joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412e19
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41f990
call fcn.0041cfb0
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x42078c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x420a00
push 4
mov ebx, 0x42080c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.004017f8
mov dword [esi + 0x3c], 0x420aa0
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.004017f8
mov dword [edi], 0x420aa8
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.00411917
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.00412448
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.00411917
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.00412448
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.00411917
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.00412448
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.00411917
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.00412448
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.00412448
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41b5d0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x41be00
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x41be28
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41be37
mov eax, 1
ret 4
Function at 0x1a9ccae
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push dword fs:[0x30]
pop ecx
push dword [ecx + 0xc]
pop ecx
push dword [ecx + 0x1c]
pop ecx
push dword [ecx]
pop ecx
push dword [ecx + 8]
pop eax
pop ecx
ret

Function at 0x1a9ccd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, ebx
movzx eax, word [ebx + 0x3c]
add ebx, eax
mov ebx, dword [ebx + 0x78]
add ebx, edx
or edi, edi
je 0x1a9cd36
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x20]
add esi, edx
push ebx
xor ebx, ebx
lodsd eax, dword [esi]
add eax, edx
push esi
push edi
xchg edi, esi
xchg edi, eax
lodsb al, byte [esi]
or al, al
jne 0x1a9cd15
cmp byte [edi], 0
je 0x1a9cd1e
jmp 0x1a9cd1c
cmp byte [edi], al
jne 0x1a9cd1c
inc edi
jmp 0x1a9cd09
mov al, 1
pop edi
pop esi
or al, al
je 0x1a9cd27
inc ebx
loop 0x1a9cd01
xchg ebx, eax
pop ebx
mov esi, dword [ebx + 0x24]
add esi, edx
inc eax
shl eax, 1
add esi, eax
movzx ecx, word [esi]
mov esi, dword [ebx + 0x1c]
add esi, edx
sub ecx, dword [ebx + 0x10]
xchg ecx, eax
shl eax, 2
add esi, eax
mov eax, dword [esi]
add eax, edx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x6c1a7536
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data_1
mov ebx, 0x42f314
nop
mov ecx, 0x29973823
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x13a5ae36
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], 1
mov eax, dword [0x13a6e004]
mov esi, 0x13a6e004
mov ebx, 0x13a01620
cmp eax, esi
je 0x13a5ae91
test dword [eax + 0x1c], 0x200
je 0x13a5ae91
cmp byte [eax + 0x19], 4
jb 0x13a5ae91
push ebx
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x13a5aefc
lea eax, [ebp - 0x414]
push eax
push 0
push 0x13a016f4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x13a5af04
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x13a5af5e
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x41c]
call fcn.13a66477
mov edi, eax
test edi, edi
jge 0x13a5af70
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a5af4b
test dword [eax + 0x1c], 0x200
je 0x13a5af4b
cmp byte [eax + 0x19], 2
jb 0x13a5af4b
push edi
push 0x13a01464
push ebx
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58ce7
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x70000
movzx eax, di
je 0x13a5af5e
mov eax, edi
test eax, eax
je 0x13a5af70
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
and dword [ebp - 0x418], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret 8
Function at 0x13a606c9
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x13a606e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x13a6e184], eax
jmp 0x13a6070d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x13a6e184]
cmp eax, 0xc8
jbe 0x13a6070c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x34]
call esi
mov dword [0x13a6e184], eax
pop esi
pop ebp
ret 8

Function at 0x13a622c4
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x28], 0x10
mov eax, dword [0x13a6e004]
mov edi, 0x13a6e004
cmp eax, edi
je 0x13a6230e
test byte [eax + 0x1c], 2
je 0x13a6230e
cmp byte [eax + 0x19], 5
jb 0x13a6230e
push 0x13a024bc
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
test esi, esi
jne 0x13a6231a
xor eax, eax
inc eax
jmp 0x13a623c0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x13a6231f
sub eax, edx
sar eax, 1
je 0x13a62312
mov ecx, esi
mov eax, 0x13a0253c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x13a6235c
test dx, dx
je 0x13a62358
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x13a6235c
add eax, 4
add ecx, 4
test dx, dx
jne 0x13a62336
xor eax, eax
jmp 0x13a62361
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x13a62312
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x13a623ae
mov eax, dword [0x13a6e004]
cmp eax, edi
je 0x13a623aa
test byte [eax + 0x1c], 2
je 0x13a623aa
cmp byte [eax + 0x19], 2
jb 0x13a623aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x13a6e004]
push 0x13a024bc
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
xor eax, eax
jmp 0x13a623c0
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.13a619a5
leave
ret 4
Function at 0x13a624b9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov eax, dword [0x13a6e004]
mov edi, 0x13a6e004
cmp eax, edi
je 0x13a624ec
test byte [eax + 0x1c], 2
je 0x13a624ec
cmp byte [eax + 0x19], 5
jb 0x13a624ec
push 0x13a024bc
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
push 0x25
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x13a6253b
push dword [ebp + 8]
call fcn.13a6240e
test eax, eax
jne 0x13a6261b
mov eax, dword [0x13a6e004]
cmp eax, edi
je 0x13a62534
test byte [eax + 0x1c], 2
je 0x13a62534
cmp byte [eax + 0x19], 2
jb 0x13a62534
push 0x13a024bc
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
xor eax, eax
jmp 0x13a6261b
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x13a62592
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x13a6e004]
cmp ecx, edi
je 0x13a62617
test byte [ecx + 0x1c], 2
je 0x13a62617
cmp byte [ecx + 0x19], 2
jb 0x13a62617
push eax
push 0x13a024bc
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.13a5a529
jmp 0x13a62617
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.13a6391c
mov dword [ebp - 4], eax
test eax, eax
jne 0x13a625cc
mov eax, dword [0x13a6e004]
cmp eax, edi
je 0x13a62617
test byte [eax + 0x1c], 2
je 0x13a62617
cmp byte [eax + 0x19], 2
jb 0x13a62617
push 0x13a024bc
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
jmp 0x13a62617
push ebx
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x13a625e0
cmp eax, ebx
ja 0x13a625e0
mov eax, dword [ebp - 4]
jmp 0x13a62619
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x13a6e004]
cmp ecx, edi
je 0x13a6260f
test byte [ecx + 0x1c], 2
je 0x13a6260f
cmp byte [ecx + 0x19], 2
jb 0x13a6260f
push eax
push 0x13a024bc
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.13a5a529
push dword [ebp - 4]
call fcn.13a639b4
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x13a62a01
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x13a62a24
xor eax, eax
jmp 0x13a62a7f
push 0x40
call fcn.13a65818
test eax, eax
je 0x13a62a20
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x13a0266c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x13a62a67
cmp eax, esi
ja 0x13a62a67
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 8
push eax
push edi
call dword [sym.imp.USER32.dll_WinHelpW]
xor eax, eax
jmp 0x13a62a7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x13a02620
call fcn.13a64941
pop ecx
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.13a619a5
leave
ret 8

Function at 0x13a62a93
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x13a6e004]
mov esi, 0x13a6e004
mov ebx, 0x13a0255c
cmp eax, esi
je 0x13a62b00
test byte [eax + 0x1c], 2
je 0x13a62b00
cmp byte [eax + 0x19], 5
jb 0x13a62b00
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x214], eax
test eax, eax
jge 0x13a62b51
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a62b48
test byte [eax + 0x1c], 2
je 0x13a62b48
cmp byte [eax + 0x19], 2
jb 0x13a62b48
push dword [ebp - 0x214]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
movzx eax, word [ebp - 0x214]
jmp 0x13a62b91
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.13a66477
mov edi, eax
test edi, edi
jge 0x13a62b9a
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a62b8e
test byte [eax + 0x1c], 2
je 0x13a62b8e
cmp byte [eax + 0x19], 2
jb 0x13a62b8e
movzx ecx, di
push ecx
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x13a62ba4
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret 0xc
Function at 0x13a62bc0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor ebx, ebx
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
xor eax, eax
mov dword [ebp - 0x630], 0x20a
cmp edi, ebx
je 0x13a62dcc
push 1
push 1
push 0x13a025e4
push 0x80000001
mov word [edi], ax
call fcn.13a64bbf
mov esi, eax
cmp esi, ebx
je 0x13a62dca
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x13a025c8
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x13a01460
test ebx, ebx
je 0x13a62cab
cmp ebx, 2
jne 0x13a62dca
mov dword [ebp - 0x628], 0x13a02734
jmp 0x13a62d0a
cmp dword [ebp - 0x62c], 1
je 0x13a62cc1
cmp dword [ebp - 0x62c], 2
jne 0x13a62dca
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x628], ecx
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x13a62d0a
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x13a62d0a
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.13a58deb
test eax, eax
jl 0x13a62dc0
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 5
call fcn.13a62a93
test eax, eax
jne 0x13a62d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x13a026f8
call fcn.13a64941
pop ecx
pop ecx
jmp 0x13a62dca
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.13a66477
xor ebx, ebx
cmp eax, ebx
jl 0x13a62dc0
mov eax, dword [ebp - 0x628]
cmp word [eax], 0x5c
je 0x13a62d69
push esi
push dword [ebp + 0xc]
push edi
call fcn.13a58deb
cmp eax, ebx
jl 0x13a62dc0
push dword [ebp - 0x628]
push dword [ebp + 0xc]
push edi
call fcn.13a58deb
cmp eax, ebx
jl 0x13a62dc0
lea eax, [ebp - 0x624]
push eax
push 0x13a026c4
push ebx
push ebx
push 0x8005
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, ebx
jl 0x13a62dc0
push 0x93d
push 0x13a02680
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebx
jl 0x13a62dc0
push edi
call fcn.13a62625
xor eax, eax
inc eax
jmp 0x13a62dcc
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret 8
Function at 0x13a64896
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x13a027bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x13a648c1
xor eax, eax
leave
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x13a028c8
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x13a648ee
cmp dword [ebp - 0x10], 4
je 0x13a648f2
and dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x13a64941
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x13a6e6dc], 0
jne 0x13a64991
call fcn.13a64896
mov dword [0x13a6e10c], eax
mov dword [0x13a6e6dc], 1
cmp dword [0x13a6e10c], 0
jle 0x13a64a2f
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.13a64905
test eax, eax
jl 0x13a64a2f
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x13a649c3
sub eax, edx
sar eax, 1
mov ecx, 0x3fd
cmp eax, ecx
jae 0x13a649f3
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x13a649e3
sub eax, edx
sar eax, 1
jmp 0x13a649f5
mov eax, ecx
add eax, eax
cmp word [ebp + eax - 0x806], 0xa
je 0x13a64a22
push 0xd
pop ecx
mov word [ebp + eax - 0x804], cx
push 0xa
pop ecx
mov word [ebp + eax - 0x802], cx
xor ecx, ecx
mov word [ebp + eax - 0x800], cx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.13a619a5
leave
ret
Function at 0x13a64c65
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], 4
mov dword [ebp - 8], esi
mov eax, dword [0x13a6e004]
mov edi, 0x13a6e004
cmp eax, edi
je 0x13a64ca7
test byte [eax + 0x1c], 2
je 0x13a64ca7
cmp byte [eax + 0x19], 5
jb 0x13a64ca7
push 0x13a0290c
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x13a64cf0
mov eax, dword [0x13a6e004]
cmp eax, edi
je 0x13a64d67
test byte [eax + 0x1c], 2
je 0x13a64d67
cmp byte [eax + 0x19], 2
jb 0x13a64d67
push ebx
push 0x13a0290c
push 0xf
jmp 0x13a64d5c
cmp dword [ebp - 4], 4
je 0x13a64d24
mov eax, dword [0x13a6e004]
cmp eax, edi
je 0x13a64d1d
test byte [eax + 0x1c], 2
je 0x13a64d1d
cmp byte [eax + 0x19], 2
jb 0x13a64d1d
push 0x13a0290c
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
mov ebx, 0x3f1
jmp 0x13a64d67
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x13a64d67
mov eax, dword [0x13a6e004]
cmp eax, edi
je 0x13a64d67
test byte [eax + 0x1c], 2
je 0x13a64d67
cmp byte [eax + 0x19], 2
jb 0x13a64d67
push ebx
push 0x13a0290c
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x13a655b0
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
xor eax, eax
push edi
push edi
cmp ebx, edi
setne al
push 3
push edi
mov ecx, ebx
neg ecx
sbb ecx, ecx
mov dword [esi], edi
push eax
mov eax, 0xc0000000
and ecx, eax
add ecx, eax
push ecx
push dword [ebp + 8]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.13a6518c
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x13a655f8
xor eax, eax
jmp 0x13a65663
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push edi
add eax, ecx
push eax
xor eax, eax
cmp ebx, edi
sete al
push edi
lea eax, [eax + eax + 2]
push eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x13a65631
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x13a655f4
xor ecx, ecx
push edi
cmp ebx, edi
setne cl
push edi
push edi
push edi
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x13a65660
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x13a655f4
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x13a6566f
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x120], 0
push ebx
push esi
push edi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x13a6e004]
mov esi, 0x13a6e004
push 2
mov edi, 0x13a02c60
pop ebx
cmp eax, esi
je 0x13a656d3
test byte [eax + 0x1c], bl
je 0x13a656d3
cmp byte [eax + 0x19], 5
jb 0x13a656d3
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x13a65722
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a6571b
test byte [eax + 0x1c], bl
je 0x13a6571b
cmp byte [eax + 0x19], bl
jb 0x13a6571b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x13a6e004]
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
xor eax, eax
jmp 0x13a657cf
cmp dword [ebp - 0x110], ebx
je 0x13a6574e
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a6571b
test byte [eax + 0x1c], bl
je 0x13a6571b
cmp byte [eax + 0x19], 3
jb 0x13a6571b
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
jmp 0x13a6571b
cmp dword [ebp - 0x11c], 5
jae 0x13a65770
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a6571b
test byte [eax + 0x1c], bl
je 0x13a6571b
cmp byte [eax + 0x19], 3
jb 0x13a6571b
push edi
push 0xe
jmp 0x13a65741
mov eax, dword [ebp - 8]
test al, 0x40
je 0x13a65789
xor eax, eax
cmp byte [ebp - 6], 1
setne al
dec eax
and eax, 0xffffffe0
add eax, 0x40
jmp 0x13a657cf
test eax, 0x200
je 0x13a65795
xor eax, eax
inc eax
jmp 0x13a657cf
test bl, al
je 0x13a6579d
push 8
jmp 0x13a657ce
test al, al
jns 0x13a657a5
push 0x10
jmp 0x13a657ce
test eax, 0x400
je 0x13a657b3
mov eax, 0x80
jmp 0x13a657cf
cmp byte [ebp - 6], 1
jne 0x13a657bd
mov eax, ebx
jmp 0x13a657cf
cmp byte [ebp - 6], 3
je 0x13a657cc
cmp byte [ebp - 6], bl
jne 0x13a6571b
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret