joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcefd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcefd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xcefd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcefd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xcefd94
push eax
push esi
call fcn.00cf220b
add esp, 8
pop esi
ret 0x10

Function at 0xcefda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcefe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xcefe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd08320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cf1dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xcefdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xcefe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcefec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xcefeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd08320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cf1dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xcefeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xcefe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xcf0000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xcf0131
push esi
call fcn.00cf3145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00ce2080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xcf0131
push 0
push ebp
call fcn.00ce23a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00ce2260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xcf008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00ce22f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xcf0121
push 0xd08918
push edi
call fcn.00cf13f0
push eax
push ebx
push esi
call fcn.00ceff60
push 0xd088f8
push edi
call fcn.00cf13f0
push eax
push ebx
push esi
call fcn.00ceff60
push 0xd088d8
push edi
call fcn.00cf13f0
push eax
push ebx
push esi
call fcn.00ceff60
push 0xd088c0
push edi
call fcn.00cf13f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00ceff60
push 0xd088a0
push edi
call fcn.00cf13f0
push eax
push ebx
push esi
call fcn.00ceff60
push 0xd08888
push edi
call fcn.00cf13f0
push eax
push ebx
push esi
call fcn.00ceff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xcf11b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cf1140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cf1140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cf1140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cf1140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcf1bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcf1c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd0387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcf1c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcf1c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x30001d24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3002dd90]
jne 0x3009408c
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x300b8248], eax
mov dword [0x300b8244], ecx
mov dword [0x300b8240], edx
mov dword [0x300b823c], ebx
mov dword [0x300b8238], esi
mov dword [0x300b8234], edi
mov word [0x300b8260], ss
mov word [0x300b8254], cs
mov word [0x300b8230], ds
mov word [0x300b822c], es
mov word [0x300b8228], fs
mov word [0x300b8224], gs
pushfd
pop dword [0x300b8258]
mov eax, dword [ebp]
mov dword [0x300b824c], eax
mov eax, dword [ebp + 4]
mov dword [0x300b8250], eax
lea eax, [ebp + 8]
mov dword [0x300b825c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x300b8198], 0x10001
mov eax, dword [0x300b8250]
mov dword [0x300b814c], eax
mov dword [0x300b8140], 0xc0000409
mov dword [0x300b8144], 1
mov eax, dword [0x3002dd90]
mov dword [ebp - 0x328], eax
mov eax, dword [0x300b4d4c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x300b8190], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30094190
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x300b8190], 0
jne 0x3009417c
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x3000427d
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x30004289
xor eax, eax
pop edi
ret
push esi
push 0x30021d60
push 0xc
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x3003e606
cmp eax, 0xb7
mov dword [edi], esi
je 0x30004315
push 0x30021d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x30004315
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x30004307
push eax
push eax
push eax
mov eax, dword [edi]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x30004307
push eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop edi
ret
test eax, eax
jle 0x30004317
and eax, 0xffff
pop esi
or eax, 0x80070000
pop edi
ret
Function at 0x300046a6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x3c], 0
push edi
je 0x30035748
xor edi, edi
cmp dword [esi + 0x40], edi
jle 0x300046e2
mov ebx, dword [ebp + 8]
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + edi*4]
push 1
push ebx
push eax
call dword [sym.imp.MSO.dll_Ordinal_639]
test eax, eax
jne 0x30035767
add edi, 1
cmp edi, dword [esi + 0x40]
jl 0x300046c2
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x30035754
mov eax, 0x3001db80
lea ecx, [esi + 0x40]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi + 0x3c], eax
jmp 0x300046b8
cmp byte [ebp + 0xc], 0
je 0x3003579b
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x3003579b
lea edx, [edi + 1]
cmp edx, dword [esi + 0x40]
push 0
jge 0x30035796
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + edi*4 + 4]
push ecx
push edi
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::Strings::CopyWzToWz_wchar_t_const___class_MsoCF::CWzInBuffer_T_class_MsoCF::String_struct_MsoCF::WzTraits___class_MsoCF::CBuffer_wchar_t_____int__]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
call fcn.300054e8
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x300047da
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009ae4d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [esi + 8], edi
call dword [sym.imp.MSO.dll_Ordinal_189]
mov dword [esi], 0x3001eb98
mov dword [ebx], 0x3001eb5c
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0x80000000
mov dword [esi + 0x18], 4
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
or eax, 0xffffffff
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 2
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
call fcn.3000488c
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 3
call fcn.3000488c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x300052c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009b6b5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.ONMain.DLL_public:_void___thiscall_MsoCF::CWindow::constructor_void_]
mov dword [esi], 0x3001fd70
mov dword [esi + 0xc], 0x300053f8
xor ebx, ebx
mov dword [esi + 0x10], 0x30005410
mov dword [esi + 0x14], 0x300054a0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
call fcn.300021ab
mov eax, dword [sym.imp.ONMain.DLL_class_MsoCF::CHeapBufferAllocator_MsoCF::g_HeapBufferAllocator]
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
push ebx
mov byte [ebp - 4], 3
call fcn.300054e8
mov dword [esi + 0x54], ebx
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 5
call dword [sym.imp.ONMain.DLL_public:_void___thiscall_MsoCF::CToolbarData::constructor_void_]
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], 0x30005484
mov dword [esi + 0x94], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x9c], ebx
mov eax, 1
mov dword [esi + 0x98], eax
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xa8], al
mov dword [esi + 0x7c], ebx
mov byte [esi + 0xa0], bl
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xa9], bl
mov byte [esi + 0xa1], bl
mov byte [esi + 0xaa], bl
mov byte [esi + 0xab], bl
mov byte [esi + 0xac], bl
mov byte [esi + 0xad], bl
mov dword [esi + 0x44], ebx
mov dword [esi + 0x88], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30006b69
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
mov esi, ecx
jne 0x3003e5d2
cmp dword [esi], 0
je 0x3003e5dd
push ebx
push 0x30021d10
push 0
push 0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [ebp + 0x18], eax
je 0x30006c0a
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x30006bf9
push eax
push eax
push eax
mov eax, dword [esi]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x30006bf9
mov dl, byte [ebp + 8]
test dl, dl
je 0x30006c13
test edi, edi
jne 0x3003e5e5
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jne 0x3003e5ee
test dl, dl
je 0x3003e5f8
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov bl, 1
mov esi, dword [ebp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
cmp byte [eax + 8], dl
je 0x30006bc6
jmp 0x30006bf9
cmp dword [eax], 0
je 0x30006be1
jmp 0x30006bf0
mov dword [edi], 0
jmp 0x30006b7b
pop edi
xor al, al
pop esi
pop ebp
ret 0x18
mov ecx, dword [eax]
mov dword [edi], ecx
jmp 0x30006bce
mov esi, dword [eax + 4]
mov dword [ecx], esi
jmp 0x30006bd9
cmp byte [ebp + 0xc], dl
jne 0x30006c1a
jmp 0x30006bf0
Function at 0x30009248
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009d948
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.ONMain.DLL_public:_void___thiscall_MsoCF::CWindow::constructor_void_]
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
mov dword [esi], 0x30020a80
mov dword [esi + 0xc], 0x30020a70
call fcn.3000488c
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x24], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3000d8ec
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009ed83
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSO.dll_Ordinal_137]
xor edi, edi
mov dword [esi], 0x30020d08
mov dword [ebp - 4], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov byte [ebp - 4], 6
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call fcn.3000d972
test al, al
sete al
mov byte [esi + 0x34], al
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x30017648
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009b0ac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
call dword [sym.imp.ONMain.DLL_public:_static_class_MsoCF::CLangConfig____stdcall_MsoCF::CLangConfig::Instance_void_]
movzx eax, word [eax + 0x14]
mov dword [ebp - 0x14], eax
movzx eax, ax
push eax
call dword [sym.imp.MSO.dll_Ordinal_7922]
test eax, eax
jne 0x3003548f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
mov eax, dword [edx + 0x38]
lea ecx, [esi + 8]
call eax
mov esi, eax
test esi, esi
je 0x30017694
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [esi + 0x58]
mov ebx, eax
push ebx
call ecx
mov edi, eax
test edi, edi
je 0x300354d9
cmp word [ebp - 0x14], 0x804
jne 0x300354d5
push ebx
call dword [sym.imp.MSO.dll_Ordinal_1921]
mov edi, eax
sub edi, 1
neg edi
sbb edi, edi
add edi, 1
test edi, edi
jne 0x3003553a
cmp word [ebp - 0x14], 0x804
jne 0x30035532
push 0x804
push esi
call fcn.3005ad46
xor ebx, ebx
movzx edi, al
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x48]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
mov eax, dword [ecx + 0x34]
mov dword [ebp - 4], ebx
call eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x2037e
call fcn.30016104
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 4], 0xffffffff
je 0x30035532
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
test edi, edi
je 0x30017694
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x30017694
mov ebx, dword [eax + 4]
mov edx, dword [esi + 0x38]
push ebx
call edx
mov edi, eax
mov eax, dword [esi + 0x80]
push 1
push edi
call eax
mov eax, dword [esi + 0x3c]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x10]
push edx
push edi
call eax
or dword [ebp - 0x10], 1
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp ax, 0x411
jne 0x30035584
or dword [ebp - 0x10], 8
jmp 0x30035588
and dword [ebp - 0x10], 0xfffffff7
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x7c]
push ecx
push edx
push edi
call eax
mov ecx, dword [esi + 0x68]
push edi
push ebx
call ecx
jmp 0x30017694
Function at 0x300193b5
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009a94c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x6e], 0
je 0x300193f5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
mov byte [edi + 0x6e], 1
call dword [sym.imp.MSO.dll_Ordinal_6393]
test eax, eax
je 0x300193e4
push 0x3001946c
call dword [sym.imp.MSO.dll_Ordinal_3210]
test eax, eax
je 0x300193e4
lea esi, [edi + 0x70]
push esi
push 0x3001945c
push 1
push 0
push 0x3001946c
call fcn.30019490
mov eax, dword [esi]
test eax, eax
je 0x3001943d
mov edi, dword [edi + 0x48]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x48]
push eax
push edi
call edx
call dword [sym.imp.ONMain.DLL_public:_static_class_MsoCF::CLangConfig____stdcall_MsoCF::CLangConfig::Instance_void_]
movzx eax, word [eax + 0x14]
mov edi, dword [sym.imp.MSO.dll_Ordinal_7922]
movzx eax, ax
push eax
call edi
test eax, eax
je 0x300193e4
jmp 0x300350ad
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
movzx ecx, ax
push ecx
call edi
test eax, eax
je 0x300193e4
mov esi, dword [esi]
xor edi, edi
test esi, esi
mov dword [ebp - 0x14], edi
je 0x300350e4
mov edx, dword [esi]
mov ecx, dword [edx]
lea eax, [ebp - 0x14]
push eax
push 0x3001e968
push esi
call ecx
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], edi
test edi, edi
mov dword [ebp - 4], 0
je 0x3003514d
mov dword [ebp - 0x10], 0
mov edx, dword [edi]
mov ecx, dword [edx + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0x3003516c
push edi
mov byte [ebp - 4], 1
call ecx
test eax, eax
jne 0x3003513a
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.MSO.dll_Ordinal_3090]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x28]
push edx
mov word [ebp - 0x28], 3
mov dword [ebp - 0x20], 1
mov ecx, dword [eax]
push 0
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 0
je 0x3003514d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
mov dword [ebp - 4], 0xffffffff
je 0x300193e4
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
jmp 0x300193e4
Function at 0x3001d322
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je Ordinal_1916
push edi
push 0x30021d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp byte [ebp + 8], 0
mov edi, eax
jne 0x3001d39f
test edi, edi
je 0x3001d3d7
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x3001d3c9
push eax
push eax
push eax
mov eax, dword [esi]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x3001d3c9
push eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 4
test edi, edi
je 0x3001d3d7
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x3001d3c9
mov ecx, dword [esi]
push eax
push eax
push eax
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x3001d3c9
mov byte [eax + 8], 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 4

Function at 0x3004240d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300b6738], 0
jne 0x300424e2
lea eax, [ebp - 0xd0]
push eax
push 0x20019
push 0
push 0x3004251c
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x300424e2
push esi
push 0x300424fc
mov dword [ebp - 0xd4], 0xc8
call dword [sym.imp.MSO.dll_Ordinal_295]
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
push edx
mov esi, eax
lea eax, [ebp - 0xd8]
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x300424d4
cmp dword [ebp - 0xd8], 1
jne 0x300424d4
add esi, esi
cmp dword [ebp - 0xd4], esi
jbe 0x300424d4
lea edx, [ebp - 0xcc]
push edx
push 0x300424fc
call dword [sym.imp.ONMain.DLL_bool___stdcall_MsoCF::Strings::IsWzPrefixOfWz_IgnoreCase_wchar_t_const___wchar_t_const__]
test al, al
je 0x300424d4
lea eax, [ebp + esi - 0xcc]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
mov dword [0x300b6738], eax
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x300b6738], 0xc
setge al
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret