joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008da20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x824
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x81c], eax
mov ax, word [0x10163160]
push ebx
push ebp
push esi
push edi
push 0x20
lea edx, [esp + 0x18]
mov edi, ecx
mov cl, byte [0x10163162]
xor ebx, ebx
push edx
push edi
mov byte [esp + 0x24], bl
mov byte [esp + 0x22c], bl
mov byte [esp + 0x434], bl
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
call fcn.10129766
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x1008db6f
lea eax, [esp + 0x220]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1008daa7
push 0x10155f48
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x18]
push edx
push ebx
push 0x1016a0e8
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x18]
push 0x10158250
push ecx
call fcn.1012982a
mov ebp, eax
add esp, 8
cmp ebp, ebx
jne 0x1008dae6
push esi
call fcn.10129ad3
add esp, 4
jmp 0x1008db6f
push 0x3ff
mov eax, esi
lea ecx, [esp + 0x42c]
call fcn.10062730
add esp, 4
test eax, eax
je 0x1008db49
lea edx, [esp + 0x428]
push edx
call fcn.10061df0
add esp, 4
cmp byte [esp + 0x428], bl
je 0x1008db2f
lea eax, [esp + 0x428]
push eax
push 0x10158254
push ebp
call fcn.1012a85b
add esp, 0xc
push 0x3ff
mov eax, esi
lea ecx, [esp + 0x42c]
call fcn.10062730
add esp, 4
test eax, eax
jne 0x1008db00
push ebp
call fcn.10129ad3
add esp, 4
push esi
call fcn.10129ad3
add esp, 4
push ebx
lea ebx, [esp + 0x1c]
call fcn.1007fb10
add esp, 4
mov eax, ebx
call fcn.1005ad10
mov ecx, dword [esp + 0x82c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x824
ret
Function at 0x1008f190
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
push 0x20
lea eax, [esp + 4]
push eax
push 0x58
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1008f1be
test dword [esp + 0xc], 0x8000000
je 0x1008f1be
mov eax, 1
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret

Function at 0x1008f9d0
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
push edi
mov ecx, str.MWDAEMON_MUTEX
call fcn.10067220
mov dword [0x101b7fc8], eax
cmp eax, edi
jne 0x1008fa04
cmp esi, edi
je 0x1008fa00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MWD__Failed_to_create_Mutex__Error:__d
push esi
call fcn.10127dc0
add esp, 0xc
xor eax, eax
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1008fa3f
cmp esi, edi
je 0x1008fa23
push str._MWD__One_instance_of_Daemon_already_running__Exiting...
push esi
call fcn.10127dc0
add esp, 8
cmp dword [0x101b7fc8], edi
je 0x1008fa3b
push 0x101b7fc8
call fcn.10082e10
mov dword [0x101b7fc8], edi
mov eax, edi
pop edi
ret
push edi
push edi
push 0x1008fa60
call fcn.10127f7d
mov edi, 1
add esp, 0xc
mov eax, edi
pop edi
ret
Function at 0x10091be0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0xff
mov dword [esp + 0x18], 1
call fcn.1006b040
mov edi, str.SoftwareWow6432NodeMicroworld
cmp eax, 1
je 0x10091c18
mov edi, str.SoftwareMicroworld
lea eax, [esp + 0xc]
push eax
push 0xf003f
push esi
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10091c62
test ebp, ebp
je 0x10091c56
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._MWD__Failed_to_open_Registry_Key__s__GetLastError___:__d
push ebp
call fcn.10127dc0
add esp, 0x10
test ebx, ebx
je 0x10091cba
mov dword [ebx], 0
jmp 0x10091cba
test ebx, ebx
je 0x10091c6c
mov dword [ebx], 0
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.EraCId
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10091cb2
cmp eax, 2
je 0x10091cb2
test ebp, ebp
je 0x10091cba
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MWD__Failed_to_get_cachedId__GetLastError___:__d__retCode_:__d
push ebp
call fcn.10127dc0
add esp, 0x10
jmp 0x10091cba
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
test eax, eax
je 0x10091ccc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0x10
ret
Function at 0x10091ce0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
xor edi, edi
mov eax, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10091d00
sub eax, edx
lea esi, [eax + 1]
cmp esi, 1
ja 0x10091d30
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x10091de6
push str._MWD__Blank_CachedID._Not_setting_the_same...
push eax
call fcn.10127dc0
add esp, 8
jmp 0x10091dcc
push ebx
call fcn.1006b040
mov ebx, str.SoftwareWow6432NodeMicroworld
cmp eax, 1
je 0x10091d45
mov ebx, str.SoftwareMicroworld
lea eax, [esp + 0x10]
push eax
push 0xf003f
push edi
push ebx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x10091d89
mov esi, dword [esp + 0x20]
test esi, esi
je 0x10091dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._MWD__Failed_to_open_Registry_Key_:__s__GetLastError___:__d
push esi
call fcn.10127dc0
add esp, 0x10
jmp 0x10091dcb
mov ecx, dword [esp + 0x10]
push esi
push ebp
push 1
push 0
push str.EraCId
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10091dc3
mov esi, dword [esp + 0x20]
test esi, esi
je 0x10091dcb
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MWD__Failed_to_set_cachedId__GetLastError___:__d__retCode_:__d
push esi
call fcn.10127dc0
add esp, 0x10
jmp 0x10091dcb
mov dword [esp + 0x14], 1
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10091ddb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 8
ret
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x10093e90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x52c], eax
cmp dword [esi], 1
push ebx
push edi
mov dword [esp + 0x14], ecx
jne 0x10093ed6
mov eax, dword [esi + 0x21c]
push eax
push esi
call fcn.10094040
pop edi
pop ebx
mov ecx, dword [esp + 0x52c]
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret
push 0x207
xor edi, edi
lea ecx, [esp + 0x125]
push edi
push ecx
mov byte [esp + 0x12c], 0
call fcn.1012e060
add esp, 0xc
push 0x207
lea edx, [esp + 0x32d]
push edi
push edx
mov byte [esp + 0x334], 0
call fcn.1012e060
add esp, 0xc
push 0x103
lea eax, [esp + 0x1d]
push edi
push eax
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 0
call fcn.1012e060
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x124]
push ecx
mov dword [esp + 0x18], eax
call ebx
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x124]
call fcn.10063030
add esp, 4
cmp dword [esp + 0xc], 0xffffffff
je 0x10093fcd
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
call ebx
mov edx, dword [esi + 0x21c]
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.10094040
mov edi, eax
test edi, edi
jne 0x10093fae
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x32c]
push ecx
call ebx
mov eax, dword [esi + 0x210]
movzx edx, word [eax + 6]
push edx
call sub.WS2_32.dll_ntohs
test ax, ax
jne 0x10093fcd
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x124]
call fcn.10063030
add esp, 4
cmp dword [esp + 0xc], 0xffffffff
jne 0x10093f67
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x120]
push ecx
push edx
call ebx
test edi, edi
je 0x1009401b
cmp byte [esp + 0x328], 0
je 0x1009401b
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x328]
push eax
push ecx
call ebx
mov edx, dword [esi + 0x21c]
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.10094040
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0x120]
push eax
push ecx
call ebx
mov ecx, dword [esp + 0x534]
mov eax, edi
pop edi
pop ebx
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret
Function at 0x10095540
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, eax
push 0x10169e28
push edi
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x10095574
push 0x10158250
push edi
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x10095574
pop edi
lea eax, [esi + 1]
pop esi
pop ecx
ret
push 2
push 0
push esi
call fcn.1012b1f9
push esi
call fcn.1012b0ca
add esp, 0x10
test eax, eax
je 0x10095620
push 2
push 0xffffffffffffffff
push esi
xor edi, edi
call fcn.1012b1f9
push esi
push 1
lea eax, [esp + 0x1f]
push 1
push eax
call fcn.1012a83e
add esp, 0x1c
test eax, eax
jne 0x100955e6
push 2
push 0xfffffffffffffffe
push esi
call fcn.1012b1f9
add esp, 0xc
test eax, eax
jne 0x100955e0
push esi
push 1
lea ecx, [esp + 0x13]
push 1
push ecx
call fcn.1012a83e
add esp, 0x10
cmp byte [esp + 0xb], 0xa
je 0x100955e0
mov edi, 1
push 2
push 0xffffffffffffffff
jmp 0x100955f6
cmp byte [esp + 0xb], 0xa
je 0x100955f2
mov edi, 1
push 2
push 0
push esi
call fcn.1012b1f9
add esp, 0xc
test edi, edi
je 0x10095620
push 0x1015804c
push esi
call fcn.1012a85b
push 0x1015804c
push ebx
call fcn.10135887
add esp, 0x10
test eax, eax
je 0x1009562f
push ebx
push 0x1014d8cc
push esi
call fcn.1012a85b
add esp, 0xc
push esi
call fcn.10129ad3
add esp, 4
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x10097490
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp esi, ebx
je 0x10097506
cmp byte [esi], bl
je 0x10097506
push edi
lea eax, [esp + 8]
push eax
push 0xf003f
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitor
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
pop edi
jne 0x10097501
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100974d0
mov ecx, dword [esp + 4]
sub eax, edx
inc eax
push eax
push esi
push 1
push ebx
push str.NoNetSwiftDrv
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100974f6
lea ebx, [eax + 1]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop ecx
ret
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x10097510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x100975f7
cmp byte [ebx], 0
je 0x100975f7
push esi
lea eax, [esp + 8]
push eax
push 1
push ebp
push str.SoftwareMicroworldeScan_For_WindowsMwMonitor
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebp
jne 0x100975ef
push 0x208
mov dword [esp + 0x10], 0x208
call fcn.1006a7b0
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x100975e4
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
push esi
push ebp
push ebp
push str.NoNetSwiftDrv
push edx
call edi
cmp eax, 0xea
jne 0x100975c1
push esi
call fcn.10128243
mov eax, dword [esp + 0x14]
push eax
call fcn.1006a7b0
mov esi, eax
add esp, 8
test esi, esi
je 0x100975e3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push esi
push ebp
push ebp
push str.NoNetSwiftDrv
push edx
call edi
jmp 0x100975da
test eax, eax
jne 0x100975da
cmp byte [esi], al
je 0x100975da
push ebx
push esi
call fcn.10129d75
add esp, 8
test eax, eax
jne 0x100975da
lea ebp, [eax + 1]
push esi
call fcn.10128243
add esp, 4
pop edi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
mov eax, 1
pop ebp
add esp, 8
ret
Function at 0x100977e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xfffffffffffffffe
push 0x10183a80
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x24], ebx
wait
mov dword [ebp - 4], ebx
mov dword [ebp - 0x88], ebx
push 0x3c
push ebx
lea eax, [ebp - 0x84]
push eax
call fcn.1012e060
mov byte [ebp], bl
push 0x103
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.1012e060
add esp, 0x18
mov dword [ebp - 0x88], 0x40
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x100978d3
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x40]
fild dword [ebp - 0x40]
test ecx, ecx
jge 0x100978a4
fadd qword [0x1017f1d8]
fmul qword [0x1017f250]
sub esp, 8
fstp qword [esp]
push str._.0f
lea edx, [ebp + 0x104]
push edx
call fcn.10127dc0
lea eax, [ebp + 0x104]
push eax
push str._s_MB
lea ecx, [ebp]
push ecx
jmp 0x10097929
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x20], edx
mov ecx, eax
and eax, 0x7fffffff
mov dword [ebp - 0x1c], eax
fild qword [ebp - 0x20]
and ecx, 0x80000000
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ebx
fild qword [ebp - 0x20]
fchs
faddp st(1)
fmul qword [0x1017f250]
sub esp, 8
fstp qword [esp]
push str._.0f
lea eax, [ebp + 0x104]
push eax
call fcn.10127dc0
lea ecx, [ebp + 0x104]
push ecx
push str._s_MB
lea edx, [ebp]
push edx
call fcn.10127dc0
add esp, 0x1c
lea eax, [ebp]
push eax
call fcn.10061df0
add esp, 4
lea eax, [ebp]
mov dword [ebp - 0x28], eax
cmp byte [eax], bl
je 0x1009794a
inc eax
jmp 0x10097940
lea ecx, [ebp]
sub eax, ecx
inc eax
push eax
call fcn.10128320
add esp, 4
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x1009796f
lea edx, [ebp]
mov esi, eax
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
cmp cl, bl
jne 0x10097965
wait
mov dword [ebp - 4], 0xfffffffe
jmp 0x1009799b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.10127db1
add ebp, 0x118
mov esp, ebp
pop ebp
ret
Function at 0x100979c0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x10183a60
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0x24], 0x104
lea ecx, [ebp - 0x1c]
push ecx
push 1
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10097a56
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x10097af1
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp]
push eax
push ebx
push ebx
push str.ProcessorNameString
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10097aba
lea edx, [ebp]
push edx
call fcn.10061df0
add esp, 4
lea eax, [ebp]
mov dword [ebp - 0x28], eax
cmp byte [eax], bl
je 0x10097a8c
inc eax
jmp 0x10097a82
lea ecx, [ebp]
sub eax, ecx
inc eax
push eax
call fcn.10128320
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x10097aba
lea ecx, [ebp]
mov edx, esi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x10097ab0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xfffffffe
jmp 0x10097aef
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.10127db1
add ebp, 0x108
mov esp, ebp
pop ebp
ret
Function at 0x10097b20
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x10183a40
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0x24], 0x104
lea ecx, [ebp - 0x1c]
push ecx
push 1
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10097bb6
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x10097c51
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp]
push eax
push ebx
push ebx
push str.VendorIdentifier
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10097c1a
lea edx, [ebp]
push edx
call fcn.10061df0
add esp, 4
lea eax, [ebp]
mov dword [ebp - 0x28], eax
cmp byte [eax], bl
je 0x10097bec
inc eax
jmp 0x10097be2
lea ecx, [ebp]
sub eax, ecx
inc eax
push eax
call fcn.10128320
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x10097c1a
lea ecx, [ebp]
mov edx, esi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x10097c10
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xfffffffe
jmp 0x10097c4f
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.10127db1
add ebp, 0x108
mov esp, ebp
pop ebp
ret
Function at 0x100998b0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10181b80
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0x200
mov dword [ebp - 0x20], 0x80
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 0xc]
mov byte [edi], 0
mov eax, edi
mov ecx, dword [ebp + 8]
call fcn.10099430
cmp byte [edi], 0
je 0x10099923
lea eax, [esi + 1]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x1c]
push eax
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x10099a0a
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push edi
call fcn.1012e060
add esp, 0xc
mov edx, dword [ebp - 0x20]
push edx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x10099a0a
mov eax, dword [ebp - 0x20]
push eax
push 0
push esi
call fcn.1012e060
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x20]
push edx
push esi
lea eax, [ebp - 0x1c]
push eax
push edi
mov ecx, dword [ebp + 8]
push ecx
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x100999f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10099a0a
mov edx, dword [ebp - 0x1c]
push edx
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x10099a0a
mov eax, dword [ebp - 0x1c]
push eax
push 0
push edi
call fcn.1012e060
add esp, 0xc
mov ecx, dword [ebp - 0x20]
push ecx
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x10099a0a
mov edx, dword [ebp - 0x20]
push edx
jmp 0x10099976
test edi, edi
je 0x10099a03
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.100856e0
add esp, 8
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10099a37
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009dfe0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x140
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x138], eax
push ebp
mov ebp, dword [0x101bb1c0]
push esi
push edi
push 0x1778
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
xor edi, edi
mov dword [esp + 0x1c], eax
cmp ebp, edi
je 0x1009e024
push ebp
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
call ebp
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call ebp
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
sub edi, dword [esp + 0xc]
sub ebp, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1009e095
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add eax, edi
add ecx, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
push 0x104
lea edx, [esp + 0x3c]
push edx
push 0x1778
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [esp + 0x38], 0
lea eax, [esp + 0x38]
je 0x1009e0c6
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x1009e0c0
lea edx, [esp + 0x38]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
sub eax, edx
push eax
mov eax, edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, ecx
sub eax, dword [esp + 0x20]
add edx, edi
push 0
mov dword [esp + 0x1c], edx
sub edx, edi
push edx
sub ecx, eax
push ecx
push edi
push eax
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10127db1
add esp, 0x140
ret