joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002962d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100c7edf
call fcn.100c72c2
mov edx, dword [ebp + 0x10]
xor esi, esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
pop ecx
push ecx
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10029690
call fcn.10028186
mov esi, eax
jmp 0x100297c0
push esi
push ebx
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
jne 0x100296af
call fcn.10028186
jmp 0x100297b7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x100296a5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10029706
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100296f1
lea ecx, [ebp - 0x418]
call fcn.10028148
lea ecx, [ebp - 0x420]
call fcn.1002851b
mov eax, 0x8007000e
jmp 0x100297e6
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x100297ee
cmp eax, 0xffffffff
ja 0x100297ee
cmp eax, 0x400
jbe 0x1002973a
push eax
lea ecx, [ebp - 0x418]
call fcn.1002815e
mov eax, dword [ebp - 0x418]
jmp 0x10029746
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x10029770
test eax, eax
jne 0x1002977b
mov esi, 0x8007000e
jmp 0x100297b9
push ebx
push eax
push ebx
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100296a5
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.100294d4
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100297d9
lea ecx, [ebp - 0x418]
call fcn.10028148
lea ecx, [ebp - 0x420]
call fcn.1002851b
mov eax, esi
call fcn.100c7214
ret 0x10
mov ecx, 0x80070057
call fcn.1001b9e7
int3
Function at 0x1002a64a
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100d4fa0]
push esi
push edi
test eax, eax
jne 0x1002a663
call fcn.1002a71f
test eax, eax
je 0x1002a6af
mov eax, dword [0x100d4fa0]
cmp eax, 1
jne 0x1002a67f
push 0xd
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1002a6af
jmp 0x1002a6f5
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, eax
test ecx, ecx
je 0x1002a698
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, ecx
jmp 0x1002a6f5
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1002a6b3
xor eax, eax
jmp 0x1002a6f5
mov eax, dword [esi]
push dword [0x100d4fa0]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x1002a6d9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x1002a6f5
lea edi, [esi + 0xff0]
push esi
push dword [0x100d4fa0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1002a6df
mov eax, esi
pop edi
pop esi
ret

Function at 0x1002cb1b
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0x48], 0
je 0x1002cb3b
and dword [esi + 0x48], 0
push ecx
call fcn.1002f230
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x1002d535
Capabilities:
Capture screenshot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
cmp dword [ebx + 0x10c], edi
je 0x1002d645
mov ecx, dword [ebx + 0x110]
test ecx, ecx
je 0x1002d645
mov edx, dword [ebx + 0x114]
test edx, edx
je 0x1002d645
mov eax, dword [ebx + 0x84]
sub eax, dword [ebx + 0x7c]
cmp eax, ecx
jne 0x1002d645
mov eax, dword [ebx + 0x88]
sub eax, dword [ebx + 0x80]
cmp eax, edx
jne 0x1002d645
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDC]
lea esi, [ebx + 0x120]
mov ecx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
cmp dword [ebx + 0x124], edi
jle 0x1002d60f
push ecx
mov ecx, esi
call fcn.1002f3c7
mov esi, eax
lea edi, [ebp - 0x18]
push 0xcc0020
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
push dword [ebx + 0x10c]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 4]
lea esi, [ebx + 0x120]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebx + 0x124]
jl 0x1002d5b0
mov eax, dword [ebp - 8]
lea esi, [ebx + 0x120]
xor edi, edi
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebx + 0x124], edi
jle 0x1002d63e
call fcn.1002c6d1
test al, al
je 0x1002d63e
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x1002d63e
push edi
push edi
push dword [eax]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.10025287
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ecx + 0x10]
push esi
push edi
mov edi, dword [ecx + 8]
test eax, eax
jns 0x1003a8a8
lea ecx, [ebx - 1]
imul ecx, eax
add edi, ecx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
imul esi, ebx
add esi, edi
cmp edi, esi
jae 0x1003a8f0
mov ebx, 0xff
movzx ecx, byte [edi + 3]
xor edx, edx
movzx eax, byte [edi]
imul eax, ecx
div ebx
xor edx, edx
mov byte [edi], al
movzx eax, byte [edi + 1]
imul eax, ecx
div ebx
xor edx, edx
mov byte [edi + 1], al
movzx eax, byte [edi + 2]
imul eax, ecx
div ebx
mov byte [edi + 2], al
add edi, 4
cmp edi, esi
jb 0x1003a8bd
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1003b065
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100cea68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
lea edi, [ebp - 0x30]
push 0xc
setne bh
xor eax, eax
stosd dword es:[edi], eax
pop ecx
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
push ecx
push 0x42
mov dword [ebp - 0x30], ecx
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1003b0ac
test byte [ebp - 0x2c], 1
jne 0x1003b0ca
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push 2
mov esi, eax
call dword [sym.imp.USER32.dll_GetSysColor]
test esi, esi
je 0x1003b0ca
test eax, eax
je 0x1003b0ca
xor bl, bl
jmp 0x1003b0cc
mov bl, 1
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0x100cecdc], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x100cecd8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov byte [0x100d55ec], bl
xor bl, bl
mov byte [0x100d55e5], bh
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
test ax, ax
je 0x1003b135
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1003b135
test dword [ebp - 0x16], 0x800
je 0x1003b135
inc bl
mov byte [0x100d55e6], bl
mov edi, 0x100d1a40
cmp byte [0x100d55e5], 0
jne 0x1003b14e
test byte [edi], 1
jmp 0x1003b151
test byte [edi], 6
je 0x1003b18e
cmp byte [0x100d55e4], 0
jne 0x1003b161
test byte [edi], 3
jmp 0x1003b164
test byte [edi], 4
je 0x1003b18e
cmp byte [0x100d55e5], 0
jne 0x1003b1db
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x1003b1db
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x100d6738]
mov ecx, ebx
call esi
and dword [edi + 0x18], 0
jmp 0x1003b1db
mov ebx, dword [edi + 0x14]
test ebx, ebx
je 0x1003b1ab
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x100d6738]
mov ecx, ebx
call esi
and dword [edi + 0x14], 0
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x1003b1c8
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x100d6738]
mov ecx, ebx
call esi
and dword [edi + 0x18], 0
cmp dword [edi + 0x38], 0
je 0x1003b1db
push dword [edi + 0x38]
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [edi + 0x38], 0
add edi, 0x5c
cmp edi, 0x100d4b20
jl 0x1003b140
mov esi, 0x100cecf0
cmp dword [esi], 0
je 0x1003b1ff
push dword [esi]
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [esi], 0
add esi, 0x14
cmp esi, 0x100ced68
jl 0x1003b1ef
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c6890
mov esp, ebp
pop ebp
ret
Function at 0x10045fe3
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 8]
mov esi, eax
neg esi
mov dword [edi + 0x50], eax
sbb esi, esi
xor ebx, ebx
and esi, 0x7fffbffb
add esi, 0x80004005
test eax, eax
je 0x1004602a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x1004602a
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x10046048
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x20], eax
test eax, eax
jne 0x10046066
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x2c], eax
test eax, eax
jne 0x10046085
mov esi, 0x80004005
test esi, esi
js 0x10046129
lea eax, [edi + 0x14]
push eax
push 4
push edi
push 0x10046ec0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
je 0x100460bc
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100460c1
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x34], eax
test eax, eax
jne 0x100460db
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x100460f5
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x24], eax
test eax, eax
jne 0x1004610f
mov esi, 0x80004005
test esi, esi
js 0x10046129
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x28], eax
test eax, eax
jne 0x10046129
mov esi, 0x80004005
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10049c0f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [ebp - 0x40]
xor edi, edi
push eax
push 0x10009288
mov ebx, ecx
mov esi, edi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_GetClassInfoW]
test eax, eax
jne 0x10049c8c
push edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0x10049a80
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x7f00
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push 5
mov dword [ebp - 0x28], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x10009288
call dword [sym.imp.USER32.dll_RegisterClassW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push edi
push 0xfffffffffffffffd
push edi
push edi
push edi
push edi
push edi
push edi
push 0x10009288
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 0xdc], eax
test eax, eax
je 0x10049db2
push ebx
push 0x100092d0
push eax
call dword [sym.imp.USER32.dll_SetPropW]
lea eax, [ebx + 0x114]
push 1
push 0x64
mov ecx, eax
mov dword [ebp - 8], eax
call fcn.100258bd
push 0xa
push 0x5209
push dword [0x100d5398]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10049cfd
mov esi, 0x80004005
jmp 0x10049d8f
push eax
push dword [0x100d5398]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
shr edi, 2
cmp edi, 0x64
jb 0x10049d17
push 0x64
pop edi
push dword [ebp - 4]
push dword [0x100d5398]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10049d8d
test edi, edi
je 0x10049d8d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10049d84
and dword [ebp - 4], esi
test edi, edi
je 0x10049d84
mov ebx, dword [ebp - 4]
mov esi, eax
xor eax, eax
lea ecx, [ebp - 4]
mov word [ebp - 4], ax
movzx eax, word [esi + ebx*4]
push ecx
mov ecx, dword [ebp - 8]
push eax
call fcn.1004b563
test al, al
jne 0x10049d79
movzx eax, word [esi + ebx*4 + 2]
mov ecx, dword [ebp - 8]
push eax
movzx eax, word [esi + ebx*4]
push eax
call fcn.1004b599
inc ebx
cmp ebx, edi
jl 0x10049d4b
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor edi, edi
cmp dword [ebx + 0x118], edi
jne 0x10049d9c
mov esi, 0x80004005
test esi, esi
js 0x10049db7
push 0x4e22
lea ecx, [ebx + 0xb8]
call fcn.10027c9a
jmp 0x10049db7
mov esi, 0x80004005
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004daef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
test byte [0x100d4e80], 1
push edi
mov edi, ecx
je 0x1004db0d
mov edx, 0x10005ce8
call fcn.10027d7f
xor eax, eax
cmp dword [edi + 0xc], eax
jne 0x1004dbd6
push ebx
push 0xa
push 0x7724
push dword [0x100d5394]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1004dbb6
push esi
push ebx
push dword [0x100d5398]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, 0xc8
shr esi, 2
cmp esi, eax
jb 0x1004db54
mov esi, eax
push ebx
push dword [0x100d5398]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1004dbb5
test esi, esi
je 0x1004dbb5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1004dbac
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x1004dbac
cmp word [ebx], ax
je 0x1004dbac
movzx eax, word [ebx + 2]
lea ecx, [edi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push ebx
call fcn.1004dcde
mov eax, dword [ebp - 4]
add ebx, 4
inc eax
push 0
mov dword [ebp - 4], eax
cmp eax, esi
pop eax
jl 0x1004db82
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
cmp dword [edi + 0xc], 0
pop ebx
jle 0x1004dbc3
mov dword [edi], 1
test byte [0x100d4e80], 1
je 0x1004dbd6
mov edx, 0x10005c40
call fcn.10027d7f
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1005e7a6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
call fcn.1005d4a2
test al, al
jne 0x1005e7de
mov ecx, dword [0x100d5118]
call fcn.1005fcb5
test al, al
jne 0x1005e853
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
call fcn.1005fbe5
test eax, eax
je 0x1005e853
lea eax, [ebp - 8]
push eax
push 1
push ebx
push 0x1000a2b0
push SysReAllocStringLen
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e853
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 2
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1000a2cc
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1005e832
mov ax, word [ebp - 4]
cmp al, 0x2f
jbe 0x1005e832
sub al, 0x2f
mov bl, al
cmp bl, 3
jbe 0x1005e832
mov bl, 2
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp bl, 2
je 0x1005e853
test bl, bl
je 0x1005e853
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
call fcn.1006029e
jmp 0x1005e85e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
and eax, 0x3ff
mov dword [0x100d5308], eax
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005e86a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100cea68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x14]
xor edi, edi
push eax
inc edi
xor esi, esi
push edi
push esi
push 0x1000a2d8
push SysReAllocStringLen
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e93c
push ebx
push 4
pop ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x1000a2f0
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1005e8cf
cmp dword [ebp - 0x10], ebx
ja 0x1005e8cf
mov edi, dword [ebp - 0xc]
push 8
pop ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x1000a2fc
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1005e929
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
ja 0x1005e929
mov edx, esi
test ecx, ecx
je 0x1005e91f
movzx ebx, byte [ebp + edx - 0xc]
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x1005e91b
imul eax, esi, 0xa
lea esi, [ebx - 0x30]
add esi, eax
inc edx
cmp edx, ecx
jb 0x1005e901
test esi, esi
jne 0x1005e922
or esi, 0xffffffff
push esi
call dword [sym.imp.USER32.dll_SetCaretBlinkTime]
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, 0xff
pop ebx
cmp edi, eax
jge 0x1005e93e
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100c6890
mov esp, ebp
pop ebp
ret
Function at 0x10071868
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x100cea68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx edi, byte [ecx + 0x11]
mov dword [ebp - 0x400], eax
movsx eax, word [eax + 0x12]
mov dword [ebp - 0x3fc], ecx
mov ecx, dword [0x100d5674]
push eax
mov dword [ebp - 0x3f8], esi
call fcn.10067b10
mov ebx, eax
mov eax, dword [ebp - 0x3fc]
movsx ecx, word [eax + 0x12]
push ecx
mov ecx, dword [0x100d5674]
call fcn.10067b10
xor ecx, ecx
mov dword [esi], ecx
test edi, edi
je 0x10071918
lea esi, [ebx + 8]
sub ebx, eax
lea edx, [eax + 8]
mov eax, dword [ebx + edx - 8]
xor eax, dword [edx - 8]
test eax, 0xff000000
jne 0x1007190d
mov eax, dword [edx - 4]
cmp eax, dword [esi - 4]
jne 0x1007190d
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1007190d
mov al, byte [edx + 4]
cmp al, byte [esi + 4]
jne 0x1007190d
inc ecx
add esi, 0x10
add edx, 0x10
cmp ecx, edi
jl 0x100718d4
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [eax]
jmp 0x10071918
mov eax, dword [ebp - 0x3f8]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
test ecx, ecx
jne 0x10071928
mov eax, dword [ebp - 0x400]
mov ax, word [eax + 0x12]
jmp 0x100719a4
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [0x100d5674]
movsx eax, word [eax + 0x12]
push eax
call fcn.10067b10
mov ecx, edi
shl ecx, 4
push ecx
push eax
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x400]
add esp, 0xc
mov ebx, dword [0x100d5674]
mov ecx, ebx
movsx eax, word [eax + 0x12]
push eax
call fcn.10067b10
test edi, edi
je 0x10071990
lea edx, [ebp - 0x3f4]
mov esi, edi
mov ecx, dword [eax]
lea eax, [eax + 0x10]
xor ecx, dword [edx]
and ecx, 0xffffff
xor dword [edx], ecx
lea edx, [edx + 0x10]
sub esi, 1
jne 0x10071979
mov eax, edi
mov ecx, ebx
shl eax, 2
push eax
lea eax, [ebp - 0x3f4]
push eax
call fcn.10067bf0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c6890
mov esp, ebp
pop ebp
ret 8
Function at 0x100b385b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
test byte [esi + 0x48], 0x40
movzx ebx, word [esi + 0x52]
je 0x100b3872
inc ebx
cmp dword [esi], 0
je 0x100b3883
push dword [esi]
mov ecx, dword [edi + 0x3c]
mov edx, ebx
call fcn.100b15f4
cmp dword [esi + 4], 0
je 0x100b3896
push dword [esi + 4]
mov ecx, dword [edi + 0x70]
mov edx, ebx
call fcn.100b15f4
cmp dword [esi + 8], 0
je 0x100b38a9
push dword [esi + 8]
mov ecx, dword [edi + 0x40]
mov edx, ebx
call fcn.100b15f4
test byte [esi + 0x48], 2
je 0x100b38d0
mov edx, dword [esi + 0xc]
test edx, edx
je 0x100b392a
mov ecx, edi
call fcn.100b3a73
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 0x20]
sub ecx, 4
je 0x100b392a
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], ecx
jmp 0x100b392a
movzx ebx, word [esi + 0x18]
test ebx, ebx
je 0x100b3911
cmp dword [esi + 0xc], 0
je 0x100b38eb
push dword [esi + 0xc]
mov ecx, dword [edi + 0x7c]
mov edx, ebx
call fcn.100b15f4
cmp dword [esi + 0x10], 0
je 0x100b38fe
push dword [esi + 0x10]
mov ecx, dword [edi + 0x78]
mov edx, ebx
call fcn.100b15f4
cmp dword [esi + 0x14], 0
je 0x100b3911
push dword [esi + 0x14]
mov ecx, dword [edi + 0x74]
mov edx, ebx
call fcn.100b15f4
movzx eax, word [esi + 0x30]
test eax, eax
je 0x100b392a
push eax
push dword [edi + 0xdc]
lea edx, [esi + 0x1c]
mov ecx, edi
call fcn.100bb951
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x100b393f
mov edx, dword [edi + 0x34]
add ecx, 0xfffffffc
je 0x100b393f
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x100b3954
mov edx, dword [edi + 0x38]
add ecx, 0xfffffffc
je 0x100b3954
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], ecx
mov ecx, dword [edi + 0x18]
add esi, 0xfffffffc
je 0x100b3962
mov eax, dword [ecx]
mov dword [esi], eax
mov dword [ecx], esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4