joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102ce8b2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x102ce982
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x102ce982
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x102ce981
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x102ce981
push esi
mov esi, dword [eax + 0x80]
add esi, edi
cmp esi, eax
je 0x102ce980
cmp dword [esi + 0xc], ebx
je 0x102ce980
mov eax, dword [esi + 0xc]
lea ecx, [eax + edi]
cmp eax, 0xffff
je 0x102ce930
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x102ce938
add esi, 0x14
cmp dword [esi + 0xc], ebx
jne 0x102ce915
mov ecx, dword [ebp + 0x10]
cmp dword [esi + 0xc], ebx
je 0x102ce980
mov esi, dword [esi + 0x10]
add esi, edi
jmp 0x102ce952
cmp eax, ecx
jne 0x102ce94f
test eax, eax
jne 0x102ce95a
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x102ce947
jmp 0x102ce980
lea eax, [ebp + 0xc]
push eax
push 4
lea eax, [ebp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 4]
push eax
call fcn.102ceb9c
test eax, eax
je 0x102ce980
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov dword [eax], esi
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x102ce98b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [0x10807bd0], edi
je 0x102ce9ad
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x102cea3e
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftOffice16.0CommonGOM
push SysReAllocStringLen
mov dword [ebx], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102cea3d
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push str.GomEnableStatistics
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
mov esi, edi
cmove esi, dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x102cea3d
push edi
push 0x38
call fcn.100dc747
mov esi, eax
mov dword [ebp + 8], esi
pop ecx
pop ecx
test esi, esi
je 0x102cea29
push 0x34
push edi
push esi
call fcn.1027bff1
add esp, 0xc
mov dword [esi + 0x34], edi
jmp 0x102cea2b
mov esi, edi
mov dword [0x10807bd0], esi
test esi, esi
jne 0x102cea48
push 8
pop edi
call fcn.102ce838
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [esi + 0x34]
push eax
push str._TEMP__GOM_STAT.bin
call fcn.102cf58f
mov edi, eax
test edi, edi
jne 0x102cea38
mov ecx, dword [0x10807bd0]
xor esi, esi
inc esi
push esi
call fcn.102cea75
mov edi, eax
test edi, edi
jne 0x102cea38
mov dword [ebx], esi
jmp 0x102cea3d
Function at 0x102cecee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x40c], 0
lea eax, [ebp - 0x40c]
and dword [ebp - 0x418], 0
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftOffice16.0CommonGOMComplexRanges
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102cef03
push esi
push 4
pop esi
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], esi
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0x10373894
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102ced97
cmp dword [ebp - 0x408], esi
jne 0x102ced97
cmp dword [ebp - 0x418], eax
je 0x102ced97
push 0x2000
push 0xff
push 0x1065f3d0
call fcn.1027bff1
add esp, 0xc
jmp 0x102ceef6
push edi
xor edi, edi
lea eax, [ebp - 0x424]
mov dword [ebp - 0x41c], 0xff
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], esi
push eax
lea eax, [ebp - 0x408]
push eax
push 0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
cmp eax, 0xea
je 0x102ceeec
test eax, eax
jne 0x102ceef5
mov eax, dword [ebp - 0x41c]
add eax, eax
cmp eax, 0x200
jae 0x102cef13
xor ecx, ecx
mov word [ebp + eax - 0x204], cx
lea eax, [ebp - 0x428]
push eax
push str.BeginRange
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call fcn.102cf0db
test eax, eax
jne 0x102ceeec
cmp dword [ebp - 0x408], esi
jne 0x102ceeec
cmp dword [ebp - 0x420], 0xffff
ja 0x102ceeec
push dword [ebp - 0x428]
lea eax, [ebp - 0x404]
push str.EndRange
push str._s_s
push 0xffffffffffffffff
push 0xff
push eax
call fcn.100555a2
add esp, 0x18
test eax, eax
js 0x102ceeec
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], esi
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102ceeec
cmp dword [ebp - 0x408], esi
jne 0x102ceeec
cmp dword [ebp - 0x414], 0xffff
ja 0x102ceeec
mov esi, dword [ebp - 0x420]
cmp esi, dword [ebp - 0x414]
ja 0x102ceee9
mov edx, esi
mov eax, esi
shr edx, 3
and eax, 7
movzx ecx, byte [edx + 0x1065f3d0]
bts ecx, eax
inc esi
mov byte [edx + 0x1065f3d0], cl
jmp 0x102ceec4
push 4
pop esi
cmp edi, 0x32
jb 0x102ced9a
pop edi
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4
call fcn.10279be9
int3
Function at 0x102cf271
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftOffice16.0CommonGOM
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102cf2d5
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.GomCacheBypass
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102cf2cc
cmp dword [ebp - 0xc], 4
jne 0x102cf2cc
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x28], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 4

Function at 0x102cf58f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push ebx
push 0x100020
call fcn.100dc747
mov dword [ebp - 0x210], eax
pop ecx
pop ecx
test eax, eax
je 0x102cf5cd
mov ecx, eax
call fcn.102cf3be
jmp 0x102cf5cf
mov eax, ebx
mov dword [edi], eax
test eax, eax
jne 0x102cf5da
push 8
pop esi
jmp 0x102cf62f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x102cf623
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x20c]
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [edi]
mov dword [ecx + 0x100004], eax
mov eax, dword [edi]
cmp dword [eax + 0x100004], 0xffffffff
jne 0x102cf63c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x102cf63c
mov ecx, dword [edi]
test ecx, ecx
je 0x102cf63c
call fcn.102cf51c
mov dword [edi], ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8

Function at 0x102cf651
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea eax, [esi + 0x100008]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x100000]
mov edx, 0x100000
mov edi, dword [ebp + 0xc]
lea eax, [ecx + edi]
cmp eax, edx
ja 0x102cf6a2
cmp ecx, edx
ja 0x102cf6a2
cmp edi, edx
ja 0x102cf6a2
push edi
push dword [ebp + 8]
lea eax, [ecx + esi]
push eax
call fcn.1027ad2a
add esp, 0xc
add dword [esi + 0x100000], edi
jmp 0x102cf6d6
push ebx
lea eax, [ebp - 8]
push eax
push ecx
push esi
push dword [esi + 0x100004]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x102cf6c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x102cf6d6
push edi
push dword [ebp + 8]
push esi
call fcn.1027ad2a
add esp, 0xc
mov dword [esi + 0x100000], edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x102d89a6
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
cdq
xor edi, edi
push 0xa
pop ecx
idiv ecx
mov edx, dword [ebp + 8]
inc edi
mov esi, dword [ebp + 0x1c]
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [edx], ebx
mov edx, ebx
mov dword [ebp + 0x1c], edi
mov dword [ebp - 8], 0xff19
mov dword [eax], ebx
jmp 0x102d8a55
movzx eax, word [esi]
test ax, ax
je 0x102d8a59
mov ecx, eax
add esi, 2
mov eax, 0xff10
cmp cx, ax
jb 0x102d89fa
add eax, 9
cmp cx, ax
jbe 0x102d8a03
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x102d8a37
push 0x2d
pop eax
cmp cx, ax
je 0x102d8a3a
cmp edx, dword [ebp - 4]
jge 0x102d8a30
mov eax, 0xff10
cmp cx, ax
sbb eax, eax
imul edx, edx, 0xa
and eax, 0xffff0120
add eax, 0xff10
sub edx, eax
add edx, ecx
cmp edx, dword [ebp + 0x18]
jle 0x102d8a55
xor eax, eax
jmp 0x102d8b31
push 0x2d
pop eax
cmp cx, word [ebp + 0x14]
je 0x102d8a59
push 0x20
cmp cx, ax
jne 0x102d8a7a
neg edi
pop eax
mov dword [ebp + 0x1c], edi
cmp word [esi], ax
jne 0x102d8a55
add esi, 2
test esi, esi
jne 0x102d89db
mov eax, dword [ebp + 8]
imul edx, edi
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x10]
inc edx
test eax, eax
jle 0x102d8a9e
cmp eax, edx
jle 0x102d8aa0
dec eax
imul edx, edx, 0xa
sub eax, 1
jne 0x102d8a70
jmp 0x102d8aa0
mov eax, dword [ebp + 8]
imul edx, edi
mov dword [eax], edx
pop eax
cmp cx, ax
je 0x102d8a94
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x102d8a97
cmp cx, word [eax]
jne 0x102d8a97
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x102d8b31
mov edx, ebx
mov edi, ebx
jmp 0x102d8b05
movzx eax, word [esi]
test ax, ax
je 0x102d8b1a
cmp esi, dword [ebp + 0x20]
je 0x102d8b1a
mov ecx, eax
add esi, 2
mov eax, 0xff10
cmp cx, ax
jb 0x102d8ac6
cmp cx, word [ebp - 8]
jbe 0x102d8ad8
cmp ecx, 0x30
jb 0x102d8a30
cmp ecx, 0x39
ja 0x102d8a30
cmp cx, ax
sbb eax, eax
and eax, 0xffff0120
add eax, 0xff10
sub ecx, eax
test edx, edx
jle 0x102d8b0b
imul ecx, edx
mov eax, edx
push 0xa
cdq
add edi, ecx
pop ecx
idiv ecx
mov edx, eax
cmp edi, dword [ebp + 0x18]
jg 0x102d8a30
test esi, esi
jne 0x102d8aa4
jmp 0x102d8b1a
cmp ecx, 5
jl 0x102d8b11
inc edi
cmp edi, dword [ebp + 0x18]
jg 0x102d8a30
mov eax, dword [ebp + 8]
xor ecx, ecx
inc ecx
cmp dword [eax], ebx
mov eax, dword [ebp + 0xc]
cmove ecx, dword [ebp + 0x1c]
imul ecx, edi
mov dword [eax], ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x102da062
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [0x106613d8], 0xffffffff
movzx ebx, ax
jne 0x102da1b4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
push 0x20019
push dword [0x106429c4]
mov edi, esi
mov dword [0x106613d8], esi
call fcn.10114b62
test eax, eax
jne 0x102da1a3
cmp dword [ebp - 0x30], esi
je 0x102da1b4
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
jmp 0x102da185
inc edi
cmp dword [ebp - 0x44], 1
jne 0x102da1a3
cmp dword [ebp - 0x3c], 8
jne 0x102da1a3
cmp dword [ebp - 0x38], 0x12
jne 0x102da1a3
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.102dc457
test eax, eax
je 0x102da170
mov eax, dword [ebp - 0x34]
movzx ecx, ax
movzx eax, ax
push eax
mov dword [ebp - 0x40], ecx
call fcn.1015fb80
test eax, eax
je 0x102da170
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.102dc457
test eax, eax
je 0x102da170
movzx eax, word [ebp - 0x34]
push eax
mov dword [ebp - 0x48], eax
call fcn.1015fb80
test eax, eax
je 0x102da170
push 2
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x102da170
mov eax, dword [0x106613d8]
cmp eax, 0x10
jae 0x102da170
mov ecx, dword [ebp - 0x40]
mov word [eax*2 + 0x10807f3c], cx
inc eax
mov dword [0x106613d8], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0x30]
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x38], 0x12
call fcn.10115110
test eax, eax
je 0x102da0d8
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x102da1b4
push eax
mov dword [ebp - 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x106613d8], esi
jle 0x102da225
cmp bx, word [esi*2 + 0x10807f3c]
jne 0x102da21c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x102da21c
lea eax, [ebp - 0x18]
push eax
call fcn.10113ed3
cmp eax, 8
jne 0x102da21c
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.102dc457
test eax, eax
je 0x102da21c
mov eax, dword [ebp - 0x34]
movzx edi, ax
movzx ecx, ax
push edi
mov dword [ebp - 0x40], ecx
call fcn.1015fb80
test eax, eax
je 0x102da21c
push 2
push edi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x102da21c
mov eax, dword [ebp - 0x40]
movzx ebx, ax
inc esi
cmp esi, dword [0x106613d8]
jl 0x102da1bc
mov ecx, dword [ebp - 4]
mov ax, bx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret
Function at 0x102df203
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [esi], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, eax
test edi, edi
jne 0x102df225
push 0x323658
jmp 0x102df240
cmp dword [esi + 4], 6
jae 0x102df235
push 0x323659
call fcn.10153dc1
cmp dword [esi + 0x10], 2
je 0x102df245
push 0x32365a
call fcn.10153dc1
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x102dfc2b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp ax, word [0x10807fda]
je 0x102dfcbd
push edi
mov esi, eax
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
push eax
push esi
mov dword [ebp - 0x1c], edi
call fcn.1014b2bd
test eax, eax
js 0x102dfc9e
mov eax, dword [ebp - 0x1c]
push edi
push edi
push 0xa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x85
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
push eax
mov dword [ebp - 0x28], edi
call fcn.1014b27e
test eax, eax
je 0x102dfc9e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.102dc460
mov eax, dword [ebp - 0x20]
test eax, eax
js 0x102dfcaa
cmp eax, 3
jle 0x102dfcac
mov eax, edi
shl esi, 0x10
and eax, 3
or esi, eax
mov dword [0x10807fd8], esi
pop edi
jmp 0x102dfcc3
mov esi, dword [0x10807fd8]
mov ecx, dword [ebp - 4]
and esi, 3
mov eax, esi
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret
Function at 0x102ebf1f
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
inc ecx
cmp byte [ebp + 0xc], 0
mov word [ebp - 0x28], cx
je 0x102ebf4e
xor eax, eax
mov dword [ebp - 0x24], 0x20
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
jmp 0x102ebf88
and dword [ebp - 0x24], 0
and dword [ebp - 0x18], 0
push 2
pop eax
push 6
mov word [ebp - 0x1c], cx
pop ecx
push 0xd
mov word [ebp - 0x1a], cx
pop ecx
mov word [ebp - 0x10], cx
xor ecx, ecx
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
push 3
mov word [ebp - 0xe], cx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], eax
pop ecx
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
Function at 0x102f1601
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x230], ecx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1027bff1
add esp, 0xc
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], esi
mov ebx, esi
mov dword [ebp - 0x21c], esi
mov edi, esi
mov dword [ebp - 0x228], esi
push 0x104
push eax
push esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x102f173c
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.1027c349
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x102f169d
lea ebx, [ebp - 0x20c]
jmp 0x102f16a2
push 2
pop eax
add ebx, eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 3
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov dword [ebp - 0x214], eax
test eax, eax
je 0x102f1736
push eax
call fcn.100dcabd
mov edi, eax
pop ecx
test edi, edi
je 0x102f1736
push edi
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push esi
push eax
push 3
call sub.VERSION.dll_GetFileVersionInfoExW
test eax, eax
je 0x102f1736
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x103334e8
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x102f1736
cmp dword [ebp - 0x218], 0x34
jne 0x102f1736
mov eax, dword [ebp - 0x21c]
movzx ecx, word [eax + 8]
movzx esi, word [eax + 0xa]
mov dword [ebp - 0x228], ecx
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x210]
test ecx, ecx
lea eax, [ecx + 0x19]
push 0x20
pop edx
cmove eax, edx
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x214], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100dcabd
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x230]
mov dword [eax + 4], ecx
test ecx, ecx
jne 0x102f1778
mov esi, 0x8007000e
jmp 0x102f17c0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x210], 0
movzx eax, ax
push eax
mov eax, dword [ebp - 0x224]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x228]
movzx eax, ax
push eax
movzx eax, si
push eax
mov eax, str.Unknown
cmovne eax, ebx
push eax
push str._s__d._d._d._d
push dword [ebp - 0x214]
push ecx
call fcn.102f190b
add esp, 0x20
mov esi, eax
test edi, edi
je 0x102f17cb
push edi
call fcn.102a9552
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret
Function at 0x102f709c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 8], esi
cmp dword [ecx + 0x28], esi
je 0x102f7103
cmp edi, 0x40000
jb 0x102f7103
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x10], xmm0
push eax
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x28], 0x105f5ec4
push dword [ebp + 8]
movlpd qword [ebp - 0x20], xmm0
push dword [ecx + 0x20]
call fcn.102f6447
mov edx, dword [ebp + 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x10]
add dword [edx], ecx
jmp 0x102f71eb
mov edx, dword [ebp + 0xc]
mov eax, 0x10000
push ebx
mov ebx, eax
mov dword [ebp - 0xc], edx
cmp edi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
cmovb ebx, edi
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
cmp dword [eax + 4], esi
je 0x102f713f
mov ecx, eax
call fcn.102f7be4
mov ecx, dword [ebp - 4]
mov esi, eax
test esi, esi
js 0x102f71ea
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 0
je 0x102f7191
test eax, eax
jne 0x102f71ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x102f7195
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x20]
call fcn.102fdec3
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x102f71ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x102f71ea
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add dword [ecx], eax
add dword [ebp + 0x14], eax
adc edx, 0
add dword [ebp + 0x10], eax
mov dword [ebp - 0xc], edx
sub edi, eax
je 0x102f71ea
cmp ebx, eax
jne 0x102f71e5
mov ecx, dword [ebp - 4]
mov eax, 0x10000
cmp edi, eax
mov ebx, eax
mov eax, dword [ebp + 0x14]
cmovb ebx, edi
xor esi, esi
jmp 0x102f7122
mov esi, 0x8000ffff
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x102f81df
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.102f253a
cmp eax, 3
je 0x102f837e
call fcn.102f253a
cmp eax, 4
je 0x102f837e
push ebx
push esi
push 0x55
mov esi, 0x10669808
push esi
push 0x10669a18
call fcn.10114d42
mov eax, dword [0x10808140]
xor ebx, ebx
test eax, eax
je 0x102f8242
push ebx
push 0x55
push esi
push eax
call fcn.10114343
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
call fcn.10164199
push eax
push dword [0x10808140]
call fcn.10114454
push edi
call fcn.10164199
push eax
push dword [0x10642a0c]
call fcn.10114454
call fcn.10164199
mov edi, eax
call fcn.102faafe
mov esi, eax
cmp edi, esi
je 0x102f837b
movzx ecx, di
push ecx
call fcn.1015f9ef
test eax, eax
jne 0x102f8288
movzx eax, si
push eax
call fcn.1015f9ef
test eax, eax
je 0x102f837b
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [0x106429d0]
call fcn.10114b62
test eax, eax
jne 0x102f837b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x102f837b
imul eax, eax, 0x104
mov edi, ebx
push SysReAllocString
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 0x104
push eax
call fcn.102dcafb
push eax
lea ecx, [ebp - 8]
call fcn.10112002
test al, al
jne 0x102f8307
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x102f837b
push dword [ebp - 8]
jmp 0x102f8375
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x102f834c
mov ebx, esi
cmp edi, dword [ebp - 0xc]
jae 0x102f834c
mov eax, 0x104
inc edi
add ebx, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x102f8323
test edi, edi
je 0x102f8367
mov ebx, esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add ebx, 0x104
sub edi, 1
jne 0x102f8352
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x102f837b
push esi
call fcn.102a9552
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret