax, [ebp - 0x40]
push 0x1e
push eax
call fcn.1000bb4b
add esp, 0x24
lea eax, [ebp - 0x40]
push eax
push edi
push esi
call fcn.100030cb
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x10060734
pop esi
call fcn.10032a69
leave
ret
Function at 0x1000c2f8
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, str.www.wxrobot.cc
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1000c321
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1000c31a
or eax, 0xffffffff
jmp 0x1000c321
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx + 0xa0], eax
setne al
pop esi
ret 4
Function at 0x1000f77f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and ecx, 0xfffffff0
push esi
push 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x5a
mov byte [ebp - 0x12], 0x8f
mov byte [ebp - 0x11], 0x1a
mov byte [ebp - 0x10], 0x2a
mov byte [ebp - 0xf], 0x3c
mov byte [ebp - 0xe], 0x4e
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0xa8
mov byte [ebp - 0xb], 0x1b
mov byte [ebp - 0xa], 0xa
mov byte [ebp - 9], 0xbd
mov byte [ebp - 8], 0x2a
mov byte [ebp - 7], 0x4c
mov byte [ebp - 6], 0x56
mov byte [ebp - 5], 0x15
pop eax
jbe 0x1000f7ff
push edi
mov edx, dword [ebp - 0x18]
xor esi, esi
lea edi, [edx + eax]
mov dl, byte [ebp + esi - 0x14]
xor byte [edi + esi], dl
inc esi
cmp esi, 0x10
jb 0x1000f7ea
add eax, 0x10
cmp eax, ecx
jb 0x1000f7e2
pop edi
cmp eax, dword [ebp + 0xc]
jae 0x1000f818
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea esi, [edx + eax]
mov dl, byte [ecx]
xor byte [esi], dl
inc ecx
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x1000f807
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10032a69
leave
ret

Function at 0x100128b8
Capabilities:
Hash data with md5

Disassembly:
push 0x40
lea eax, [esi + 0x14]
push 0
push eax
call fcn.10035680
and dword [esi + 0x58], 0
and dword [esi + 0x54], 0
add esp, 0xc
mov dword [esi + 0x5c], 0x67452301
mov dword [esi + 0x60], 0xefcdab89
mov dword [esi + 0x64], 0x98badcfe
mov dword [esi + 0x68], 0x10325476
ret
Function at 0x10012c20
Capabilities:
Create directory

Disassembly:
push 0x48
mov eax, 0x1004da67
call fcn.10035b95
mov esi, ecx
mov eax, dword [esi + 0x14]
xor edi, edi
mov dword [ebp - 0x54], esi
cmp eax, edi
je 0x10012cd8
cmp eax, 3
jb 0x10012cd8
mov eax, esi
call fcn.10013078
cmp word [eax], 0x3a
jne 0x10012cd8
push esi
lea ecx, [ebp - 0x48]
call fcn.100055af
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x34]
dec eax
push eax
lea ecx, [ebp - 0x48]
call fcn.10013050
movzx eax, word [eax]
push 0x5c
pop ebx
cmp ax, bx
je 0x10012c8a
cmp ax, 0x2f
je 0x10012c8a
lea esi, [ebp - 0x48]
call fcn.10013009
push 1
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], ebx
call fcn.1000b8b2
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x2f
call fcn.1000b8b2
or ecx, 0xffffffff
cmp esi, ecx
jne 0x10012cbd
mov esi, ecx
cmp eax, ecx
jne 0x10012cc3
mov eax, ecx
cmp esi, eax
jb 0x10012cc9
mov esi, eax
cmp esi, ecx
jne 0x10012ce0
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.100029d6
xor eax, eax
call fcn.10035c18
ret
mov dword [ebp - 0x4c], 1
mov ecx, dword [ebp - 0x54]
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.100026b7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10012d01
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10012d31
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10012d18
lea eax, [ebp - 0x28]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10012d31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10012d8a
push 1
inc esi
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ebx
call fcn.1000b8b2
push 1
mov edi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], 0x2f
call fcn.1000b8b2
or ecx, 0xffffffff
cmp edi, ecx
jne 0x10012d65
mov edi, ecx
cmp eax, ecx
jne 0x10012d6b
mov eax, ecx
mov esi, edi
cmp edi, eax
jb 0x10012d73
mov esi, eax
push 0
cmp esi, ecx
push 1
lea ecx, [ebp - 0x2c]
je 0x10012d9a
call fcn.100029d6
xor edi, edi
jmp 0x10012ce7
push edi
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c], edi
call fcn.100029d6
jmp 0x10012da1
call fcn.100029d6
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.100029d6
mov eax, dword [ebp - 0x4c]
jmp 0x10012cda
Function at 0x10012db4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor bl, bl
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x10012dcb
mov eax, dword [edi]
jmp 0x10012dcd
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10012e64
mov eax, dword [esi + 0x14]
xor ecx, ecx
push 2
add eax, 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003220e
cmp dword [esi + 0x18], 8
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
jb 0x10012e04
mov edi, dword [edi]
mov eax, dword [esi + 0x14]
push edi
add eax, 3
push eax
push ebx
call fcn.10034a59
mov ecx, dword [esi + 0x14]
xor eax, eax
lea edi, [ebx + ecx*2]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
mov ecx, 0x414
push eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x14], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call fcn.1003323b
pop ecx
pop edi
mov al, bl
pop ebx
leave
ret

Function at 0x10012f72
Capabilities:
Check mutex on windows

Disassembly:
push 0x20
mov eax, 0x1004cd01
call fcn.10035b95
mov esi, ecx
push 0x10054dc8
lea ecx, [ebp - 0x2c]
call fcn.10002648
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 8
jb 0x10012f9c
mov esi, dword [esi + 4]
jmp 0x10012f9f
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000266a
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10012fbb
lea eax, [ebp - 0x28]
push eax
xor esi, esi
inc esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10012fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10012fef
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100029d6
mov eax, esi
call fcn.10035c18
ret
xor esi, esi
jmp 0x10012fdb
Function at 0x100131c7
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push 0xa4
mov eax, 0x1004e73c
call fcn.10035b95
mov edi, ecx
xor esi, esi
mov eax, edi
mov dword [ebp - 0x60], esi
call fcn.10014045
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x100133af
push dword [ebp - 0x60]
call fcn.10033407
pop ecx
mov ebx, eax
lea eax, [ebp - 0x60]
push eax
push ebx
push esi
push esi
push 2
mov dword [ebp - 0x5c], ebx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, esi
jne 0x100133a1
mov dword [ebp - 0x64], ebx
cmp ebx, esi
je 0x100133af
jmp 0x1001322f
mov ebx, dword [ebp - 0x64]
cmp dword [ebx + 0x34], esi
jbe 0x10013393
mov eax, dword [ebx + 0x40]
cmp eax, 0x47
je 0x10013249
cmp eax, 6
jne 0x10013393
lea ecx, [ebp - 0x54]
call fcn.10002633
lea ecx, [ebp - 0x38]
call fcn.10002633
mov dword [ebp - 4], esi
cmp dword [ebx + 0x34], 0
jbe 0x100132b4
movzx eax, byte [ebx + esi + 0x2c]
push eax
push 0x10053970
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.1000bb4b
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.10002648
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.10002a3c
push 0
push 1
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0
call fcn.100029d6
inc esi
cmp esi, dword [ebx + 0x34]
jb 0x10013262
cmp dword [ebx + 0x40], 0x47
push dword [ebx + 0xc]
sete al
lea ecx, [ebp - 0x8c]
mov byte [ebp - 0x58], al
call fcn.100039b0
lea esi, [ebp - 0x8c]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.10012b5d
push 0xffffffffffffffff
xor esi, esi
push esi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.10002869
push esi
push 1
lea ecx, [ebp - 0xb0]
call fcn.100029d6
push esi
push 1
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0
call fcn.1000383a
mov ecx, dword [edi + 0xc]
cmp ecx, esi
jne 0x1001331f
mov dword [ebp - 0x68], esi
jmp 0x1001332d
mov eax, dword [edi + 0x14]
sub eax, ecx
push 0x3c
cdq
pop esi
idiv esi
mov dword [ebp - 0x68], eax
mov esi, dword [edi + 0x10]
mov eax, esi
sub eax, ecx
push 0x3c
cdq
pop ecx
idiv ecx
cmp eax, dword [ebp - 0x68]
jae 0x10013350
lea eax, [ebp - 0x58]
push eax
push 1
push esi
call fcn.10014234
mov dword [edi + 0x10], eax
jmp 0x10013375
mov ebx, esi
lea esi, [ebp - 0x70]
call fcn.1001c152
push dword [ebp - 0x6c]
lea eax, [ebp - 0x58]
push dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, edi
call fcn.10014185
mov ebx, dword [ebp - 0x64]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.100029d6
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.100029d6
xor esi, esi
mov ebx, dword [ebx + 8]
mov dword [ebp - 0x64], ebx
cmp ebx, esi
jne 0x1001322c
cmp dword [ebp - 0x5c], esi
je 0x100133af
push dword [ebp - 0x5c]
call fcn.100334d1
pop ecx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x3c
cdq
pop ecx
idiv ecx
neg eax
sbb eax, eax
neg eax
call fcn.10035c18
ret
Function at 0x100135c0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x1004e149
call fcn.10035b95
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x230], ebx
push eax
mov dword [ebp - 0x22c], eax
mov esi, ecx
mov dword [ebp - 0x220], ebx
call fcn.100140c3
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x230], edi
jb 0x10013608
mov esi, dword [esi + 4]
jmp 0x1001360b
add esi, 4
lea eax, [ebp - 0x220]
push eax
push 8
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100136fc
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x228], ebx
call fcn.10035680
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x224], 0x104
push ebx
jmp 0x100136e4
inc dword [ebp - 0x228]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.10002648
lea eax, [ebp - 0x24c]
mov dword [ebp - 4], edi
push eax
mov eax, dword [ebp - 0x22c]
call fcn.100140f3
push ebx
push edi
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], bl
call fcn.100029d6
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
mov dword [ebp - 0x224], 0x104
call fcn.10035680
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x228]
push dword [ebp - 0x220]
call esi
test eax, eax
je 0x10013670
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
call fcn.10035c18
ret 4
Function at 0x1001370a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9a4]
sub esp, 0xa24
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x9a0], eax
mov eax, dword [ebp + 0x9b0]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x9c4], 8
push esi
mov dword [ebp - 0x70], ebx
jae 0x10013741
lea eax, [ebp + 0x9b0]
lea ecx, [ebp - 0x70]
push ecx
push 1
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10013864
push 0x206
mov word [ebp + 0x798], ax
lea eax, [ebp + 0x79a]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call fcn.10035680
xor eax, eax
push 0x7fe
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
mov dword [ebp - 0x74], 0x104
mov dword [ebp - 0x80], ebx
call fcn.10035680
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x798]
push eax
push ebx
jmp 0x10013847
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x80], 1
jne 0x10013801
cmp dword [ebp - 0x74], ebx
jbe 0x10013801
cmp dword [ebp - 0x78], 3
jbe 0x10013801
lea eax, [ebp + 0x798]
push eax
push str.PnpInstanceID
call fcn.10032f4a
pop ecx
pop ecx
test eax, eax
jne 0x10013801
mov word [ebp - 0x62], ax
lea eax, [ebp - 0x68]
push eax
push 0x10054e48
call fcn.10032f4a
pop ecx
pop ecx
test eax, eax
je 0x10013869
push 0x208
lea eax, [ebp + 0x798]
push ebx
push eax
call fcn.10035680
push 0x800
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.10035680
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x798]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x74], 0x104
push dword [ebp - 0x70]
mov dword [ebp - 0x78], 0x400
call esi
test eax, eax
je 0x100137be
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x69], bl
jmp 0x10013876
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x69], 1
push ebx
push 1
lea ecx, [ebp + 0x9ac]
call fcn.100029d6
mov ecx, dword [ebp + 0x9a0]
mov al, byte [ebp - 0x69]
pop esi
xor ecx, ebp
pop ebx
call fcn.10032a69
add ebp, 0x9a4
leave
ret 0x1c