joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebx], ecx
cmp dword [ebp + 0xc], ecx
je 0x1000c94a
lea eax, [ebp - 4]
push eax
push 1
push ecx
push str.stssync
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000c94a
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea eax, [ebp + 0x10]
push eax
xor ecx, ecx
push ecx
push ecx
push ecx
push str.ststypes
push dword [ebp - 4]
mov esi, ecx
call edi
test eax, eax
jne 0x1000c8ce
mov eax, dword [ebp + 0x10]
add eax, 5
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x1000c93f
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push str.ststypes
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1000c8ce
cmp dword [ebp - 8], 7
jne 0x1000c8ce
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [eax + esi], ecx
mov byte [eax + esi + 4], cl
mov eax, esi
jmp 0x1000c8d3
mov eax, str.calendar
movzx ecx, word [eax]
test cx, cx
je 0x1000c933
mov edi, ecx
mov edx, dword [ebp + 0xc]
test di, di
je 0x1000c900
movzx edi, word [edx]
test di, di
je 0x1000c900
cmp cx, di
jne 0x1000c900
add eax, 2
add edx, 2
movzx ecx, word [eax]
test cx, cx
jne 0x1000c8e5
movzx ecx, word [eax]
cmp word [edx], cx
je 0x1000c926
test cx, cx
je 0x1000c917
xor ecx, ecx
add eax, 2
cmp word [eax], cx
jne 0x1000c90f
add eax, 2
movzx ecx, word [eax]
mov edi, ecx
test cx, cx
jne 0x1000c8dd
jmp 0x1000c933
push 0x1011a2d0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx], eax
test esi, esi
je 0x1000c93f
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc

Function at 0x100107de
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x1c
mov eax, 0x10111d95
call fcn.10110919
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x28]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
xor eax, eax
test ecx, ecx
mov dword [ebp + 0xc], eax
push 0x40
pop esi
lea edx, [ecx + 0x28]
cmove edx, esi
mov ecx, dword [edx]
test ecx, ecx
jne 0x10010815
mov ecx, 0x80004005
jmp 0x10010875
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x1011a3f0
push ecx
call dword [eax]
mov ecx, eax
mov eax, dword [ebp + 0xc]
test ecx, ecx
js 0x10010875
test eax, eax
je 0x10010872
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
xor ecx, ecx
xor esi, esi
inc ecx
test ax, ax
push 0x11
cmovs esi, ecx
call edi
test ax, ax
jns 0x10010851
add esi, 2
push 0x12
call edi
test ax, ax
jns 0x1001085d
add esi, 4
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x28]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ecx, eax
mov eax, dword [ebp + 0xc]
jmp 0x10010875
xor ecx, ecx
inc ecx
xor ebx, ebx
test ecx, ecx
setne bl
and dword [ebp - 4], 0
test eax, eax
je 0x1001088a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
call fcn.101108ea
ret 8
Function at 0x10011423
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x10111ebe
call fcn.10110919
mov edi, dword [ebp + 8]
lea eax, [edi - 0x14]
neg edi
sbb edi, edi
and edi, eax
and dword [ebp - 4], 0
mov ecx, dword [edi + 0x40]
test ecx, ecx
jne 0x10011339
cmp dword [ebp + 0x14], ecx
jne 0x1001138d
mov bl, 1
jmp 0x1001138f
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1001138d
and dword [ebp + 0x14], 0
lea edx, [ebp + 0x14]
and dword [ebp + 8], 0
mov ebx, 0x10119418
mov eax, dword [ecx]
push edx
push ebx
push ecx
call dword [eax]
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
call dword [eax]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
cmp eax, ecx
sete bl
mov byte [ebp - 4], 1
test ecx, ecx
je 0x1001137d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 2
test eax, eax
je 0x1001138f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1001138f
xor bl, bl
or dword [ebp - 4], 0xffffffff
test bl, bl
jne 0x100113a1
mov eax, 0x8000ffff
jmp case.default.0x100113cf
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x100113be
push dword [ebp + 0x1c]
push ecx
lea ecx, [edi + 0x14]
call fcn.10010b68
mov eax, 0x40180
jmp case.default.0x100113cf
add ecx, 7
mov eax, 0x80004001
cmp ecx, 7
ja case.default.0x100113cf
jmp dword [ecx*4 + 0x1001145e]
push dword [ebp + 0x1c]
push ecx
lea ecx, [edi + 0x14]
call fcn.10010b68
jmp case.default.0x100113cf
push ecx
lea ecx, [edi + 0x14]
neg ecx
push 0xffffffffffffffff
sbb ecx, ecx
and ecx, edi
add ecx, 0x30
call fcn.10010d07
xor ecx, ecx
test eax, eax
cmovns eax, ecx
jmp case.default.0x100113cf
push ecx
push ecx
lea ecx, [edi + 0x14]
call fcn.10010c62
jmp case.default.0x100113cf
lea ecx, [edi + 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
and ecx, edi
test byte [ecx + 0x74], 8
jne case.default.0x100113cf
push ecx
push 0xfffffffffffffffc
jmp 0x100113f0
lea esi, [edi + 0x14]
neg esi
sbb esi, esi
and esi, edi
lea eax, [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [esi + 0x7c], 0
je case.0x100113cf.6
push 0
push dword [esi + 0x7c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp case.default.0x100113cf
push dword [ebp + 0x1c]
push ecx
lea ecx, [edi + 0x30]
call fcn.1001115c
call fcn.101108ea
ret 0x1c
Function at 0x1001412b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10112029
call fcn.1011094d
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x41c], eax
push 0x60
push eax
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.kernel32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
push 2
pop eax
test edi, edi
jne 0x1001419c
push eax
push edi
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1001419c
call fcn.10012a54
mov esi, eax
jmp 0x1001427e
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100141bf
call fcn.10012a54
jmp 0x10014271
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x100141b5
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x100141e8
mov esi, 0x8007000e
jmp 0x10014273
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
test edx, edx
ja 0x100142ac
jb 0x10014203
cmp eax, 0xffffffff
ja 0x100142ac
cmp eax, 0x400
jbe 0x10014218
push eax
lea ecx, [ebp - 0x41c]
call fcn.10046129
jmp 0x10014224
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x41c], 0
je 0x100141de
push esi
push dword [ebp - 0x41c]
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100141b5
mov eax, dword [ebp - 0x41c]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x41c]
call fcn.10046129
mov esi, eax
test edi, edi
je 0x1001427e
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x418]
cmp dword [ebp - 0x41c], eax
je 0x10014297
lea ecx, [ebp - 0x41c]
call fcn.10012a1c
lea ecx, [ebp - 0x428]
call fcn.10006b97
mov eax, esi
call fcn.101108ff
ret 0x10
push 0x80070216
call fcn.10046129
int3

Function at 0x10016d8e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
jne 0x10016dc0
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x10016dc2
xor eax, eax
pop ebp
ret 0xc
Function at 0x10017c58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push pe_nt_image_headers32
mov eax, 0x1011241e
call fcn.1011094d
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov esi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x124], eax
test eax, eax
jle 0x10017c97
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.10046129
mov esi, eax
mov dword [ebp - 0x11c], esi
test esi, esi
js 0x10017e37
cmp dword [ebx + 0xac], edi
je 0x10017caa
lea ecx, [ebx + 0xa8]
call fcn.10046129
mov ecx, dword [ebp - 0x124]
cmp ecx, 0x64
jle 0x10017d58
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x120], edi
push 0xa5a9
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.10046129
push 0xa5aa
lea ecx, [ebp - 0x120]
call fcn.10046129
push ecx
push dword [ebp - 0x11c]
lea ecx, [ebx + 0x30]
push dword [ebp - 0x120]
call fcn.10046129
push dword [ebp - 0x120]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call ebx
push dword [ebp - 0x11c]
call ebx
mov esi, 0x80004005
mov dword [ebp - 0x11c], esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x10017d4e
cmp dword [ebp + 0xc], 0
jle 0x10017d46
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [eax + edi*4]
call esi
mov eax, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x10017d32
mov esi, dword [ebp - 0x11c]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, esi
call fcn.101108ff
ret 0xc
mov eax, edi
mov dword [ebp - 0x120], eax
test ecx, ecx
jle 0x10017d19
push eax
lea ecx, [ebp + 8]
call fcn.10046129
lea ecx, [ebp - 0x118]
push dword [eax]
call fcn.10046129
push dword [eax]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x10017d9f
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
cmp esi, 0xffffffff
jne 0x10017dca
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x10017de4
cmp eax, 3
je 0x10017de4
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov dword [ebp - 0x11c], esi
jmp 0x10017de0
mov eax, esi
shr eax, 4
and eax, 1
mov dword [ebp - 0x128], eax
mov esi, edi
mov dword [ebp - 0x11c], edi
test esi, esi
js 0x10017e37
push dword [ebp - 0x120]
lea ecx, [ebp + 8]
call fcn.10046129
mov ecx, ebx
cmp dword [ebp - 0x128], edi
jne 0x10017e06
push edi
push dword [eax]
call fcn.100180b3
jmp 0x10017e0d
push dword [eax]
call fcn.10018284
mov esi, eax
mov dword [ebp - 0x11c], esi
test esi, esi
js 0x10017e37
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp eax, dword [ebp - 0x124]
jl 0x10017d64
jmp 0x10017d19
lea ecx, [ebx + 0xa8]
call fcn.10046129
push dword [ebx + 0xbc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebx + 0xbc], edi
jmp 0x10017d1f
Function at 0x10018284
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x370
mov eax, 0x10112487
call fcn.1011094d
mov dword [ebp - 0x37c], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
or dword [ebp - 0x374], 0xffffffff
mov esi, ebx
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x370], esi
mov dword [ebp - 4], ebx
test eax, eax
je 0x1001849d
push 1
push eax
call fcn.100180b3
mov edi, eax
test edi, edi
js 0x1001848f
mov edi, dword [ebp - 0x378]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, 0x101
ja 0x1001849d
mov ecx, edi
call fcn.10006afa
push eax
push edi
lea ecx, [ebp - 0x370]
call fcn.10046129
mov edi, eax
test edi, edi
js 0x10018489
push 2
push 0x1011c2b0
lea ecx, [ebp - 0x370]
call fcn.10046129
mov edi, eax
test edi, edi
js 0x10018489
mov esi, dword [ebp - 0x370]
lea ecx, [ebp - 0x118]
push esi
call fcn.10046129
lea ecx, [ebp - 0x368]
push ecx
push dword [eax]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x118], ecx
je 0x1001836a
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x374]
pop ecx
cmp eax, 0xffffffff
je 0x100184a2
mov edx, 0x1011c2b8
lea ecx, [ebp - 0x33c]
movzx eax, byte [ecx]
cmp al, byte [edx]
jne 0x10018392
movzx eax, byte [ecx + 1]
cmp al, byte [edx + 1]
je 0x10018452
mov edx, 0x1011c2bc
lea ecx, [ebp - 0x33c]
movzx eax, byte [ecx]
cmp al, byte [edx]
jne 0x100183b1
movzx eax, byte [ecx + 1]
cmp al, byte [edx + 1]
je 0x10018452
push dword [ebp - 0x378]
lea ecx, [ebp - 0x36c]
call fcn.10046129
push 1
push 0x101191cc
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 1
call fcn.10046129
mov edi, eax
test edi, edi
js 0x1001847b
lea ecx, [ebp - 0x33c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100183eb
sub ecx, edx
lea eax, [ebp - 0x33c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x36c]
call fcn.10046129
mov edi, eax
test edi, edi
js 0x1001847b
test byte [ebp - 0x368], 0x10
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0x37c]
mov dword [ebp - 0x36c], ebx
je 0x10018436
push eax
call fcn.10018284
jmp 0x1001843d
push ebx
push eax
call fcn.100180b3
mov edi, eax
test edi, edi
js 0x1001847b
mov byte [ebp - 4], bl
push dword [ebp - 0x36c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x368]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x10018373
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x12
cmovne edi, eax
jmp 0x1001848f
push dword [ebp - 0x36c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1001848f
mov esi, dword [ebp - 0x370]
push dword [ebp - 0x374]
call dword [sym.imp.kernel32.dll_FindClose]
jmp 0x100184a4
mov ebx, 0x80070057
mov edi, ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.101108ff
ret 4
Function at 0x1001f752
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
mov esi, ecx
push 1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1001f794
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
test eax, eax
je 0x1001f794
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x1001f794
cmp word [eax + 2], 0
je 0x1001f794
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x1001f794
add eax, 0x30
jmp 0x1001f799
mov eax, 0x1011ec80
pop edi
pop esi
ret

Function at 0x10042ae4
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x10042afe
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x10042af1
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10045201
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1004520d
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x10045235
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1004521b
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10053b70
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x10053bc6
test esi, esi
je 0x10053bc6
push 2
pop edx
call fcn.10046129
mov edi, eax
test edi, edi
jne 0x10053b91
mov eax, 0x80004005
jmp 0x10053bcb
mov ecx, esi
call fcn.10006995
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0
push edi
call dword [sym.imp.advapi32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x10053bcb
mov eax, 0x80070057
pop edi
pop esi
ret 4

Function at 0x10053bd0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10053be0
mov eax, 0x80070057
jmp 0x10053c24
call fcn.10046129
mov edi, eax
test edi, edi
je 0x10053c21
push 0
call fcn.10053fa0
neg eax
sbb eax, eax
and eax, 0x100
push eax
push esi
push edi
call dword [sym.imp.advapi32.dll_RegDeleteKeyExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, 2
je 0x10053c21
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x10053c24
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x10062739
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc0
mov eax, 0x10114a80
call fcn.1011094d
mov eax, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc8], 0x101bb940
mov dword [0x101bb940], ebx
mov dword [0x101bb944], ebx
mov dword [0x101bb948], ebx
xor ecx, ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], ebx
push eax
inc ecx
push ecx
push ebx
push str.Control_PanelInternational
push SysReAllocString
mov dword [ebp - 0xcc], ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100628b0
mov edi, dword [sym.imp.advapi32.dll_RegGetValueW]
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push 0x20000020
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
call edi
test eax, eax
jne 0x100628a4
cmp dword [ebp - 0xc0], 3
jbe 0x100628a4
push dword [ebp - 0xc0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x100628a4
lea eax, [ebp - 0xc0]
push eax
push esi
push ebx
push 0x20
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
call edi
test eax, eax
jne 0x1006289c
mov ebx, dword [ebp - 0xc0]
cmp ebx, 3
jbe 0x1006289c
xor edx, edx
shr ebx, 1
push edx
pop ecx
mov eax, edx
mov edi, edx
mov word [esi + ebx*2 - 2], cx
je 0x1006289c
jmp 0x10062847
cmp eax, ebx
jae 0x1006284d
inc eax
cmp word [esi + eax*2], dx
je 0x10062842
cmp word [esi + edi*2], dx
jne 0x10062897
cmp edi, eax
jbe 0x10062897
xor ecx, ecx
lea eax, [esi + eax*2]
mov word [ebp - 0xbc], cx
lea ecx, [ebp - 0xbc]
push 0x55
push ecx
push eax
call dword [sym.imp.kernel32.dll_ResolveLocaleName]
test eax, eax
je 0x10062892
cmp word [ebp - 0xbc], 0
je 0x10062892
lea eax, [ebp - 0xbc]
mov ecx, 0x101bb940
push eax
call fcn.10046129
lea eax, [edi + 1]
xor edx, edx
inc edi
cmp edi, ebx
jb 0x10062847
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push dword [ebp - 0xc4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0x101bb940
call fcn.101108ff
ret 4
Function at 0x1000167c
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x1001d908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1002a034]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
lea eax, [ebp]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x10001768
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10003356
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.100033b4
push 0x104
push eax
push dword [ebp + 0x218]
push edi
call fcn.1000db6a
mov ecx, dword [ebp - 0x14]
add esp, 0x10
test ecx, ecx
je 0x1000173e
call fcn.100037d1
jmp 0x1000173e
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004926
add ebp, 0x20c
leave
ret
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003d44
pop ecx
pop ecx
push ebx
push esi
call fcn.1000db6a
int3

Function at 0x1000177d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x1001d938
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1002a034]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
lea eax, [ebp]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x10001869
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10003356
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.100033b4
push 0x104
push eax
push dword [ebp + 0x218]
push edi
call fcn.1000db6a
mov ecx, dword [ebp - 0x14]
add esp, 0x10
test ecx, ecx
je 0x1000183f
call fcn.100037d1
jmp 0x1000183f
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004926
add ebp, 0x20c
leave
ret
push esi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003d44
pop ecx
pop ecx
push ebx
push esi
call fcn.1000db6a
int3
Function at 0x100019e1
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001d960
call fcn.10004980
mov ebx, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 0x14], esi
mov word [ebx], ax
call fcn.100018f8
test eax, eax
je 0x10001a12
call fcn.100018ea
mov esi, eax
mov dword [ebp - 0x14], eax
push 0x104
push ebx
push esi
push edi
push 0x10021c18
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
test esi, esi
js 0x10001b28
jmp 0x10001a62
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10001a70
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10001b20
push ebx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10001ad1
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10001b2e
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10001b20
push 1
push 0x1a
push ebx
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
test esi, esi
jns 0x10001b20
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10001b2e
mov eax, esi
call fcn.10004937
ret
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003d44
pop ecx
pop ecx
push edi
push esi
call fcn.1000db6a
int3

Function at 0x10002445
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10002469
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
ret