joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fbef
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a8233
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.10179380
mov eax, dword [0x10216040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x1002fd20
push ebx
push edx
call fcn.1002fd6d
mov ebx, eax
test ebx, ebx
jne 0x1002fc57
push esi
jmp 0x1002fd48
lea ecx, [ebp - 0x2014]
call fcn.100041f0
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x1002fcdf
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.10004b10
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.1002dcf3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x1002fd0d
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.1002b350
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10004d90
jmp 0x1002fd4f
push esi
mov ecx, edi
call fcn.1002ab33
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x1002fd06
test esi, esi
jne 0x1002fd29
mov esi, 0x101f1648
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.1002ab33
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101786e5
leave
ret 0x10
Function at 0x1002fe0a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x58], esi
je 0x1002fe57
push esi
push dword [ebp + 8]
call fcn.1002fd6d
mov edi, eax
test edi, edi
je 0x1002fedf
push dword [ebp + 0x14]
push ebx
push 3
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x1002fedf
mov eax, dword [ebp + 0x14]
push 2
pop ecx
lea eax, [eax*2 + 1]
mul ecx
setb cl
movsx ecx, cl
neg ecx
or ecx, eax
push ecx
call fcn.1002aa7a
mov edx, dword [ebp + 0x14]
pop ecx
mov ecx, eax
mov dword [ebp - 8], ecx
test edx, edx
je 0x1002feb1
mov dword [ebp - 4], 0x41
mov al, byte [ebx + esi]
and al, 0xf
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4], ax
mov al, byte [ebx + esi]
shr al, 4
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4 + 2], ax
inc esi
cmp esi, edx
jb 0x1002fe8a
xor eax, eax
mov word [ecx + esi*4], ax
mov eax, dword [edi]
push ecx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101b8a64]
mov ecx, edi
call esi
push dword [ebp - 8]
mov esi, eax
call fcn.1002aa83
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10035ca7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x10035cef
call fcn.1002c9c4
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10035cef
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10035cfc
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x10035d38
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x10035d1b
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x10035d24
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x10035d36
test di, di
jne 0x10035d36
test dx, dx
je 0x10035d38
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10035da1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.1002c9c4
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10035de1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10035de1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10035de9
jmp 0x10035de3
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x100360d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x101a88ba
call fcn.10179264
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.1002c9c4
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x10036138
call fcn.1002c9c4
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1003614c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x10036148
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x10036154
or eax, 0xffffffff
jmp 0x100362a6
mov ecx, edi
call fcn.100366e3
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.10039643
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x100361e0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x100361e0
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x100361e0
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.1002b0f0
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x100361dd
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x101b8a64]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x100361dd
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.1003fd5f
test eax, eax
je 0x100361dd
push 0
mov ecx, esi
call fcn.1003fb32
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.100392e2
push ebx
call fcn.1003a9ae
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.1003607c
test eax, eax
jne 0x10036229
cmp dword [edi + 0x9c], eax
jne 0x10036229
call fcn.1002c9c4
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.1003a9ae
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.1003607c
and dword [edi + 0x9c], 0
jmp 0x10036254
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x10036268
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.1003fb32
test esi, esi
je 0x10036275
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x1003628b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x1003628b
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x101b8a64]
mov ecx, edi
call esi
mov ecx, edi
call fcn.1003669a
mov eax, dword [edi + 0x68]
call fcn.101791c9
ret
Function at 0x1003a941
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1003a980
call fcn.1002c9c4
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1003a980
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1003a988
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.10058be7
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1003b3a6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1003b432
cmp dword [esi + 0x20], 0
je 0x1003b432
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1003b432
cmp dword [ebp + 8], 0
je 0x1003b432
xor edi, edi
mov ebx, edi
call fcn.1002c9c4
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003b416
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1003b432
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1007107d
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1003b42e
mov ecx, esi
call fcn.1003b144
mov eax, edi
jmp 0x1003b434
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1003fc94
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101a7e0e
call fcn.101791fb
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1003fcba
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1003fd14
lea ecx, [ebp - 0x10]
call fcn.100041f0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x101b8a64]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.10188245
push eax
call fcn.100042e0
add esp, 0x14
test esi, esi
je 0x1003fd07
push esi
call fcn.10187c3f
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10004d90
mov eax, ebx
call fcn.101791c9
ret 8

Function at 0x100411c4
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov di, ax
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov si, ax
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
add ax, ax
shr si, 0xf
add ax, si
shr di, 0xf
add ax, ax
add ax, di
pop edi
pop esi
ret
Function at 0x100446e6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 1]
add edi, 0xfffffee8
push dword [edi + 0x1c]
call fcn.1002c611
mov eax, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
inc ebx
cmp dword [eax + 4], 0x100
jne 0x100447e9
cmp dword [eax + 8], 9
jne 0x100447e9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x100447e9
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.1003a9ae
test eax, eax
je 0x10044745
mov eax, dword [eax + 0x20]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10044817
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
sar eax, 0x1f
and eax, ebx
add eax, 2
push eax
push edi
call fcn.10044914
test eax, eax
je 0x100447e5
push 0
push 0
push 0x400
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
mov edx, 0x534b
shr eax, 0x10
cmp ax, dx
jne 0x100447c3
movzx eax, cx
mov ecx, edi
push eax
call fcn.1003fba0
mov dword [ebp - 8], eax
test eax, eax
je 0x100447c3
mov ecx, eax
call fcn.1003fd5f
test eax, eax
je 0x100447c3
mov eax, dword [ebp - 8]
push ebx
push dword [eax + 0x20]
push 0x28
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0xe0]
test ecx, ecx
je 0x100447e5
mov eax, dword [ecx]
push dword [ebp + 0xc]
push ecx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x101b8a64]
call esi
neg eax
sbb esi, esi
inc esi
test esi, esi
jne 0x10044804
mov eax, dword [edi]
push dword [ebp + 0xc]
mov esi, dword [eax + 0x10c]
mov ecx, esi
call dword [0x101b8a64]
mov ecx, edi
call esi
test eax, eax
je 0x10044806
xor ebx, ebx
lea ecx, [ebp - 1]
call fcn.10002810
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
call fcn.1003a9ae
mov esi, eax
test esi, esi
je 0x100447e9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx edx, ax
movsx eax, dx
sar eax, 0x1f
and eax, ebx
add eax, 2
mov dword [ebp - 8], eax
mov eax, edx
shr eax, 0xf
push eax
jmp 0x10044863
mov ecx, esi
call fcn.1003fc6a
and eax, 0x8010000
cmp eax, 0x10000
je 0x1004487d
push dword [ebp - 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call fcn.1003a9ae
mov esi, eax
test esi, esi
jne 0x1004484d
jmp 0x100447e9
push ebx
push dword [esi + 0x20]
push 0x28
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10044804
Function at 0x10044f43
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
push edi
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 0xc]
cmp dword [ecx + 8], edi
jle 0x10044fbf
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10044f84
mov eax, dword [edx + 0x10]
cmp dword [eax + edi*8 + 4], esi
je 0x10044f84
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x10044fb2
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10044fb5
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10044fac
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x101b8a64]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
and dword [eax + edi*4], 0
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 8]
jl 0x10044f68
test eax, eax
je 0x10045006
lea esi, [edx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add ecx, 0x14
push edi
call fcn.10045237
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x101b8a64]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10045289
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x101a8ee4
call fcn.10179264
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x10045380
cmp edi, dword [ebx + 0xc]
jge 0x10045380
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x100452e0
cmp edi, dword [esi + 8]
jl 0x1004536e
cmp dword [ebp + 0xc], 0
je 0x1004536e
xor edi, edi
jmp 0x10045312
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.10044cd5
mov esi, eax
test esi, esi
je 0x100452fa
mov dword [esi], vtable.CThreadData.0
jmp 0x100452fc
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.10033d6b
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x1004532e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x1004533a
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x100453a7
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.1017cab0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10045380
cmp edi, dword [esi + 8]
jge 0x10045380
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.101791c9
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100314e8
int3
Function at 0x10046ade
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10216040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [0x1021e618]
mov dword [ebp - 0x20], ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x10046b37
push 0x101bb5cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10046b5c
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x1021e618], eax
jmp 0x10046b40
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x10046b5c
mov eax, dword [ebp - 0x18]
mov ecx, esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [0x101b8a64]
call esi
jmp 0x10046c9e
and dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.10046f57
lea eax, [ebp - 0x14]
push eax
call fcn.10187c3f
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.10187fb2
mov eax, dword [ebp - 0x20]
lea edi, [esi + 1]
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.10046f57
lea eax, [ebp - 0x14]
push eax
call fcn.10187c3f
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
push ecx
call fcn.10187fb2
mov eax, dword [ebp - 0x20]
add esp, 0x38
add edi, esi
inc dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.10046f57
lea eax, [ebp - 0x14]
push eax
call fcn.10187c3f
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.10187fb2
mov eax, dword [ebp - 0x20]
add edi, esi
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.10046f57
lea eax, [ebp - 0x14]
push eax
call fcn.10187c3f
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.10187fb2
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 7
push eax
add edi, esi
inc dword [ebx]
push 0x800
call fcn.10046f57
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.10187c3f
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.10187fb2
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + esi]
add esp, 0x10
xor edx, edx
inc dword [ebx]
mov word [ecx + eax*2 + 2], dx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101786e5
leave
ret
Function at 0x1004a913
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
push 0
pop ebx
and edi, 1
je 0x1004a9a2
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push 0x101bf03c
push dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.1002dadc
test eax, eax
jne 0x1004a97b
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push 0x101bf03c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1002dadc
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x1004a97b
inc ebx
test esi, esi
je 0x1004a986
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], 0
je 0x1004a995
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1004aa3c
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov eax, ecx
and al, 2
movzx esi, al
neg esi
sbb esi, esi
and esi, str.Apartment
test cl, 4
je 0x1004a9bd
mov esi, str.Free
and ecx, 6
cmp cl, 6
jne 0x1004a9cc
mov esi, str.Both
jmp 0x1004a9d4
test esi, esi
je 0x1004aa59
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push str.InprocServer32
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x1004aa29
push esi
call fcn.10187c3f
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.ThreadingModel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
neg eax
sbb ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004aa34
call fcn.1002c9c4
cmp byte [eax + 0x14], 0
je 0x1004aa59
test ebx, ebx
jne 0x1004aa59
test edi, edi
je 0x1004aa55
mov esi, 0x101bf03c
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, ebx
jmp 0x1004aa5c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1004b7bb
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1004b7e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004b7eb
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.10004810
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.10074d61
int3