joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6534d17b
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x94
push ebx
push esi
mov esi, dword [esp + 0xa4]
push edi
mov edi, dword [esp + 0xa4]
push eax
push esi
push edi
call fcn.6534d23f
mov eax, esi
mov ebx, 1
sub eax, 0
je 0x6534d210
dec eax
jne 0x6534d205
lea eax, [esp + 0xc]
mov dword [0x653c3018], edi
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x1c]
cmp eax, 2
jne 0x653687f8
mov ecx, dword [esp + 0x18]
mov dword [0x653c32a0], ecx
push edi
call fcn.6534e39a
add esp, 4
call fcn.6534e3cd
call fcn.6534e411
xor ebx, ebx
test eax, eax
setge bl
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret 0xc
sub eax, 2
je 0x653687ab
jmp 0x6534d231
call fcn.6535149f
mov edx, dword [section..data]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
call esi
test eax, eax
jne 0x6536880b
call fcn.653514e3
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x94
ret 0xc
mov ecx, dword [section..data]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ecx
call esi
test eax, eax
je 0x6534d231
mov edx, dword [section..data]
push edx
call esi
test byte [eax + 0xc], bl
je 0x653687e5
push 0
call sub.ole32.dll_CoSetState
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret 0xc
call fcn.653512d4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret 0xc
cmp eax, ebx
jne 0x6534d1dd
mov dword [0x653c3008], ebx
jmp 0x6534d1dd
mov eax, dword [section..data]
push eax
call esi
test byte [eax + 0xc], bl
je 0x65368832
push 0
call sub.ole32.dll_CoSetState
call fcn.653514e3
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret 0xc
call fcn.653512d4
jmp 0x6534d22c

Function at 0x6534d4d6
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.6534d53a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x653c6010], eax
je 0x6537227a
push 0x74
push 1
call fcn.6534d565
mov esi, eax
add esp, 8
test esi, esi
je 0x6537227a
mov eax, dword [0x653c6010]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x6537227a
push esi
call fcn.6534d74b
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x6534d75e
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x653c61b8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x6534d791
call edi
mov esi, eax
test esi, esi
je 0x6537265b
mov eax, 1
mov dword [0x653c61b8], eax
cmp eax, 1
jne 0x6537269e
test esi, esi
je 0x6537266d
cmp word [esi], 0
mov eax, esi
je 0x6534d7bc
add eax, 2
cmp word [eax], 0
jne 0x6534d7aa
add eax, 2
cmp word [eax], 0
jne 0x6534d7aa
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x65372690
push edi
call fcn.6534d81c
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x65372690
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x65372680
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call ebp
mov ebx, eax
test ebx, ebx
je 0x65372679
mov eax, 2
jmp 0x6534d78c
call edi
mov esi, eax
test esi, esi
jne 0x6534d7a2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.6534ddb0
add esp, 4
xor ebx, ebx
jmp 0x6534d80e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x65372679
test ebx, ebx
jne 0x653726af
call ebp
mov ebx, eax
test ebx, ebx
je 0x65372679
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x653726c7
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x653726b7
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x653726b7
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.6534d81c
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x653726e9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x6534e872
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x653c3008], 0
push esi
push edi
jne 0x6536cd06
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
pop edi
pop esi
leave
ret 0x10
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0xc]
call fcn.6534ec34
test eax, eax
jne 0x6536cd55
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
je 0x6536cd3e
mov ecx, dword [ebp + 0xc]
call fcn.6534ecce
mov eax, edi
jmp 0x6534e897
push dword [ebp - 4]
call fcn.6534322a
mov edi, eax
pop ecx
test edi, edi
jne 0x6536cd5d
mov ecx, dword [ebp + 0xc]
call fcn.6534ecce
push 0xe
pop eax
jmp 0x6534e897
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x6536cd94
mov esi, dword [ebp + 0x14]
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp - 4]
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
shl eax, 1
mov dword [esi], eax
jne 0x6536cd94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
push edi
call fcn.6534329a
pop ecx
mov ecx, dword [ebp + 0xc]
call fcn.6534ecce
mov eax, dword [ebp + 8]
jmp 0x6534e897
Function at 0x6534edb8
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x6536e390
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x6536e382
mov eax, dword [ebp + 0x10]
push edi
sub dword [ebp + 0xc], eax
push edi
push edi
push 2
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, edi
je 0x6536e390
mov ecx, dword [0x653c7c10]
cmp ecx, edi
je 0x6534ee7e
mov eax, dword [ebp + 0x10]
xor edx, edx
div ecx
sub dword [ebp + 0x10], edx
cmp dword [ebp + 0x14], edi
mov dword [ebp - 4], edx
jne 0x6534ee96
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x6536e3ad
push 0x1c
call fcn.6534322a
mov esi, eax
pop ecx
test esi, esi
je 0x6536e3ce
mov ecx, esi
call fcn.6534ee9b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [ecx], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x10]
mov dword [0x653c7c10], ecx
jmp 0x6534ee0e
add dword [ebp + 0x14], edx
jmp 0x6534ee20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x6534ede5
mov eax, dword [ebp + 0x18]
push 0x14
mov dword [eax], edi
call fcn.6534322a
mov esi, eax
pop ecx
cmp esi, edi
jne 0x6536e3b6
mov eax, 0x8007000e
jmp 0x6534ee79
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6536e390
mov ecx, esi
call fcn.653a97f1
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
jmp 0x6534ee72
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6536e3a3

Function at 0x6534fa83
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
test edx, edx
jbe 0x6534fa99
mov eax, dword [esp + 8]
xor ecx, dword [eax]
add eax, 4
dec edx
jne 0x6534fa91
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x65351533
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.6534e1be
mov eax, dword [0x653c7c44]
mov ebp, dword [esp + 0x10]
cmp eax, 1
je 0x65372252
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x653c3298], 1
mov byte [0x653c7c40], bl
jne 0x653515a7
mov ecx, dword [0x653c663c]
test ecx, ecx
je 0x65351595
mov esi, dword [0x653c6638]
sub esi, 4
cmp esi, ecx
jb 0x65351595
mov eax, dword [esi]
test eax, eax
je 0x6535158e
call eax
mov ecx, dword [0x653c663c]
sub esi, 4
cmp esi, ecx
jae 0x65351580
push 0x653c7c34
push 0x653c7c2c
call fcn.6534e073
add esp, 8
push 0x653c7c3c
push 0x653c7c38
call fcn.6534e073
add esp, 8
test ebx, ebx
je 0x65372265
call fcn.6534e210
pop esi
pop ebp
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x6535154d
push ebp
mov dword [0x653c7c44], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x65352cf2
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [section..data]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
test esi, esi
je 0x6536a3db
xor eax, eax
test eax, eax
jne 0x6536a3f8
mov eax, dword [esi + 0x120]
add esi, 0x120
test eax, eax
je 0x65352d33
mov eax, dword [esp + 0xc]
mov edx, dword [esi]
mov dword [eax], edx
xor eax, eax
pop edi
pop esi
ret
push esi
push 0xd90
call fcn.65353f67
test eax, eax
jne 0x6536a403
mov edi, dword [esi]
mov ecx, 0x364
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x65352d26
call fcn.65353daf
test eax, eax
jl 0x65352d30
mov ecx, dword [section..data]
push ecx
call edi
mov esi, eax
jmp 0x65352d0c
jge 0x65352d16
jmp 0x65352d30
jge 0x65352d46
jmp 0x65352d30

Function at 0x65353a82
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x653c3008]
sub esp, 0x200
test eax, eax
jne 0x6536ba16
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x20c]
mov edx, dword [esp + 0x208]
push eax
mov eax, dword [esp + 0x208]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add esp, 0x200
ret 0x10
mov edx, dword [esp + 0x208]
mov eax, dword [esp + 0x204]
lea ecx, [esp]
push 0x200
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x6536ba5b
mov ecx, dword [esp + 0x210]
mov edx, dword [esp + 0x20c]
push ecx
push edx
lea eax, [esp + 8]
push 0xffffffffffffffff
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x200
ret 0x10
Function at 0x65353b7b
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x2c]
push edi
push 0x65353cc0
xor edi, edi
and esi, 0x7fffffff
mov dword [ebx + 0xd7c], 0x7ed
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x65353ca8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
jne 0x653672e4
lea ecx, [esp + 0x2c]
push ecx
push 1
push edi
push 0x65353cd0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x65367320
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x18
ret
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x30]
push ecx
push edi
or esi, 0x20000030
push edi
push esi
push 1
push edx
mov dword [esp + 0x48], edi
call eax
mov eax, dword [esp + 0x30]
cmp eax, 0x2710
jae 0x65353bda
movsx eax, ax
mov dword [ebx + 0xd7c], eax
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea edx, [esp + 0x18]
push 0xa
push edx
push 1
mov dword [esp + 0x3c], 0xa
call fcn.653b61f5
add esp, 0xc
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x34]
push edx
lea eax, [esp + 0x24]
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x2c]
mov edi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x28], 1
jne 0x65353bda
lea eax, [esp + 0xc]
push eax
call fcn.65353af4
add esp, 4
cmp eax, 0x2710
jae 0x65353bda
movsx ecx, ax
mov dword [ebx + 0xd7c], ecx
jmp 0x65353bda

Function at 0x65353daf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x65353dcd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.ole32.dll_CoGetMalloc]
test eax, eax
jne 0x6536ea3c
mov eax, dword [ebp - 4]
push 0x124
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
je 0x6536ea46
push 0x49
xor eax, eax
pop ecx
mov edi, esi
push esi
push dword [section..data]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x6536ea5b
lea edi, [esi + 4]
push edi
call fcn.65353e56
mov ebx, eax
pop ecx
test ebx, ebx
jl 0x6536ea73
call fcn.65353eb1
test eax, eax
je 0x65353dc6
push 0x653c79b0
call sub.ole32.dll_CoSetState
mov ebx, eax
test ebx, ebx
jl 0x6536ea6c
or dword [esi + 0xc], 1
jmp 0x65353dc6
mov eax, 0x8007000e
jmp 0x65353dc8
mov ebx, 0x8007000e
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, ebx
jmp 0x65353dc8
mov ebx, 0x8007000e
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x6536ea4b
mov ecx, dword [edi]
call fcn.65351387
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x6536ea60
Function at 0x65353f67
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [section..data]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
test eax, eax
je 0x65369eba
xor eax, eax
test eax, eax
jl 0x65369ed1
mov edx, dword [section..data]
push edx
call esi
mov ecx, dword [eax]
xor eax, eax
test eax, eax
jne 0x65369eda
mov edx, dword [esp + 8]
mov eax, dword [ecx]
push edx
push ecx
xor esi, esi
call dword [eax + 0xc]
test eax, eax
je 0x65369ee5
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, esi
pop esi
ret 8
call fcn.65353daf
test eax, eax
jl 0x65369ed1
mov ecx, dword [section..data]
push ecx
call esi
jmp 0x65353f7e
mov ecx, dword [esp + 8]
jmp 0x65353f95
jge 0x65353f9d
jmp 0x65353fba
mov esi, 0x8007000e
jmp 0x65353fb2

Function at 0x65357fb3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [0x653c3008], ebx
push esi
jne 0x6536cb20
mov esi, dword [ebp + 8]
mov word [ebp - 4], 0x5c
mov word [ebp - 2], bx
mov ax, word [esi]
mov word [ebp - 8], ax
mov ax, word [esi + 2]
mov word [ebp - 6], ax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x6536cbf7
mov eax, 0x8ca
pop esi
pop ebx
leave
ret 0xc
push ebx
push ebx
lea eax, [ebp + 8]
push 4
push eax
push 2
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x6536cb43
mov eax, 0xea
jmp 0x65358000
lea eax, [ebp + 8]
mov byte [ebp + 0xa], 0x5c
push eax
mov byte [ebp + 0xb], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
mov byte [ebp + 0xa], bl
je 0x65357ffb
cmp eax, 5
je 0x65357ffb
cmp eax, 6
je 0x65357ffb
cmp eax, 2
je 0x65357ffb
cmp dword [0x653c7c28], ebx
jne 0x6536cbb4
push 0x653c8618
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x653c7c28], eax
je 0x6536cc55
push str.WNetGetConnectionA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x653c90c8], eax
je 0x6536cc43
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push esi
push eax
lea eax, [ebp + 8]
push eax
call dword [0x653c90c8]
cmp eax, ebx
jne 0x65358000
push dword [esi]
lea eax, [ebp - 0x108]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and al, 0x16
add eax, 0xea
jmp 0x65358000
cmp eax, 5
je 0x65357ffb
cmp eax, 6
je 0x65357ffb
cmp eax, 2
je 0x65357ffb
cmp dword [0x653c7c28], ebx
jne 0x6536cc5f
push str.mpr.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x653c7c28], eax
je 0x6536cc55
push str.WNetGetConnectionW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x653c90c8], eax
jne 0x6536cc5f
push dword [0x653c7c28]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x653c7c28], ebx
mov eax, 0x4c6
jmp 0x65358000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [0x653c90c8]
jmp 0x65358000
Function at 0x6535826a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
xor ebx, ebx
cmp dword [0x653c3008], ebx
push esi
push edi
mov dword [ebp - 4], 0x208
jne 0x6536da92
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x653582cb
mov ecx, dword [ebp + 0x18]
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 4]
cmp ecx, edx
jne 0x653582cb
mov edi, dword [ebp + 0x14]
lea esi, [ebp - 0x418]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x653582cb
pop edi
pop esi
pop ebx
leave
ret 0x14
mov eax, dword [ebp + 0x18]
add eax, eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x653582c4
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x14]
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x6536db08
push ebx
push ebx
lea eax, [ebp - 0x10c]
push 0x104
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push ebx
call esi
test eax, eax
je 0x6536db08
cmp dword [ebp + 0xc], ebx
je 0x6536db72
push dword [ebp + 0xc]
call fcn.6534142b
pop ecx
mov edi, eax
push ebx
push ebx
inc edi
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
cmp eax, ebx
je 0x6536db08
push ebx
push ebx
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
jne 0x6536db0f
xor eax, eax
jmp 0x653582c4
lea eax, [ebp - 0x210]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x6536db53
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], ecx
jne 0x6536db53
lea edi, [ebp - 0x10c]
lea esi, [ebp - 0x418]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x653582c4
push dword [ebp - 8]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x653582c4
mov dword [ebp + 0xc], ebx
jmp 0x6536db18
Function at 0x6535849c
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xac
push esi
push edi
mov edi, 0x653c7db4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x28
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xbc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x42]
push ecx
push edx
call fcn.653585a9
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x653c7dc8]
repne scasb al, byte es:[edi]
mov eax, dword [0x653c7dc0]
mov ecx, dword [0x653c7dc4]
dec edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [esp + 8], 0x27
mov dword [edi], eax
mov eax, dword [0x653c7dcc]
mov dword [edi + 4], ecx
mov cx, word [0x653c7dd0]
mov dword [edi + 8], edx
lea edx, [esp + 8]
push edx
mov dword [edi + 0xc], eax
lea eax, [esp + 0x10]
push eax
mov word [edi + 0x10], cx
lea ecx, [esp + 0x3c]
push ecx
push 0x80000000
call esi
test eax, eax
jne 0x653688cd
lea edx, [esp + 0xc]
push 0x65364828
push edx
call fcn.653585e0
add esp, 8
test eax, eax
je 0x6536890b
lea eax, [esp + 0xc]
push 0x65364850
push eax
call fcn.653585e0
add esp, 8
test eax, eax
jne 0x65368940
mov ecx, dword [esp + 0xbc]
mov edx, dword [0x65346a48]
mov eax, dword [0x65346a4c]
mov dword [ecx], edx
mov edx, dword [0x65346a50]
mov dword [ecx + 4], eax
mov eax, dword [0x65346a54]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
xor eax, eax
pop edi
pop esi
add esp, 0xac
ret
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
mov byte [esp + ecx + 0x36], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
push 0x80000000
call esi
test eax, eax
je 0x65358542
mov eax, 0x80040155
pop edi
pop esi
add esp, 0xac
ret
mov eax, dword [esp + 0xbc]
mov ecx, dword [0x65346a08]
mov edx, dword [0x65346a0c]
mov dword [eax], ecx
mov ecx, dword [0x65346a10]
mov dword [eax + 4], edx
mov edx, dword [0x65346a14]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
xor eax, eax
pop edi
pop esi
add esp, 0xac
ret
pop edi
mov eax, 0x80004005
pop esi
add esp, 0xac
ret
Function at 0x6535898a
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
push ebx
push esi
push edi
mov edi, str.Interface_
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x27
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x64]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ebx, 0x8002801d
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2e]
push ecx
push edx
call fcn.653585a9
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [0x653c7e14]
repne scasb al, byte es:[edi]
mov eax, dword [0x653c7e0c]
mov ecx, dword [0x653c7e10]
dec edi
mov dword [edi], eax
lea eax, [esp + 0x60]
push eax
mov dword [edi + 4], ecx
lea ecx, [esp + 0x24]
push ecx
push 0x80000000
mov byte [edi + 8], dl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x65358aa8
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x68]
push edx
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x65358a9d
mov esi, dword [esp + 0x74]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x64]
mov dword [esp + 0x64], 0x14
mov dword [esi], eax
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x65358a9b
lea edx, [esp + 0x74]
push 0x10
lea eax, [esp + 0x10]
push edx
push eax
call fcn.65358ab1
mov ecx, dword [esp + 0x80]
add esp, 0xc
cmp byte [ecx], 0x2e
jne 0x65358a9b
mov edx, dword [esp + 0x6c]
push 0x10
inc ecx
push 0
push ecx
mov word [edx], ax
call fcn.65358ab1
mov ecx, dword [esp + 0x7c]
add esp, 0xc
mov dword [esi], 1
mov word [ecx], ax
xor ebx, ebx
mov edx, dword [esp + 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x50
ret

Function at 0x65358c48
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
or ecx, 0xffffffff
xor eax, eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x2c]
push 0x10
dec ecx
push eax
push esi
mov edi, ecx
call fcn.65358ab1
mov ecx, dword [esp + 0x38]
add edi, esi
add esp, 0xc
cmp ecx, edi
jne 0x65368a80
lea ecx, [esp + 8]
push 0x20
push ecx
push 0x80000001
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x65368a80
mov eax, 1
pop edi
pop esi
add esp, 0x20
ret
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret