joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103aa39
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov edi, 0x1002380
cmp eax, esi
je 0x103aa7e
test byte [eax + 0x1c], 4
je 0x103aa7e
cmp byte [eax + 0x19], 5
jb 0x103aa7e
push edi
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
mov eax, dword [0x1078100]
push dword [eax + 0x5c]
and dword [ebp - 0x460], 0
push 0x1002d68
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01009a76
add esp, 0x10
test eax, eax
jge 0x103aad7
mov ecx, dword [0x1075004]
cmp ecx, esi
je 0x103aad0
test byte [ecx + 0x1c], 4
je 0x103aad0
cmp byte [ecx + 0x19], 2
jb 0x103aad0
push eax
push edi
push 0x3c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
xor eax, eax
jmp 0x103ac64
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp eax, 0xffffffff
jne 0x103ab2a
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103ab22
test byte [eax + 0x1c], 4
je 0x103ab22
cmp byte [eax + 0x19], 3
jb 0x103ab22
mov ecx, dword [0x1078100]
push dword [ecx + 0x5c]
push edi
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100915e
xor eax, eax
inc eax
jmp 0x103ac64
lea eax, [ebp - 0x430]
push eax
mov eax, dword [0x1078100]
push dword [eax + 0x5c]
lea eax, [ebp - 0x20c]
push 0x10019a0
push ebx
push eax
call fcn.01009a76
add esp, 0x14
test eax, eax
jge 0x103ab85
mov ecx, dword [0x1075004]
cmp ecx, esi
je 0x103abf5
test byte [ecx + 0x1c], 4
je 0x103abf5
cmp byte [ecx + 0x19], 2
jb 0x103abf5
push eax
push edi
push 0x3e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
jmp 0x103abf5
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103abaf
test byte [eax + 0x1c], 4
je 0x103abaf
cmp byte [eax + 0x19], 5
jb 0x103abaf
lea ecx, [ebp - 0x20c]
push ecx
push edi
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100915e
lea eax, [ebp - 0x20c]
push eax
call fcn.0103a828
test eax, eax
jne 0x103abff
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103abf5
test byte [eax + 0x1c], 4
je 0x103abf5
cmp byte [eax + 0x19], 2
jb 0x103abf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [0x1075004]
push edi
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091cb
mov dword [ebp - 0x460], 1
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x103ab2a
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x103ac59
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103ac59
test byte [eax + 0x1c], 4
je 0x103ac59
cmp byte [eax + 0x19], 2
jb 0x103ac59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push edi
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
xor eax, eax
cmp dword [ebp - 0x460], eax
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret
Function at 0x103b20b
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov edi, 0x1002380
cmp eax, esi
je 0x103b250
test byte [eax + 0x1c], 4
je 0x103b250
cmp byte [eax + 0x19], 5
jb 0x103b250
push edi
push 0x5c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
mov eax, dword [0x1078100]
push dword [eax + 0x5c]
and dword [ebp - 0x460], 0
push 0x1002d7c
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01009a76
add esp, 0x10
test eax, eax
jge 0x103b2a9
mov ecx, dword [0x1075004]
cmp ecx, esi
je 0x103b2a2
test byte [ecx + 0x1c], 4
je 0x103b2a2
cmp byte [ecx + 0x19], 2
jb 0x103b2a2
push eax
push edi
push 0x5d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
xor eax, eax
jmp 0x103b436
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp eax, 0xffffffff
jne 0x103b2fc
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103b2f4
test byte [eax + 0x1c], 4
je 0x103b2f4
cmp byte [eax + 0x19], 3
jb 0x103b2f4
mov ecx, dword [0x1078100]
push dword [ecx + 0x5c]
push edi
push 0x5e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100915e
xor eax, eax
inc eax
jmp 0x103b436
lea eax, [ebp - 0x430]
push eax
mov eax, dword [0x1078100]
push dword [eax + 0x5c]
lea eax, [ebp - 0x20c]
push 0x10019a0
push ebx
push eax
call fcn.01009a76
add esp, 0x14
test eax, eax
jge 0x103b357
mov ecx, dword [0x1075004]
cmp ecx, esi
je 0x103b3c7
test byte [ecx + 0x1c], 4
je 0x103b3c7
cmp byte [ecx + 0x19], 2
jb 0x103b3c7
push eax
push edi
push 0x5f
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
jmp 0x103b3c7
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103b381
test byte [eax + 0x1c], 4
je 0x103b381
cmp byte [eax + 0x19], 5
jb 0x103b381
lea ecx, [ebp - 0x20c]
push ecx
push edi
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100915e
lea eax, [ebp - 0x20c]
push eax
call fcn.0103ac78
test eax, eax
jne 0x103b3d1
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103b3c7
test byte [eax + 0x1c], 4
je 0x103b3c7
cmp byte [eax + 0x19], 2
jb 0x103b3c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [0x1075004]
push edi
push 0x61
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091cb
mov dword [ebp - 0x460], 1
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x103b2fc
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x103b42b
mov eax, dword [0x1075004]
cmp eax, esi
je 0x103b42b
test byte [eax + 0x1c], 4
je 0x103b42b
cmp byte [eax + 0x19], 2
jb 0x103b42b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push edi
push 0x62
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
xor eax, eax
cmp dword [ebp - 0x460], eax
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret
Function at 0x1040f2b
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
xor edx, edx
cmp ecx, 2
sete dl
push esi
push edi
mov edi, edx
cmp ecx, 2
jne 0x1040f4d
mov eax, dword [eax + 0x15c]
mov esi, dword [eax + 0xf8]
mov eax, dword [0x1075004]
cmp eax, 0x1075004
je 0x1040f7d
test byte [eax + 0x1c], 4
je 0x1040f7d
cmp byte [eax + 0x19], 5
jb 0x1040f7d
push 0x1002eb4
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
test edi, edi
je 0x1040fa6
xor eax, eax
cmp dword [ebp + 0xc], eax
sete al
lea eax, [eax*8 + 8]
test dword [ebp + 0x10], eax
je 0x1040f9a
xor eax, eax
inc eax
jmp 0x1040fb1
push dword [ebp + 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1040fb1
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.010497e5
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x10425e3
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov edi, 0x100300c
cmp eax, esi
je 0x104261a
test byte [eax + 0x1c], 4
je 0x104261a
cmp byte [eax + 0x19], 5
jb 0x104261a
push edi
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push eax
push 0x100971f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x104266c
mov eax, dword [0x1075004]
cmp eax, esi
je 0x1042665
test byte [eax + 0x1c], 4
je 0x1042665
cmp byte [eax + 0x19], 2
jb 0x1042665
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push edi
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
xor esi, esi
jmp 0x104273e
push 0x4e20
push 0
push 3
call fcn.010242e0
push 0x2710
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10426bd
cmp eax, 0x102
jne 0x1042704
mov eax, dword [0x1075004]
cmp eax, esi
je 0x10426b6
test byte [eax + 0x1c], 4
je 0x10426b6
cmp byte [eax + 0x19], 5
jb 0x10426b6
push edi
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push 0x7530
jmp 0x1042671
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x10426ef
mov eax, dword [0x1075004]
cmp eax, esi
je 0x1042733
test byte [eax + 0x1c], 4
je 0x1042733
cmp byte [eax + 0x19], 2
jb 0x1042733
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x36
jmp 0x1042723
push dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 8], eax
sete al
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1042735
mov eax, dword [0x1075004]
cmp eax, esi
je 0x1042733
test byte [eax + 0x1c], 4
je 0x1042733
cmp byte [eax + 0x19], 2
jb 0x1042733
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x38
mov eax, dword [0x1075004]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1047d23
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov edi, 0x1003160
cmp eax, esi
je 0x1047d5e
test byte [eax + 0x1c], 4
je 0x1047d5e
cmp byte [eax + 0x19], 5
jb 0x1047d5e
push edi
push 0x8e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push 0x1046f8a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10780e4], eax
test eax, eax
jne 0x1047db6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x1075004]
cmp eax, esi
je 0x1047dab
test byte [eax + 0x1c], 4
je 0x1047dab
cmp byte [eax + 0x19], 2
jb 0x1047dab
push ebx
push edi
push 0x8f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
test ebx, ebx
je 0x1047db6
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
test ebx, ebx
pop esi
sete al
pop ebx
leave
ret
Function at 0x1049495
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov edi, 0x10042c8
cmp eax, esi
je 0x10494ca
test byte [eax + 0x1c], 4
je 0x10494ca
cmp byte [eax + 0x19], 5
jb 0x10494ca
push edi
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
mov ebx, 0x1077fe0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x18], eax
test eax, eax
jne 0x104951b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x1c], eax
mov eax, dword [0x1075004]
cmp eax, esi
je 0x1049553
test byte [eax + 0x1c], 4
je 0x1049553
cmp byte [eax + 0x19], 2
jb 0x1049553
push dword [ebp + 0x1c]
push edi
push 0x31
jmp 0x1049548
call fcn.010492e7
test eax, eax
jne 0x1049553
mov eax, dword [0x1075004]
cmp eax, esi
je 0x1049553
test byte [eax + 0x1c], 4
je 0x1049553
cmp byte [eax + 0x19], 2
jb 0x1049553
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push edi
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x18], 0
pop edi
pop esi
pop ebx
jne 0x104956c
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0x18]
pop ebp
ret 0x18
Function at 0x1055fdb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [0x1075004]
mov edi, 0x1075004
mov ebx, 0x1004d48
cmp eax, edi
je 0x1056013
test byte [eax + 0x1c], 4
je 0x1056013
cmp byte [eax + 0x19], 5
jb 0x1056013
push ebx
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push dword [esi + 0x24]
and dword [ebp - 4], 0
push 0x1004dac
push dword [ebp + 8]
call fcn.0105ff37
test eax, eax
jne 0x1056060
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1075004]
cmp eax, edi
je 0x1056187
test byte [eax + 0x1c], 4
je 0x1056187
cmp byte [eax + 0x19], 2
jb 0x1056187
push dword [ebp - 4]
push ebx
push 0x10
jmp 0x105617c
push dword [esi + 0x28]
push 0x1004d98
push dword [ebp + 8]
call fcn.0105ff37
test eax, eax
jne 0x10560a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1075004]
cmp eax, edi
je 0x1056187
test byte [eax + 0x1c], 4
je 0x1056187
cmp byte [eax + 0x19], 2
jb 0x1056187
push dword [ebp - 4]
push ebx
push 0x11
jmp 0x105617c
xor eax, eax
cmp dword [esi + 0x20], eax
setne al
push eax
push 0x1004d84
push dword [ebp + 8]
call fcn.0105ff37
test eax, eax
jne 0x10560f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1075004]
cmp eax, edi
je 0x1056187
test byte [eax + 0x1c], 4
je 0x1056187
cmp byte [eax + 0x19], 2
jb 0x1056187
push dword [ebp - 4]
push ebx
push 0x12
jmp 0x105617c
cmp dword [esi + 0x20], 0
jne 0x1056138
push dword [esi + 0x1c]
push 0x1004d70
push dword [ebp + 8]
call fcn.0105ff37
test eax, eax
jne 0x1056187
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1075004]
cmp eax, edi
je 0x1056187
test byte [eax + 0x1c], 4
je 0x1056187
cmp byte [eax + 0x19], 2
jb 0x1056187
push dword [ebp - 4]
push ebx
push 0x13
jmp 0x105617c
cmp dword [esi + 0x18], 8
jb 0x1056143
mov esi, dword [esi + 4]
jmp 0x1056146
add esi, 4
push esi
push 0x1004d5c
push dword [ebp + 8]
call fcn.01060035
test eax, eax
jne 0x1056187
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [0x1075004]
cmp eax, edi
je 0x1056187
test byte [eax + 0x1c], 4
je 0x1056187
cmp byte [eax + 0x19], 2
jb 0x1056187
push dword [ebp - 4]
push ebx
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x105b701
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1071ab8
call fcn.0105b710
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10786f8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x105b4bc
cmp eax, esi
jne 0x105b4af
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x105b4bf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x105b496
xor esi, esi
inc esi
mov eax, dword [0x10786f4]
cmp eax, esi
jne 0x105b4d2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x105b501
mov eax, dword [0x10786f4]
test eax, eax
jne 0x105b4fb
mov dword [0x10786f4], esi
push 0x10015f8
push 0x10015ec
call fcn.0105b3f8
pop ecx
pop ecx
test eax, eax
je 0x105b501
jmp 0x105b625
mov dword [0x1078160], esi
mov eax, dword [0x10786f4]
cmp eax, esi
jne 0x105b525
push 0x10015e8
push 0x10015dc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10786f4], 2
cmp dword [ebp - 0x20], ebx
jne 0x105b532
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1078704], ebx
je 0x105b553
push 0x1078704
call fcn.0105be29
pop ecx
test eax, eax
je 0x105b553
push ebx
push 2
push ebx
call dword [0x1078704]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x105b625
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x105b5bd
cmp cx, bx
je 0x105b578
cmp dword [ebp - 0x1c], ebx
jne 0x105b5bd
movzx ecx, word [eax]
cmp cx, bx
je 0x105b58d
cmp cx, 0x20
ja 0x105b58d
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x105b578
test byte [ebp - 0x40], 1
je 0x105b599
movzx ecx, word [ebp - 0x3c]
jmp 0x105b59c
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x107815c], eax
cmp dword [0x1078150], ebx
jne 0x105b602
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x105b5ce
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x105b562
cmp dword [0x1078160], ebx
jne 0x105b610
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x107815c]
jmp 0x105b631
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0105b755
ret
call fcn.0105bf6e
jmp 0x105b459
Function at 0x105c2e8
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x120], esi
mov eax, dword [0x1075004]
cmp eax, 0x1075004
je 0x105c336
test byte [eax + 0x1c], 2
je 0x105c336
cmp byte [eax + 0x19], 5
jb 0x105c336
push 0x10052bc
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
push edi
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push ebx
push dword [ebp + 8]
call esi
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x105c35d
xor eax, eax
jmp 0x105c406
cmp dword [ebp + 0x18], 0
jne 0x105c36a
add eax, eax
jmp 0x105c406
test bl, 0x30
jne 0x105c406
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x105c3c6
mov eax, dword [0x1075004]
cmp eax, 0x1075004
je 0x105c356
test byte [eax + 0x1c], 2
je 0x105c356
cmp byte [eax + 0x19], 2
jb 0x105c356
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push 0x10052bc
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
jmp 0x105c356
cmp dword [ebp - 0x108], 2
jne 0x105c400
cmp dword [ebp - 0x114], 5
jb 0x105c400
push edi
push dword [ebp + 8]
call fcn.01062de3
test eax, eax
je 0x105c400
push dword [ebp + 0x18]
or ebx, 0x20
push edi
push 0
push dword [ebp - 0x120]
push ebx
push dword [ebp + 8]
call esi
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret 0x14
Function at 0x105c41c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov eax, dword [0x1075004]
cmp eax, 0x1075004
je 0x105c468
test byte [eax + 0x1c], 2
je 0x105c468
cmp byte [eax + 0x19], 5
jb 0x105c468
push 0x10052bc
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
test byte [ebp + 0xc], 0x30
mov ebx, dword [ebp + 8]
jne 0x105c4e2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x10
pop esi
push esi
lea eax, [ebp - 0x24]
push eax
push 0x58
push ebx
call edi
test eax, eax
je 0x105c4e1
test dword [ebp - 0x16], 0x800
je 0x105c4e1
push 2
lea eax, [ebp - 0x28]
push eax
push 0x20001009
push ebx
call edi
test eax, eax
je 0x105c4e1
mov eax, ebx
and eax, 0x3ff
cmp ax, 0xd
jne 0x105c4bd
test byte [ebp + 0xc], 1
je 0x105c4de
cmp dword [ebp - 0x28], 8
jmp 0x105c4dc
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x105c4de
cmp eax, 6
je 0x105c4de
cmp eax, 0x17
je 0x105c4de
cmp eax, 0xa
je 0x105c4de
cmp eax, 0xb
je 0x105c4de
cmp eax, 0xc
jne 0x105c4e1
push 0x20
pop esi
pop edi
push dword [ebp + 0x18]
or esi, dword [ebp + 0xc]
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret 0x14
Function at 0x105c715
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x28], 0x10
mov eax, dword [0x1075004]
mov edi, 0x1075004
cmp eax, edi
je 0x105c75f
test byte [eax + 0x1c], 2
je 0x105c75f
cmp byte [eax + 0x19], 5
jb 0x105c75f
push 0x10052bc
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
test esi, esi
jne 0x105c76b
xor eax, eax
inc eax
jmp 0x105c811
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x105c770
sub eax, edx
sar eax, 1
je 0x105c763
mov ecx, esi
mov eax, 0x100533c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x105c7ad
test dx, dx
je 0x105c7a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x105c7ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x105c787
xor eax, eax
jmp 0x105c7b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x105c763
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x105c7ff
mov eax, dword [0x1075004]
cmp eax, edi
je 0x105c7fb
test byte [eax + 0x1c], 2
je 0x105c7fb
cmp byte [eax + 0x19], 2
jb 0x105c7fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1075004]
push 0x10052bc
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
xor eax, eax
jmp 0x105c811
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0105b7af
leave
ret 4
Function at 0x105ca05
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov eax, dword [0x1075004]
mov edi, 0x1075004
cmp eax, edi
je 0x105ca38
test byte [eax + 0x1c], 2
je 0x105ca38
cmp byte [eax + 0x19], 5
jb 0x105ca38
push 0x10052bc
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push 0x25
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x105ca87
push dword [ebp + 8]
call fcn.0105c8ee
test eax, eax
jne 0x105cb67
mov eax, dword [0x1075004]
cmp eax, edi
je 0x105ca80
test byte [eax + 0x1c], 2
je 0x105ca80
cmp byte [eax + 0x19], 2
jb 0x105ca80
push 0x10052bc
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
xor eax, eax
jmp 0x105cb67
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x105cade
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1075004]
cmp ecx, edi
je 0x105cb63
test byte [ecx + 0x1c], 2
je 0x105cb63
cmp byte [ecx + 0x19], 2
jb 0x105cb63
push eax
push 0x10052bc
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
jmp 0x105cb63
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.0105c184
mov dword [ebp - 4], eax
test eax, eax
jne 0x105cb18
mov eax, dword [0x1075004]
cmp eax, edi
je 0x105cb63
test byte [eax + 0x1c], 2
je 0x105cb63
cmp byte [eax + 0x19], 2
jb 0x105cb63
push 0x10052bc
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
jmp 0x105cb63
push ebx
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x105cb2c
cmp eax, ebx
ja 0x105cb2c
mov eax, dword [ebp - 4]
jmp 0x105cb65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1075004]
cmp ecx, edi
je 0x105cb5b
test byte [ecx + 0x1c], 2
je 0x105cb5b
cmp byte [ecx + 0x19], 2
jb 0x105cb5b
push eax
push 0x10052bc
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
push dword [ebp - 4]
call fcn.0105c21c
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4