joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103e3e1
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
shr edx, 3
je 0x103e40a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
push esi
mov esi, dword [ecx + eax]
xor dword [eax], esi
mov esi, dword [ecx + eax + 4]
xor dword [eax + 4], esi
add eax, 8
dec edx
jne 0x103e3f7
pop esi
pop ebp
ret 0xc

Function at 0x103e84d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100a358
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103e922
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x103e911
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x103e8fb
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x103e911
push eax
push edi
push dword [ebp - 0x110]
call fcn.0103e7e5
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x103e924
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010356d1
leave
ret 4
Function at 0x103fa64
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01041256

Function at 0x103fea6
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x103feed
cmp dword [ebp - 0x108], 2
jne 0x103feed
cmp dword [ebp - 0x114], 5
jb 0x103feed
xor eax, eax
inc eax
jmp 0x103feef
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010356d1
leave
ret

Function at 0x104044a
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
xor eax, eax
push ebx
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 1
push dword [ebp + 0xc]
mov ebx, 0x80004005
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
test eax, eax
jne 0x10404b6
mov eax, dword [section..data]
cmp eax, section..data
je 0x1040576
test byte [eax + 0x1c], 2
je 0x1040576
push ebx
push 0x100a8a8
push 0x100a804
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
jmp 0x1040576
mov eax, dword [ebp - 4]
push edi
add eax, eax
push eax
call fcn.0104b68d
mov edi, eax
test edi, edi
jne 0x10404f8
mov eax, dword [section..data]
cmp eax, section..data
je 0x10404f1
test byte [eax + 0x1c], 2
je 0x10404f1
push 0x100a894
push 0x100a804
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
mov ebx, 0x8007000e
jmp 0x104056b
lea eax, [ebp - 4]
push eax
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1040537
mov eax, dword [section..data]
cmp eax, section..data
je 0x104056b
test byte [eax + 0x1c], 2
je 0x104056b
push ebx
push 0x100a8a8
push 0x100a804
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
jmp 0x104056b
xor ebx, ebx
xor ecx, ecx
cmp dword [ebp - 4], ebx
jbe 0x104055c
movzx eax, word [edi + ecx*2]
cmp ax, 0xd
je 0x1040550
cmp ax, 0xa
jne 0x1040556
mov word [edi + ecx*2], 0x20
inc ecx
cmp ecx, dword [ebp - 4]
jb 0x1040540
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [eax], ecx
test edi, edi
je 0x1040575
push edi
call fcn.0104b6a5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x1040583
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
xor esi, esi
push esi
push esi
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push esi
push 1
push esi
push dword [ebp + 8]
mov dword [ebp - 8], 0x80004005
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x10405f7
mov eax, dword [section..data]
cmp eax, section..data
je 0x104069b
test byte [eax + 0x1c], 2
je 0x104069b
push 0x80004005
push 0x100a8f4
push 0x100a804
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
jmp 0x104069b
push dword [ebp - 4]
call fcn.0104b68d
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0x1040638
mov eax, dword [section..data]
cmp eax, section..data
je 0x104062f
test byte [eax + 0x1c], 2
je 0x104062f
push 0x100a8e0
push 0x100a804
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
mov dword [ebp - 8], 0x8007000e
jmp 0x104068e
push esi
push esi
lea ecx, [ebp - 4]
push ecx
push eax
push 1
push esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x104067b
mov eax, dword [section..data]
cmp eax, section..data
je 0x104068e
test byte [eax + 0x1c], 2
je 0x104068e
push 0x80004005
push 0x100a8f4
push 0x100a804
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
jmp 0x104068e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], esi
mov dword [ecx], eax
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
je 0x104069b
push dword [ebp + 0xc]
call fcn.0104b6a5
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1040804
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x1040944
cmp word [esi], di
je 0x1040944
push esi
call fcn.0103fb10
movzx ecx, word [esi]
cmp cx, di
je 0x1040914
push 2
pop ebx
cmp cx, 0x3b
je 0x1040944
cmp cx, 0x22
je 0x1040944
cmp cx, 0x3c
je 0x1040944
cmp cx, 0x3e
je 0x1040944
cmp cx, 0x2a
je 0x1040944
cmp cx, 0x2b
je 0x1040944
cmp cx, 0x3d
je 0x1040944
cmp cx, 0x7c
je 0x1040944
cmp cx, 0x3f
je 0x1040944
cmp cx, 0x2c
je 0x1040944
cmp cx, 0x20
je 0x1040944
cmp cx, 9
je 0x1040944
cmp cx, 0x3a
jne 0x10408f5
cmp eax, edi
jne 0x1040906
cmp dword [ebp + 0xc], edi
je 0x1040944
add esi, ebx
movzx eax, word [esi]
test ax, ax
mov edi, esi
je 0x1040944
movzx eax, ax
push eax
call sub.msvcrt.dll_iswdigit
add esi, ebx
test eax, eax
pop ecx
je 0x1040944
movzx eax, word [esi]
test ax, ax
jne 0x10408ce
sub esi, edi
and esi, 0xfffffffe
xor eax, eax
cmp esi, 0xa
setle al
jmp 0x1040946
cmp eax, edi
je 0x1040906
cmp cx, 0x5d
jne 0x1040906
add esi, ebx
cmp word [esi], di
jne 0x1040919
add esi, ebx
movzx ecx, word [esi]
cmp cx, di
jne 0x1040837
xor eax, eax
inc eax
jmp 0x1040946
cmp dword [ebp + 0xc], edi
je 0x1040944
add esi, ebx
movzx eax, word [esi]
test ax, ax
mov edi, esi
je 0x1040944
movzx eax, ax
push eax
call sub.msvcrt.dll_iswdigit
add esi, ebx
test eax, eax
pop ecx
je 0x1040944
movzx eax, word [esi]
test ax, ax
jne 0x104092a
jmp 0x10408e6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1040f32
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x228], ecx
xor ecx, ecx
cmp esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
je 0x1040f6d
mov dword [esi], ecx
cmp dword [ebp + 0x24], ecx
jne 0x1040f8a
push eax
push 0x109
lea eax, [ebp - 0x218]
push eax
call fcn.01040ee9
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x220]
push ecx
push 0x20019
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1041040
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
lea eax, [ebp - 0x22c]
push eax
push 0
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1041009
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x224]
je 0x1040ff9
cmp ecx, 3
jne 0x1041009
cmp dword [ebp + 0x1c], 4
jne 0x1041009
cmp eax, 4
jne 0x1041009
test esi, esi
je 0x1040fff
mov dword [esi], eax
mov dword [ebp - 0x21c], 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1041040
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1041040
test byte [ecx + 0x1c], 2
je 0x1041040
push eax
push 0x100aa0c
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040e4a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010356d1
leave
ret 0x20
Function at 0x104105c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x224], eax
push 0x109
lea eax, [ebp - 0x218]
push eax
call fcn.01040ee9
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1041105
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x104118a
test byte [ecx + 0x1c], 2
je 0x104118a
push eax
lea eax, [ebp - 0x218]
push eax
push 0x100aa0c
push 0xf
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040e76
jmp 0x104118a
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x1c]
push 0
push esi
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov edi, 0x100aa0c
mov ebx, section..data
je 0x1041151
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x104115b
test byte [ecx + 0x1c], 2
je 0x104115b
push eax
push esi
push dword [ebp - 0x224]
push edi
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0103935d
jmp 0x104115b
mov dword [ebp - 0x21c], 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x104118a
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x104118a
test byte [ecx + 0x1c], 2
je 0x104118a
push eax
push edi
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040e4a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010356d1
leave
ret 0x18

Function at 0x10411a6
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
push 0x109
lea eax, [ebp - 0x218]
push eax
xor edi, edi
call fcn.01040ee9
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push edi
lea eax, [ebp - 0x218]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104123f
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x21c]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x104123f
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x104123f
test byte [ecx + 0x1c], 2
je 0x104123f
push eax
push 0x100aa0c
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040e4a
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010356d1
leave
ret 8
Function at 0x1041256
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x220], ecx
mov ecx, dword [ebp + 0x14]
push 0x109
lea eax, [ebp - 0x218]
xor edi, edi
push eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], edi
call fcn.01040ee9
cmp dword [ebp + 0xc], edi
jne 0x10412dc
push esi
mov ebx, 0x20019
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
push SysReAllocStringLen
call edi
test eax, eax
je 0x10412da
push esi
push ebx
push 0
lea eax, [ebp - 0x218]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1041342
xor edi, edi
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push edi
push dword [ebp - 0x224]
push dword [ebp - 0x220]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x104130d
mov dword [ebp - 0x21c], 1
jmp 0x1041342
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x1041340
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1041340
test byte [ecx + 0x1c], 2
je 0x1041340
push eax
push 0x100aa0c
push 0x13
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040e4a
mov dword [esi], edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010356d1
leave
ret 0x10
Function at 0x10413d0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x21c], eax
xor eax, eax
cmp dword [ebp + 0x18], 2
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
mov esi, 0x208
je 0x104141e
cmp dword [ebp + 0x18], eax
jne 0x104144c
push eax
push eax
push 2
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push SysReAllocStringLen
call fcn.01040f32
test eax, eax
mov dword [ebp - 0x210], eax
jne 0x104144a
mov dword [ebp - 0x214], 1
xor eax, eax
cmp dword [ebp + 0x18], 1
je 0x1041460
cmp dword [ebp + 0x18], 2
jne 0x1041480
cmp dword [ebp - 0x214], eax
je 0x1041480
push eax
push eax
push 2
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.01040f32
mov dword [ebp - 0x210], eax
xor eax, eax
cmp dword [ebp - 0x210], eax
je 0x10414d5
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov ebx, eax
lea edi, [ebx + ebx + 2]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov ecx, dword [ebp - 0x218]
mov dword [ecx], eax
je 0x10414d5
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x10414d5
mov eax, dword [ebp - 0x21c]
mov dword [eax], edi
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010356d1
leave
ret 0x14

Function at 0x10423df
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x98]
push eax
mov esi, ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, 1
jne 0x104247e
cmp dword [ebp - 0x88], 2
jne 0x104247e
cmp dword [esi + 0x10], 0
jne 0x1042430
push 0x100ab74
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x104247e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100ab64
push eax
call edi
push 0x100ab50
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
call edi
push 0x100ab40
push dword [esi + 0x10]
mov dword [esi + 0x18], eax
call edi
push 0x100ab24
push dword [esi + 0x10]
mov dword [esi + 0x20], eax
call edi
push 0x100ab14
push dword [esi + 0x10]
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x24], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010356d1
leave
ret
Function at 0x1048cd1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x100c8c8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1048d32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x100c888
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1048d32
cmp dword [ebp - 0xc], 4
jne 0x1048d32
cmp dword [ebp - 0x10], 1
sete al
leave
ret
xor eax, eax
leave
ret

Function at 0x1048d74
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 8
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
test eax, eax
jne 0x1048da6
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 2
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
leave
ret 8

Function at 0x104baec
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.010356d1
leave
ret

Function at 0x104be0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.0104bc46
mov esi, eax
test esi, esi
jne 0x104be48
mov eax, dword [section..data]
cmp eax, section..data
je 0x104be6f
test byte [eax + 0x1c], 2
je 0x104be6f
push 0x100cf0c
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141a1
jmp 0x104be6f
movzx eax, word [ebp + 0xc]
push 5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x104be6f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x104be6f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x104c2fb
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x1054200]
cmp eax, 1
push esi
mov esi, 0x80004005
je 0x104c314
cmp eax, 3
jne 0x104c41e
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x1055424], eax
call esi
push 0x105557c
mov dword [0x1055428], eax
call fcn.0104c18e
mov esi, eax
test esi, esi
jge 0x104c36f
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c41e
test byte [eax + 0x1c], 2
je 0x104c41e
push esi
push 0x100cfe0
push 0x100cf88
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
jmp 0x104c41e
push 0x1055590
call fcn.0104c573
mov esi, eax
test esi, esi
jge 0x104c3a8
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c41e
test byte [eax + 0x1c], 2
je 0x104c41e
push esi
push 0x100cf98
push 0x100cf88
push 0xb
jmp 0x104c35f
and dword [0x105542c], 0
push edi
xor eax, eax
mov edi, 0x1055580
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0104c6fa
mov esi, eax
test esi, esi
pop edi
jge 0x104c3ec
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c41e
test byte [eax + 0x1c], 2
je 0x104c41e
push 0x100cf88
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141a1
jmp 0x104c41e
call fcn.0104c94f
mov esi, eax
test esi, esi
jge 0x104c412
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c41e
test byte [eax + 0x1c], 2
je 0x104c41e
push 0x100cf88
push 0xd
jmp 0x104c3df
mov dword [0x1054200], 2
xor esi, esi
mov eax, esi
pop esi
ret
Function at 0x104d421
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
jne 0x104d452
push 3
pop eax
jmp 0x104d546
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
mov edi, 0x100d54c
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x104d499
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push 0x100d540
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x104d4a7
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
cmp eax, ebx
jne 0x104d4ff
cmp dword [ebp - 8], 2
jne 0x104d4cb
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x100d534
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 8], 1
je 0x104d4db
cmp eax, ebx
jne 0x104d4db
cmp dword [ebp - 0x10], 0x14
je 0x104d534
cmp dword [ebp - 0x14], ebx
je 0x104d504
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x104d504
push 0x13
pop eax
jmp 0x104d545
push dword [ebp + 8]
call fcn.0104d36c
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x104d534
push 0x14
push dword [ebp + 8]
push 3
push ebx
push 0x100d534
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x104d534
mov dword [ebp - 0xc], 0x15
cmp dword [ebp - 4], ebx
je 0x104d542
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
leave
ret 4