joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048bdc
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x100a4ba2
call fcn.10001360
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0x100b5a58
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
lea ecx, [esi + 0x14]
mov dword [ebp - 4], eax
call fcn.10046fb1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x101080c8], eax
mov eax, esi
call fcn.100013a0
ret

Function at 0x10048cfd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, ecx
lea ecx, [eax + 4]
mov dword [eax], 0x100b58ec
mov dword [ecx], 0xc0000001
jmp fcn.1000f673

Function at 0x1004b7b3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5d0f
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7c0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x80]
mov dword [ebp - 4], 2
call fcn.10026d23
lea ecx, [esi + 0x68]
mov dword [ebp - 4], 5
call fcn.10026d23
lea ecx, [esi + 0x58]
call fcn.10025a62
lea ecx, [esi + 0x48]
call fcn.10025a62
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 8
call fcn.10026d23
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 0xb
call fcn.10026d23
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0x10
call fcn.10026d23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c7da
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6399
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100b7c0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x50]
mov dword [ebp - 4], 1
call fcn.10066887
lea ecx, [edi + 0x50]
call fcn.10009b7d
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x34]
mov dword [ebp - 4], 4
call fcn.10026d23
lea ecx, [edi + 0x30]
mov dword [ebp - 4], 7
call fcn.10026d23
lea ecx, [edi + 0x2c]
mov dword [ebp - 4], 0xa
call fcn.10026d23
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0xd
call fcn.10026d23
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0x13
call fcn.10026d23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004c8cb
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a63f0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7c0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xc0]
call fcn.1002539f
lea ecx, [esi + 0x44]
call fcn.1002539f
and dword [ebp - 4], 0
lea ecx, [esi + 0x40]
call fcn.10006c62
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 1
call fcn.10006c62
lea ecx, [esi + 0x38]
mov dword [ebp - 4], 2
call fcn.10006c62
lea ecx, [esi + 0x34]
call fcn.1002539f
lea ecx, [esi + 0x30]
call fcn.1002539f
lea ecx, [esi + 0x2c]
call fcn.1002539f
lea ecx, [esi + 0x28]
call fcn.1002539f
lea ecx, [esi + 0x24]
call fcn.1002539f
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 3
call fcn.10006c62
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 4
call fcn.10006c62
lea ecx, [esi + 0x18]
call fcn.1002539f
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 9
call fcn.10026d23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c99a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6441
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7c0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 2
call fcn.10026d23
lea ecx, [esi + 0x30]
call fcn.1002669b
lea ecx, [esi + 0x1c]
call fcn.1002669b
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 3
call fcn.10006c62
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 8
call fcn.10026d23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100584c2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a248e
call fcn.10002f91
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x420]
push 0x200
call fcn.10001b31
xor eax, eax
mov word [ebp - 0x40c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.1002de62
lea eax, [ebp - 0x420]
push eax
call fcn.10028034
mov edx, 0x104
cmp eax, edx
jbe 0x10058534
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov byte [ebp - 0x418], 1
push edx
mov word [eax + 0x208], cx
lea ecx, [ebp - 0x420]
call fcn.1004196c
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x420]
setne bl
call fcn.100073e1
mov al, bl
call fcn.100034a6
ret 4

Function at 0x10061733
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4

Function at 0x10064c05
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0x800000
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10001550
mov esp, ebp
pop ebp
ret
Function at 0x1006e73c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
or ebx, 0xffffffff
push edi
mov edi, ecx
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [edi + 0x1c]
mov dword [ebp - 8], eax
push esi
mov byte [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
cmp dword [edi + 0x58], eax
je 0x1006e78a
lea ecx, [edi + 0x6c]
cmp byte [ecx], al
je 0x1006e78a
lea eax, [ebp - 0xc]
push eax
call fcn.1002bc20
xor ebx, ebx
mov byte [ebp - 1], 1
test eax, eax
cmovg ebx, eax
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
je 0x1006e7a0
cmp ebx, 0xffffffff
je 0x1006e79a
cmp dword [ebp + 8], ebx
jge 0x1006e7a0
mov ebx, dword [ebp + 8]
mov byte [ebp - 1], al
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
jne 0x1006e7bb
mov ecx, dword [edi + 0x94]
call fcn.1001bf08
mov bl, 1
jmp 0x1006e7e8
cmp byte [ebp - 1], 0
je 0x1006e7d0
test ebx, ebx
jne 0x1006e7d0
cmp byte [edi + 0x35], bl
je 0x1006e7d0
xor ecx, ecx
mov bl, cl
jmp 0x1006e7e8
mov ecx, dword [edi + 0x94]
lea eax, [ebp + 0xa]
push ebx
push eax
call fcn.1001bf2a
xor ecx, ecx
cmp word [eax], cx
setne bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0xc]
mov byte [ebp - 0x14], 1
push eax
call fcn.1002bc20
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test bl, bl
je 0x1006e820
push dword [ebp + 0x14]
mov ecx, edi
mov byte [edi + 0x35], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1004f378
jmp 0x1006e838
xor eax, eax
mov byte [edi + 0x35], al
cmp byte [ebp - 1], al
jne 0x1006e82e
xor al, al
jmp 0x1006e838
push dword [ebp + 0x10]
mov ecx, edi
call fcn.1004f4bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10071a46
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push eax
push ebx
mov edi, ecx
call fcn.10071b45
mov esi, eax
test esi, esi
jne 0x10071b32
cmp dword [edi + 0x7c], eax
je 0x10071b20
cmp dword [ebp + 0x14], 0xffffffff
je 0x10071a95
push dword [ebp + 0x14]
mov ecx, edi
call fcn.10071ce3
jmp 0x10071b1a
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x10071b12
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or dword [ebp - 0x258], 0xffffffff
lea ecx, [ebp - 0x258]
push 0
push 0
push eax
call fcn.1002d62c
cmp dword [ebp - 0x258], 0xffffffff
je 0x10071af8
cmp dword [ebp - 0x238], 0
ja 0x10071af4
cmp dword [ebp - 0x234], 0x7fffffff
ja 0x10071af4
push dword [ebp - 0x234]
mov ecx, edi
call fcn.10071ce3
mov esi, eax
jmp 0x10071afb
push 8
jmp 0x10071afa
push 0x10
pop esi
cmp dword [ebp - 0x258], 0xffffffff
je 0x10071b1c
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10071b1c
push ebx
mov ecx, edi
call fcn.1004f06c
mov esi, eax
test esi, esi
jne 0x10071b30
cmp byte [ebp + 0xc], 0
je 0x10071b30
push ebx
mov ecx, edi
call fcn.10075dc7
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10071b45
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x220
mov eax, 0x100ac2e2
call fcn.10002f91
mov dword [ebp - 0x220], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], bl
je 0x10071bba
push ebx
push ebx
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x218]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
xor eax, eax
add esp, 0x24
cmp ax, word [ebp - 0x18]
jne 0x10071b98
cmp ax, word [ebp - 0x218]
je 0x10071bba
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10071bba
test al, 0x10
je 0x10071bba
mov ecx, dword [ebp - 0x220]
push edi
push esi
call fcn.1004eed0
jmp 0x10071cdb
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x228]
mov dword [ebp - 4], ebx
push eax
push 0x5c
push esi
call fcn.10027880
test al, al
jne 0x10071bfd
lea eax, [ebp - 0x228]
push eax
push 0x2f
push esi
call fcn.10027880
test al, al
jne 0x10071bfd
push esi
lea ecx, [ebp - 0x21c]
call fcn.10006bee
mov esi, dword [ebp - 0x21c]
jmp 0x10071c2c
push esi
call fcn.100093ab
or ecx, 0xffffffff
sub ecx, dword [ebp - 0x228]
add eax, ecx
push eax
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.10027f82
lea ecx, [ebp - 0x21c]
mov esi, dword [eax]
call fcn.10006c62
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.100360f3
test al, al
jne 0x10071c44
push 0x40
jmp 0x10071cc6
test edi, edi
je 0x10071cc7
mov ecx, edi
call fcn.1001b632
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.10019bb1
cmp word [eax], bx
je 0x10071cc7
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x22c]
mov ecx, edi
push eax
call fcn.1001a617
mov eax, dword [eax]
mov dword [ebp - 0x220], eax
push dword [ebp - 0x21c]
mov ecx, esi
mov byte [ebp - 4], 2
push eax
call fcn.10063bbb
test al, al
jne 0x10071cb5
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 5
call fcn.10006c62
lea eax, [ebp - 0x14]
mov byte [ebp - 4], bl
push eax
mov ecx, edi
call fcn.10019bb1
cmp word [eax], bx
je 0x10071cc7
jmp 0x10071c65
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.10006c62
push 4
pop ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 6
call fcn.10006c62
mov eax, ebx
call fcn.100034a6
ret 0xc
Function at 0x1008cd38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x101080ec], 0
je 0x1008cd50
mov eax, dword [0x101080f0]
jmp 0x1008ce20
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push SysReAllocStringLen
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008cd9f
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x101080f0
push esi
push esi
push dword [0x10107770]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008cd9f
cmp dword [ebp - 8], 4
je 0x1008cdf9
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x1008cdb0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008ce01
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x101080f0
push esi
push esi
push dword [0x10107770]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008ce01
cmp dword [ebp - 8], 4
jne 0x1008ce01
mov esi, dword [0x101080f0]
jmp 0x1008ce07
mov dword [0x101080f0], esi
cmp dword [ebp - 4], 0
mov byte [0x101080ec], 1
je 0x1008ce1d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1008ce24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.CLSID
push SysReAllocStringLen
mov dword [ebp - 8], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1008ceb6
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x1008ceac
push 4
pop edi
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008ceac
cmp dword [ebp + 8], edi
jne 0x1008ceac
mov edi, dword [ebp - 0xc]
cmp edi, 3
ja 0x1008ceac
cmp dword [ebp - 4], ebx
je 0x1008ceb8
push dword [ebp - 4]
call esi
jmp 0x1008ceb8
cmp dword [ebp - 4], ebx
je 0x1008ceb6
push dword [ebp - 4]
call esi
mov edi, ebx
cmp dword [ebp - 8], ebx
je 0x1008cec2
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1008e8ff
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x214], 1
call sub.VCRUNTIME140.dll_memset
mov edx, 0x1010848c
mov dword [ebp - 0x210], esi
add esp, 0xc
mov eax, edx
xor ecx, ecx
cmp dword [eax], 0
je 0x1008e961
add eax, 0x14
inc ecx
cmp eax, 0x101084b4
jge 0x1008eab8
jmp 0x1008e94b
imul esi, ecx, 0x14
add esi, edx
je 0x1008eab8
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008ea9c
cmp dword [ebp - 0x214], 1
jne 0x1008ea9c
cmp word [ebp - 0x20c], ax
je 0x1008ea9c
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x1008ea9c
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x1008e9e3
add eax, eax
cmp eax, 0x208
jae 0x1008eacb
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x1008e9e9
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.1008eccc
mov dword [esi], eax
test eax, eax
je 0x1008ea9c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._GetPerfhostHookVersion_0
push eax
call edi
test eax, eax
jne 0x1008ea16
mov eax, dword [ebp + 0x10]
jmp 0x1008ea18
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x1008ea3c
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_12
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_4
jmp 0x1008ea70
cmp eax, 2
jne 0x1008ea51
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_8
jmp 0x1008ea2e
cmp eax, 3
jne 0x1008ea7a
push str._InitPerf_v3_4
push dword [esi]
call edi
push str._PerfCodeMarker_v3_8
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_v3_4
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x1008ea9c
cmp dword [esi + 0x10], 0
je 0x1008ea9c
cmp dword [esi + 0xc], 0
je 0x1008ea9c
push dword [0x10104f3c]
push esi
call fcn.1008e8c6
test eax, eax
jns 0x1008eab8
cmp dword [esi], 0
je 0x1008eaa9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 0xc
call fcn.1008db4f
int3
Function at 0x1008effd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push eax
push 0
push 2
push esi
push 0x100d0158
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1008f066
cmp dword [ebp - 0x210], 4
jb 0x1008f066
test edi, edi
lea eax, [ebp - 0x20c]
cmovne esi, edi
push esi
push eax
call fcn.1008f120
jmp 0x1008f068
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 8

Function at 0x1008f07a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push eax
push 0
push 2
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1008f10d
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x1008f10d
shr ecx, 1
push 0xffffffffffffffff
cmp word [ebp + ecx*2 - 0x210], 0x5c
sete al
lea eax, [eax*2 + str.Microsoft_SharedOffice16_]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1008f120
jmp 0x1008f10f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret 4

Function at 0x10091ba4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp ax, word [0x10108a02]
je 0x10091c36
push edi
mov esi, eax
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
push eax
push esi
mov dword [ebp - 0x1c], edi
call fcn.10005ae9
test eax, eax
js 0x10091c17
mov eax, dword [ebp - 0x1c]
push edi
push edi
push 0xa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x85
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
push eax
mov dword [ebp - 0x28], edi
call fcn.10091c50
test eax, eax
je 0x10091c17
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10098c42
mov eax, dword [ebp - 0x20]
test eax, eax
js 0x10091c23
cmp eax, 3
jle 0x10091c25
mov eax, edi
shl esi, 0x10
and eax, 3
or esi, eax
mov dword [0x10108a00], esi
pop edi
jmp 0x10091c3c
mov esi, dword [0x10108a00]
mov ecx, dword [ebp - 4]
and esi, 3
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10001550
mov esp, ebp
pop ebp
ret
Function at 0x1009323a
Capabilities:
Encrypt data using rc4 prga
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x10093249
or eax, 0xffffffff
jmp 0x1009329a
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x10093277
cmp ax, 0x41
jb 0x1009326a
cmp ax, 0x5a
ja 0x1009326a
movzx eax, ax
add eax, 0x20
jmp 0x1009326d
movzx eax, ax
imul ecx, ecx, 0x21
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x10093256
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4
Function at 0x10093bd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
lea ecx, [ebp - 0x240]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 1
push 0x101055f0
call fcn.1008ffce
test byte [esi + 0x20], 2
jne 0x10093dd0
cmp dword [esi + 0x14], ebx
je 0x10093c2d
push dword [esi + 0x14]
mov ecx, 0x10105608
call fcn.10005e71
and dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x14]
push 8
push eax
push 0x1004
push dword [esi + 4]
call edi
test eax, eax
je 0x10093d2c
lea eax, [ebp - 0x234]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push str.CpgScript
push 0
call fcn.10005f9e
mov dword [ebp - 0x218], eax
test eax, eax
js 0x10093d2c
mov eax, dword [ebp - 0x230]
xor ecx, ecx
push 4
xor ebx, ebx
pop edx
inc ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, 0x10105608
call fcn.1000b76c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10093cab
mov dword [ebp - 0x218], 0x8007000e
jmp 0x10093dc3
xor edi, edi
cmp dword [ebp - 0x230], edi
jbe 0x10093cf9
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x234]
push dword [eax + edi*4]
call fcn.10095e4b
mov dword [ebp - 0x218], eax
test eax, eax
js 0x10093ce9
movzx edx, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [ecx + edx*4], eax
inc byte [esi + 0x1d]
jmp 0x10093cf0
cmp eax, 0x8007000e
je 0x10093d12
inc edi
cmp edi, dword [ebp - 0x230]
jb 0x10093cb5
cmp byte [esi + 0x1d], 0
jne 0x10093dab
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
and dword [eax], 0
jmp 0x10093dab
push dword [esi + 0x14]
mov ecx, 0x10105608
call fcn.10005e71
and dword [esi + 0x14], 0
mov byte [esi + 0x1d], 0
jmp 0x10093dc3
push 4
mov ecx, 0x10105608
call fcn.1000b76c
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10093d4e
mov dword [ebp - 0x218], 0x8007000e
jmp 0x10093dcf
mov byte [esi + 0x1d], 1
and dword [eax], ebx
lea eax, [ebp - 0x214]
push 0x100
push eax
push 4
push dword [esi + 4]
call edi
test eax, eax
je 0x10093dab
and dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.100956dc
test eax, eax
je 0x10093d9f
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.10097b83
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x10093dcf
cmp dword [esi + 8], 0xc00
je 0x10093db8
or dword [esi + 0x20], 2
and dword [ebp - 0x218], 0
test ebx, ebx
je 0x10093dcf
lea eax, [ebp - 0x234]
push eax
call fcn.10006000
pop edi
mov esi, dword [ebp - 0x218]
lea ecx, [ebp - 0x240]
call fcn.10002d8f
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 4
Function at 0x10095b95
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101055ec], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x10095bbe
mov esi, 0x8ff000ff
jmp 0x10095c11
test ebx, ebx
je 0x10095c0c
xor esi, esi
cmp dword [0x101055c4], esi
jne 0x10095bd3
call fcn.10005b66
mov esi, eax
test esi, esi
js 0x10095c11
push edi
call fcn.10091dda
mov edi, eax
test edi, edi
je 0x10095c0c
test byte [edi + 0x20], 4
jne 0x10095bff
push edi
call fcn.100934ec
mov esi, eax
test esi, esi
jns 0x10095bff
cmp esi, 0x8007000e
je 0x10095c11
xor esi, esi
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x10095c26
sub eax, 1
je 0x10095c3a
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10095c3a
cmp byte [edi + 0x1e], 0
jbe 0x10095c3a
movzx eax, byte [eax]
mov dword [ebx], eax
jmp 0x10095c11
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10095c0c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
push ebx
push eax
call fcn.10095c68
mov esi, eax
jmp 0x10095c11