joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eefd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1099264], ebx
push esi
push edi
jne 0x100ef7f
push 0x1001a5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100efba
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001a50
push edi
call esi
test eax, eax
mov dword [0x1099264], eax
je 0x100efba
push 0x1001a40
push edi
call esi
push 0x1001a2c
push edi
mov dword [0x1099268], eax
call esi
cmp dword [0x10990f8], 2
mov dword [0x109926c], eax
jne 0x100ef7f
push 0x1001a10
push edi
call esi
test eax, eax
mov dword [0x1099274], eax
je 0x100ef7f
push 0x10019f8
push edi
call esi
mov dword [0x1099270], eax
mov eax, dword [0x1099270]
test eax, eax
je 0x100efc4
call eax
test eax, eax
je 0x100efab
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1099274]
test eax, eax
je 0x100efab
test byte [ebp - 8], 1
jne 0x100efc4
cmp dword [0x1099104], 4
jb 0x100efbe
or byte [ebp + 0x12], 0x20
jmp 0x100efe3
xor eax, eax
jmp 0x100eff3
or byte [ebp + 0x12], 4
jmp 0x100efe3
mov eax, dword [0x1099268]
test eax, eax
je 0x100efe3
call eax
mov ebx, eax
test ebx, ebx
je 0x100efe3
mov eax, dword [0x109926c]
test eax, eax
je 0x100efe3
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1099264]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10102be
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x10102ef
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x10102f6
cmp ebx, dword [ebp + 8]
jae 0x10102f6
xor eax, eax
jmp 0x10104e6
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x1010307
xor eax, eax
inc eax
jmp 0x10104e5
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x101031d
cmp ecx, edx
jae 0x1010462
cmp dword [eax + 4], 0
je 0x1010326
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x101030e
cmp dword [ebp + 8], 0
je 0x1010348
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x1010462
cmp eax, esi
jae 0x1010462
mov eax, dword [0x1099280]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x101036d
cmp dword [esi*4 + 0x1099288], edi
je 0x1010466
inc esi
cmp esi, eax
jl 0x101035b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10104e2
cmp dword [ebp - 8], 0x1000000
jne 0x10104e2
test byte [ebp - 0xc], 0xcc
je 0x10103eb
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x10104e2
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10104e2
cmp word [eax + 0x18], 0x10b
jne 0x10104e2
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x10104e2
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x10103eb
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x10103eb
test byte [ecx + 0x27], 0x80
jne 0x1010462
push 1
push 0x10992c8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x10102ff
mov ecx, dword [0x1099280]
test ecx, ecx
mov edx, ecx
jle 0x101041f
lea eax, [ecx*4 + 0x1099284]
cmp dword [eax], edi
je 0x101041f
dec edx
sub eax, 4
test edx, edx
jg 0x1010413
test edx, edx
jne 0x1010450
push 0xf
pop ebx
cmp ecx, ebx
jg 0x101042c
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x1010444
lea eax, [edx*4 + 0x1099288]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x1010432
cmp ecx, 0x10
jge 0x1010450
inc ecx
mov dword [0x1099280], ecx
push 0
push 0x10992c8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x10102ff
xor eax, eax
jmp 0x10104e5
test esi, esi
jle 0x10102ff
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x10992c8
call ebx
test eax, eax
jne 0x10102ff
cmp dword [esi*4 + 0x1099288], edi
je 0x10104bc
mov eax, dword [0x1099280]
lea esi, [eax - 1]
test esi, esi
jl 0x10104aa
cmp dword [esi*4 + 0x1099288], edi
je 0x10104a6
dec esi
jns 0x101049a
test esi, esi
jge 0x10104ba
cmp eax, 0x10
jge 0x10104b5
inc eax
mov dword [0x1099280], eax
lea esi, [eax - 1]
jmp 0x10104bc
je 0x10104d4
xor ecx, ecx
test esi, esi
jl 0x10104d4
lea eax, [ecx*4 + 0x1099288]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x10104c2
push 0
push 0x10992c8
call ebx
jmp 0x10102ff
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10123f0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.0100dcb0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1012456
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x10990f8]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x101245a
xor eax, eax
jmp 0x1012467
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1013f69
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1090004]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 4
pop eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf8], eax
xor eax, eax
lea edi, [ebp - 0xdc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [ebp - 0xec]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0xf4]
push eax
xor edi, edi
push edi
push 0x1002268
push ecx
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], 0x10
call ebx
cmp dword [esi + 0x1730], edi
mov dword [ebp - 0xfc], edi
jbe 0x10141ad
lea eax, [esi + 0x570]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x101418b
mov eax, dword [esi + eax*4 + 0x232c]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0xfc]
inc eax
push eax
lea eax, [ebp - 0xcc]
push 0x1002254
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
lea eax, [ebp - 0xf0]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101418b
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xf4]
push eax
push edi
push 0x100223c
push dword [ebp - 0xf0]
call ebx
mov esi, dword [ebp - 0x104]
lea eax, [ebp - 0xf8]
push eax
lea eax, [esi + 0x2a58]
push eax
lea eax, [ebp - 0xf4]
push eax
push edi
push 0x1002224
push dword [ebp - 0xf0]
call ebx
push 4
lea edi, [esi + 0x41c]
pop ecx
lea esi, [ebp - 0xdc]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x10140e3
push 4
pop ecx
lea edi, [ebp - 0xec]
lea esi, [ebp - 0xdc]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1014177
mov esi, dword [ebp - 0x104]
lea eax, [ebp - 0xf8]
push eax
lea eax, [esi + 0x2a5c]
push eax
lea eax, [ebp - 0xf4]
push eax
xor edi, edi
push edi
push 0x1002200
push dword [ebp - 0xf0]
call ebx
lea eax, [ebp - 0xf8]
push eax
lea eax, [esi + 0x2a4c]
push eax
lea eax, [ebp - 0xf4]
push eax
push edi
push 0x10021f4
push dword [ebp - 0xf0]
call ebx
lea eax, [ebp - 0xf8]
push eax
lea eax, [esi + 0x2a50]
push eax
lea eax, [ebp - 0xf4]
push eax
push edi
push 0x10021e4
push dword [ebp - 0xf0]
call ebx
lea eax, [ebp - 0xf8]
push eax
add esi, 0x2a54
push esi
lea eax, [ebp - 0xf4]
push eax
push edi
push 0x10021d4
push dword [ebp - 0xf0]
call ebx
push dword [ebp - 0xf0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x110]
xor edi, edi
inc dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
add dword [ebp - 0x100], 0x234
cmp eax, dword [esi + 0x1730]
jb 0x1014002
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d888
leave
ret 4
Function at 0x10141c1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x1090004]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push 4
mov ebx, ecx
lea ecx, [ebx + 8]
push ecx
push 4
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1002268
push eax
mov dword [ebp - 0xdc], eax
call esi
cmp dword [ebx + 0x1730], edi
mov dword [ebp - 0xd4], edi
jbe 0x1014346
lea eax, [ebx + 0x570]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1014324
mov edi, dword [ebx + eax*4 + 0x232c]
mov eax, dword [ebp - 0xd4]
inc eax
push eax
lea eax, [ebp - 0xcc]
push 0x1002254
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
push eax
lea ecx, [ebp - 0xd0]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1014324
push 4
lea eax, [edi + 0x2a58]
push eax
push 4
push 0
push 0x1002224
push dword [ebp - 0xd0]
call esi
push 4
lea eax, [edi + 0x2a5c]
push eax
push 4
push 0
push 0x1002200
push dword [ebp - 0xd0]
call esi
push 4
lea eax, [edi + 0x2a4c]
push eax
push 4
push 0
push 0x10021f4
push dword [ebp - 0xd0]
call esi
push 4
lea eax, [edi + 0x2a50]
push eax
push 4
push 0
push 0x10021e4
push dword [ebp - 0xd0]
call esi
push 4
lea eax, [edi + 0x2a54]
push eax
push 4
push 0
push 0x10021d4
push dword [ebp - 0xd0]
call esi
push 0x10
add edi, 0x41c
push edi
push 3
push 0
push 0x100223c
push dword [ebp - 0xd0]
call esi
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
add dword [ebp - 0xd8], 0x234
cmp eax, dword [ebx + 0x1730]
jb 0x1014219
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d888
leave
ret 4
Function at 0x1015f87
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xfffffffffffffff1
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, esi
call fcn.01012eb9
mov ecx, esi
mov dword [esi + 4], eax
call fcn.01012d3f
mov eax, dword [esi + 4]
xor edi, edi
inc edi
xor ebx, ebx
cmp eax, edi
je 0x1015fd7
cmp eax, 3
je 0x1015fd7
cmp eax, 2
jne 0x1015fe8
mov ecx, esi
call fcn.0101481e
cmp eax, ebx
jge 0x1015fe8
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
cmp dword [esi + 4], edi
jne 0x1016037
push ebx
push ebx
push 0x400
push dword [esi + 0xc]
mov dword [esi + 0x18], edi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1016029
push ebx
push ebx
push dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1016030
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esi + 0x18], ebx
jne 0x1016002
jmp 0x1016037
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0xdc
call sub.d3d8.dll_Direct3DCreate8
cmp eax, ebx
mov dword [esi + 0x2354], eax
jne 0x1016057
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 0x82000001
jmp 0x10160b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
cmp eax, ebx
jl 0x101606d
mov ecx, esi
call fcn.010151af
cmp eax, ebx
jge 0x1016075
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
jmp 0x10160b6
xor edx, edx
cmp dword [esi + 0x2350], ebx
jbe 0x10160a3
lea ecx, [esi + 0x232c]
mov eax, dword [ecx]
cmp dword [eax + 0x2a40], ebx
jne 0x10160af
cmp dword [eax + 0x2a48], ebx
jne 0x10160af
inc edx
add ecx, 4
cmp edx, dword [esi + 0x2350]
jb 0x1016085
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 0x82000003
jmp 0x10160b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x1016862
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x1090004]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x118]
push eax
mov esi, ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x108], 1
sete al
xor edi, edi
cmp dword [esi + 4], 2
mov dword [esi + 0x20], eax
jne 0x101692e
cmp eax, edi
je 0x101692e
lea eax, [ebp - 0x120]
push eax
push 0x1002308
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x101692e
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x11c]
push eax
push edi
push edi
push 0x10022dc
push dword [ebp - 0x120]
mov dword [ebp - 0x124], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101692e
cmp dword [ebp - 0x11c], edi
je 0x101692e
push 0x10022c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [esi + 0x24], eax
je 0x1016922
push 0x10022ac
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x28], eax
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.01016a79
fstp st(0)
cmp dword [esi + 0x34], edi
jne 0x101695c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
cmp eax, edi
mov ecx, esi
jge 0x1016953
push 1
push eax
call fcn.01013f0f
jmp 0x10169d2
call fcn.0101651a
cmp eax, edi
jl 0x10169d2
cmp dword [esi + 4], 2
jne 0x1016974
push edi
lea eax, [ebp - 0x11c]
push eax
push 1
push 0x61
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x13c], edi
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x10169ac
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10169c7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x34], edi
mov ecx, esi
je 0x10169c2
call fcn.010137ce
jmp 0x10169c7
call fcn.01013699
cmp dword [ebp - 0x13c], 0x12
jne 0x101697a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100d888
leave
ret
Function at 0x101930a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x108aedf
call fcn.01084370
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov ecx, dword [eax + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
lea esi, [eax + 0x10]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x20], ecx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x24], ecx
mov ecx, dword [eax + 0x28]
mov dword [ebx + 0x28], ecx
mov ecx, dword [eax + 0x2c]
mov dword [ebx + 0x2c], ecx
mov cx, word [eax + 0x30]
mov word [ebx + 0x30], cx
mov cx, word [eax + 0x32]
mov word [ebx + 0x32], cx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x34], ecx
push 8
lea esi, [eax + 0x38]
pop ecx
lea edi, [ebx + 0x38]
add eax, 0x58
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x58]
call fcn.01018eca
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
add eax, 0x68
push eax
lea ecx, [ebx + 0x68]
call fcn.01018eca
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x101c1f3
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x108b18d
call fcn.01084370
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [0x10993d4]
dec ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov dword [ebp - 0x10], esi
je 0x101c20e
dec ecx
lea ecx, [eax + 0x6c]
jmp 0x101c211
lea ecx, [eax + 0x64]
mov eax, dword [edi + 4]
push ebx
xor edx, edx
mov dx, word [eax + 0x1c]
movzx eax, word [eax + 0x1e]
xor ebx, ebx
push ebx
push edx
push eax
push ebx
push dword [ecx]
mov ecx, esi
call fcn.0101c17c
mov eax, dword [ebp + 8]
mov dword [esi + 0x18], ebx
mov dword [esi], 0x1002524
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov ecx, dword [eax + 0x54]
movzx eax, word [esi + 0xc]
shr ecx, 3
mov byte [esi + 0x10], cl
movzx ecx, cl
imul eax, ecx
add eax, 7
and eax, 0xfffffff8
mov dword [esi + 8], eax
mov ecx, dword [edi + 4]
mov dword [ecx + 0x18], eax
movzx eax, word [esi + 0xe]
imul eax, dword [esi + 8]
push 0x40
push 0x1000
push eax
push ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, ebx
mov dword [esi + 0x14], eax
pop ebx
jne 0x101c2a3
push 0x108bb18
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], 0x10024f8
mov dword [ebp - 0x18], 0x1002358
call fcn.01084394
mov ecx, dword [edi + 4]
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1049920
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test edi, edi
je 0x104994a
cmp edi, 1
je 0x104994a
push 0x1002da8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0x8876086c
jmp 0x1049a5a
push esi
push 1
push 0x1c0
call fcn.01012474
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x104996b
mov dword [ebp - 4], 0x8007000e
jmp 0x1049a4c
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esi + 0xc], edi
mov dword [esi + 4], eax
call fcn.01049035
test eax, eax
jne 0x104998d
mov dword [ebp - 4], 0x80004005
jmp 0x1049a4b
fld dword [ebp + 0x10]
push edi
push ecx
fstp dword [esp]
call fcn.01056463
test eax, eax
pop ecx
pop ecx
mov dword [esi + 0x1bc], eax
je 0x1049981
and dword [esi + 0x1c], 0
call fcn.01057053
mov ebx, eax
test ebx, ebx
jne 0x10499c1
mov dword [ebp - 4], 0x8007000e
jmp 0x1049a4b
push 0x1056e7b
push 0x1870a
push ebx
call fcn.01057230
push fcn.0104c142
push 0x18706
push ebx
call fcn.01057230
push 0x1056edd
push 0x1870b
push ebx
call fcn.01057230
push 0x1048f80
push 0x1870d
push ebx
call fcn.01057230
push 0x1048f1f
push 0x1870f
push ebx
call fcn.01057230
fld1
sub esp, 0x18
fstp qword [esp + 0x10]
fldz
fstp qword [esp + 8]
fldz
fstp qword [esp]
push ebx
call fcn.0105720d
fld qword [0x1002da0]
push ecx
push ecx
fstp qword [esp]
push 0x1872c
push ebx
call fcn.01057112
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [eax], esi
xor esi, esi
pop ebx
test esi, esi
je 0x1049a59
push dword [ebp + 8]
call fcn.01049101
pop ecx
pop esi
mov eax, dword [ebp - 4]
leave
ret

Function at 0x104a303
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
and dword [ebx], 0
push esi
push edi
push 0xc
mov edi, eax
call fcn.0100f62c
mov esi, eax
test esi, esi
pop ecx
je 0x104a33a
push 0x140
call fcn.0100f62c
test eax, eax
pop ecx
jne 0x104a343
push esi
call fcn.0100f567
pop ecx
mov dword [ebp - 4], 0x8007000e
jmp 0x104a38f
and dword [esi + 4], 0
mov dword [esi], eax
mov dword [esi + 8], 0xa
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
jae 0x104a37d
push esi
push edi
lea eax, [ebp - 8]
call fcn.0104a1ac
test eax, eax
pop ecx
pop ecx
je 0x104a396
mov eax, dword [edi + 0x10]
add eax, dword [edi + 0x14]
cmp dword [ebp - 8], eax
jb 0x104a362
and dword [ebp - 0xc], 0
mov dword [ebx], esi
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x104a38f
call fcn.01049252
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
push 0x1002dd4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0x80004005
jmp 0x104a383
Function at 0x104aa62
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1002f38
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x104aabc
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x104aabc
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x104aabc
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x104aac5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x1002f38
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x104ab35
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1002f54
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x104ab2c
cmp dword [ebp - 0xc], 4
jne 0x104ab2c
cmp dword [ebp - 0x10], edi
je 0x104ab2c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1093600], edi
xor eax, eax
jmp 0x104ab5d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1093600], edi
jge 0x104ab58
mov dword [0x1093600], edi
call fcn.0101d6bb
test eax, eax
je 0x104ab58
emms
mov dword [0x1093600], 1
mov eax, dword [0x1093600]
pop edi
leave
ret

Function at 0x104ac5a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x1090004]
push ebx
push edi
push 0x25
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
xor bl, bl
push eax
mov byte [ebp - 0x99], bl
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x104aca8
inc bl
mov byte [ebp - 0x99], 1
cmp dword [ebp - 0x88], 1
jne 0x104acd9
cmp dword [ebp - 0x94], 4
ja 0x104ace6
jne 0x104acd0
cmp dword [ebp - 0x90], 0xa
jb 0x104acd0
cmp word [ebp - 0x8c], 0x55d
jae 0x104ace6
mov byte [ebp - 0x99], 1
jmp 0x104ace6
cmp dword [ebp - 0x88], 2
jne 0x104acff
test bl, bl
je 0x104ad1d
mov eax, dword [ebp + 8]
sub eax, 6
je 0x104ad0a
dec eax
je 0x104ad03
sub eax, 3
jne 0x104acff
cmp byte [ebp - 0x99], 0
je 0x104ad2e
xor eax, eax
jmp 0x104ad36
call fcn.0104ab65
jmp 0x104ad36
cmp byte [ebp - 0x99], 0
jne 0x104acff
call fcn.0104aba4
and eax, 4
jmp 0x104ad36
cmp dword [ebp + 8], 0xa
je 0x104ad2e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x104ad36
call fcn.0104aba4
and eax, 8
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0100d888
leave
ret