joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e06d
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40e09e
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x40e0a5
cmp ebx, dword [ebp + 8]
jae 0x40e0a5
xor eax, eax
jmp 0x40e28b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40e0b6
xor eax, eax
inc eax
jmp 0x40e28a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40e0c8
cmp ecx, edx
jae 0x40e12c
cmp dword [eax + 4], 0
je 0x40e0d1
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40e0bd
cmp dword [ebp + 8], 0
je 0x40e0eb
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40e12c
cmp eax, esi
jae 0x40e12c
mov ecx, dword [0x413998]
mov esi, ebx
and esi, 0xfffff000
xor eax, eax
test ecx, ecx
jle 0x40e10d
cmp dword [eax*4 + 0x4139a0], esi
je 0x40e133
inc eax
cmp eax, ecx
jl 0x40e0ff
lea eax, [ebp + 8]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
or edi, 0xffffffff
push edi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
jl 0x40e1a3
mov eax, dword [ebp + 8]
jmp 0x40e1a5
xor eax, eax
jmp 0x40e28a
test eax, eax
jle 0x40e0ae
xor edx, edx
mov ebx, 0x4139e0
inc edx
mov edi, ebx
xchg dword [edi], edx
test edx, edx
jne 0x40e0ae
cmp dword [eax*4 + 0x4139a0], esi
je 0x40e182
lea eax, [ecx - 1]
test eax, eax
jl 0x40e16f
cmp dword [eax*4 + 0x4139a0], esi
je 0x40e16b
dec eax
jns 0x40e15f
test eax, eax
jge 0x40e180
cmp ecx, 0x10
jge 0x40e17b
inc ecx
mov dword [0x413998], ecx
lea eax, [ecx - 1]
jmp 0x40e182
je 0x40e19a
xor edx, edx
test eax, eax
jl 0x40e19a
lea ecx, [edx*4 + 0x4139a0]
mov edi, dword [ecx]
inc edx
cmp edx, eax
mov dword [ecx], esi
mov esi, edi
jle 0x40e188
xor eax, eax
xchg dword [ebx], eax
jmp 0x40e0ae
xor eax, eax
test eax, eax
je 0x40e288
cmp dword [ebp - 8], 0x1000000
jne 0x40e288
test byte [ebp - 0xc], 0xcc
je 0x40e21a
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40e288
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40e288
cmp word [eax + 0x18], 0x10b
jne 0x40e288
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40e288
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40e21a
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40e21a
test byte [ecx + 0x27], 0x80
jne 0x40e12c
xor eax, eax
inc eax
mov ecx, eax
mov edx, 0x4139e0
xchg dword [edx], ecx
test ecx, ecx
jne 0x40e28a
mov ecx, dword [0x413998]
test ecx, ecx
mov edx, ecx
jle 0x40e249
lea eax, [ecx*4 + 0x41399c]
cmp dword [eax], esi
je 0x40e249
dec edx
sub eax, 4
test edx, edx
jg 0x40e23d
test edx, edx
jne 0x40e27a
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40e256
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40e26e
lea eax, [edx*4 + 0x4139a0]
mov edi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], esi
mov esi, edi
jle 0x40e25c
cmp ecx, 0x10
jge 0x40e27a
inc ecx
mov dword [0x413998], ecx
xor eax, eax
mov ecx, 0x4139e0
xchg dword [ecx], eax
jmp 0x40e0ae
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445f34
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x49de44]
cmp byte [eax + 0xc], 0
je 0x4460a1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44609a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49eb6c], 0
jne 0x445f88
push 0x4460a8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4460b0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb6c], eax
cmp dword [0x49bd4c], 0
jne 0x446083
push 0x4460c0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x49bd4c], eax
cmp dword [0x49bd4c], 0
je 0x446083
push 0x4460cc
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb70], eax
push 0x4460dc
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb74], eax
push 0x4460f0
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb78], eax
push 0x446108
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb7c], eax
push 0x446120
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb80], eax
push 0x446134
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb84], eax
push 0x44614c
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb88], eax
push 0x446164
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb8c], eax
push 0x446180
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb90], eax
push 0x44618c
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4460a1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x449f70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004049c0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x449fbf
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404c30
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451894
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4518e4]
test si, 4
je 0x4518a8
or bl, 1
test si, 8
je 0x4518b2
or bl, 4
test si, 1
je 0x4518bc
or bl, 8
test si, 2
je 0x4518c6
or bl, 0x10
test si, 0x10
je 0x4518d0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4518df
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4518e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x451920]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451901
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451910
or bl, 4
test esi, 0x20000000
je 0x45191b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x457fc8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x457fda
add esp, 0xfffffff0
call fcn.00403f10
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421b3c
mov eax, dword [0x49d878]
mov dword [eax + 4], ebx
mov dword [eax], 0x45836c
mov eax, dword [0x49d888]
mov dword [eax + 4], ebx
mov dword [eax], 0x458378
mov eax, ebx
call fcn.00458384
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4547a0
push eax
push 0
push 0
mov eax, dword [0x49dae4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4235a0]
call fcn.00424c3c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4235a0]
call fcn.00424c3c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4235a0]
call fcn.00424c3c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004587a4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458680
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458680
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458680
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x458117
call fcn.00403f68
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x424b14
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x452e20
call fcn.00425116
push 1
call fcn.00424b97
pop ecx
test al, al
jne 0x4249bd
push 7
call fcn.004257a1
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00424b62
mov byte [ebp - 0x24], al
mov eax, dword [0x461f38]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4249b6
test eax, eax
jne 0x424a27
mov dword [0x461f38], ecx
push 0x42835c
push 0x428344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x424a0a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x424b0e
push 0x428340
push 0x4282f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x461f38], 2
jmp 0x424a2c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00424cf4
pop ecx
call fcn.00425795
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x424a5c
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a5c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004259d3
call esi
call fcn.0042579b
mov esi, eax
cmp dword [esi], edi
je 0x424a7a
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a7a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004258b6
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004258ec
test al, al
jne 0x424ab3
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x424abc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00424d11
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x424b0e
call fcn.0042515c
ret
call fcn.00424823
jmp 0x42499e

Function at 0x4264c9
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4264d8
or eax, 0xffffffff
jmp 0x426515
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x4264f2
imul ecx, ecx, 0x21
movzx eax, ax
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x4264e5
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x41376b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp + 0xbd0c], 0x1f40
lea eax, [ebp + 0xbd0c]
push eax
lea eax, [ebp + 0x1804c]
push eax
push 0x10002
mov dword [ebp + 0x8c], esp
mov byte [ebp + 0x7b], 1
call sub.carclw62.dll_REALIA_GET_COMMAND_TAIL
add esp, 0xc
mov byte [ebp + 0x7b], 0
mov dword [ebp + 0xbd08], eax
cmp dword [ebp + 0xbd08], 1
jge 0x4137c8
mov eax, 0x20202020
lea edi, [ebp + 0x1804c]
mov ecx, 0x7d0
rep stosd dword es:[edi], eax
jmp 0x4138e9
cmp dword [ebp + 0xbd08], 0x1f40
jge 0x4138e9
jmp 0x413818
call fcn.004137dd
lea esi, [ebp + 0x34d94]
lea edi, [ebp - 0x40]
mov edx, 0xb04
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_95
mov ebx, dword [ebp - 0x40]
cmp ebx, 1
jl 0x41384e
cmp ebx, 0x1f40
jle 0x413852
int 4
jmp 0x413839
mov dword [ebp - 0x40], 0x30303030
mov dword [ebp - 0x3c], 0x30383030
mov byte [ebp - 0x38], 0x30
mov word [ebp - 0x37], 0x2b30
lea esi, [ebp + 0x34d9e]
lea edi, [ebp - 0x36]
mov edx, 0xb0b
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_S9
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov al, byte [ebp - 0x38]
mov byte [ebp - 0x2c], al
mov ax, word [ebp - 0x37]
mov word [ebp - 0x2b], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x2dd]
lea edi, [ebp - 0x2a]
mov edx, 0x20b
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_A9
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x40]
mov edx, 0xb04
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_95
mov ecx, dword [ebp - 0x40]
mov eax, 0x20202020
lea edi, [ebp + ebx + 0x1804b]
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_FILLDATA
ret
Function at 0x418936
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp + 0xceec]
mov ecx, 0x104
mov al, 0x20
repe scasb al, byte es:[edi]
jb 0x418a66
mov word [ebp + 0x5ce6], 0x306c
mov dword [ebp + 0x5ce8], 0x78643030
mov dword [ebp + 0x5cec], 0x20202020
mov dword [ebp + 0x5cf0], 0x20202020
mov byte [ebp + 0x5cf4], 0x20
cmp dword [ebp + 0xd718], 3
jb 0x418a10
cmp dword [ebp + 0xd718], 0x104
ja 0x418a10
mov eax, dword [ebp + 0x5ce6]
mov ecx, dword [ebp + 0x5cea]
mov dword [ebp + 0xc5c8], eax
mov eax, dword [ebp + 0x5cee]
mov dword [ebp + 0xc5cc], ecx
mov dword [ebp + 0xc5d0], eax
mov al, byte [ebp + 0x5cf2]
mov byte [ebp + 0xc5d4], al
mov ax, word [ebp + 0x5cf3]
mov word [ebp + 0xc5d5], ax
mov eax, 0x20202020
mov byte [ebp + 0xc5d7], al
mov dword [ebp + 0xc5d8], 0x20202020
mov dword [ebp + 0x12708], 0x3f
call fcn.00419474
lea esi, [ebp + 0xdbbd]
lea edi, [ebp + 0xceec]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
jmp 0x418a66
mov eax, dword [ebp + 0x5ce6]
mov ecx, dword [ebp + 0x5cea]
mov dword [ebp + 0xceec], eax
mov eax, dword [ebp + 0x5cee]
mov dword [ebp + 0xcef0], ecx
mov dword [ebp + 0xcef4], eax
mov al, byte [ebp + 0x5cf2]
mov byte [ebp + 0xcef8], al
mov ax, word [ebp + 0x5cf3]
mov word [ebp + 0xcef9], ax
mov eax, 0x20202020
mov byte [ebp + 0xcefb], al
lea edi, [ebp + 0xcefc]
mov ecx, 0x3d
rep stosd dword es:[edi], eax
push 0x10001
push 0x104
lea eax, [ebp + 0xceec]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_CARC__GetDynamicCallAddress
add esp, 0x10
mov dword [ebp + 0x84], eax
mov eax, dword [ebp + 0x84]
lea ecx, [ebp + 0xc4c0]
push ecx
push 0x10001
mov dword [ebp + 0x8c], esp
mov byte [ebp + 0x7b], 1
call eax
add esp, 8
mov byte [ebp + 0x7b], 0
ret
Function at 0x10039cb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
push edi
push 0x45
mov ebx, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x1b4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1b4]
push eax
mov dword [ebp - 0x1b4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x1a4], 1
push 0
sete al
or dword [ebx + 8], 0xffffffff
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [ebx + 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x14
lea eax, [ebp - 0xa0]
push eax
push 0x1004
push dword [0x100db44]
call esi
test eax, eax
push 0xa
pop edi
je 0x1003a6a
push edi
lea eax, [ebp - 0xa0]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov byte [ebx + 0x10], al
jmp 0x1003a6e
and byte [ebx + 0x10], 0
push 0x17
pop ecx
xor eax, eax
mov dword [ebp - 0x18], edi
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov al, byte [ebx + 0x10]
push 0x20
mov byte [ebp - 0x61], al
lea eax, [ebp - 0x5c]
push eax
push 0xfa6
push dword [0x100db44]
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], 0xe
mov dword [ebp - 0xc], 0x12
mov dword [ebp - 8], 0x18
call esi
and dword [ebp - 4], 0
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea esi, [ebx + 0x494c]
mov eax, dword [ebp - 4]
fild dword [ebp + eax*4 - 0x1c]
fimul dword [ebx + 4]
fmul dword [0x100184c]
fadd dword [0x1001848]
call sub.msvcrt.dll__ftol
neg eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
call edi
mov dword [esi - 0x18], eax
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 0x63], 1
call edi
and byte [ebp - 0x63], 0
inc dword [ebp - 4]
mov dword [esi], eax
add esi, 4
cmp dword [ebp - 4], 6
jl 0x1003ac7
lea eax, [ebx + 0x48d8]
push eax
lea eax, [ebx + 0x46e4]
push eax
call fcn.010065ac
lea esi, [ebx + 0x11c8]
mov ecx, esi
call fcn.0100a286
mov eax, 0x46d
mov ecx, eax
lea edi, [ebx + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea esi, [ebx + 0x11c8]
lea edi, [ebx + 0x237c]
rep movsd dword es:[edi], dword [esi]
and dword [ebx], 0
lea ecx, [ebx + 0x3530]
call fcn.01003797
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10049fa
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [0x1014b84], 0
jne 0x1004a80
push ebx
xor ebx, ebx
lea eax, [ebp - 0x114]
inc ebx
push eax
mov dword [0x1014b84], ebx
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 5
jne 0x1004a7f
push esi
push edi
push 0x1001abc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1004a7d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001aa0
push edi
call esi
test eax, eax
je 0x1004a7d
call eax
cmp ax, 0x409
jne 0x1004a7d
push 0x1001a84
push edi
call esi
test eax, eax
je 0x1004a7d
call eax
cmp ax, 0x409
je 0x1004a7d
mov dword [0x1014b80], ebx
pop edi
pop esi
pop ebx
mov eax, dword [0x1014b80]
leave
ret

Function at 0x1004a87
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x1014b88], 0
jne 0x1004c52
push esi
push edi
mov dword [0x1014b88], 1
call fcn.010049fa
test eax, eax
jne 0x1004b56
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
pop edi
push edi
push 0x10124b8
push 0x138a
push dword [0x100db44]
call esi
push edi
push 0x1012580
push 0x138b
push dword [0x100db44]
call esi
push edi
push 0x1012648
push 0x138c
push dword [0x100db44]
call esi
push edi
push 0x1012710
push 0x138d
push dword [0x100db44]
call esi
push edi
push 0x10127d8
push 0x138e
push dword [0x100db44]
call esi
push edi
push 0x10128a0
push 0x138f
push dword [0x100db44]
call esi
push edi
push 0x1012968
push 0x1390
push dword [0x100db44]
call esi
push edi
push 0x1012a30
push 0x1391
push dword [0x100db44]
call esi
jmp 0x1004bbc
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1001c34
push 0x10124b8
call esi
push 0x1001bf4
push 0x1012580
call esi
push 0x1001bd4
push 0x1012648
call esi
push 0x1001ba8
push 0x1012710
call esi
push 0x1001b70
push 0x10127d8
call esi
push 0x1001b4c
push 0x10128a0
call esi
push 0x1001b18
push 0x1012968
call esi
push 0x1001ad8
push 0x1012a30
call esi
lea eax, [ebp - 8]
push eax
push 0x1001888
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1004c50
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
mov dword [ebp - 4], 0x100d060
mov ebx, 0x1012af8
mov dword [ebp - 0xc], 0x10
mov esi, 0x208
and word [ebx], 0
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push 0
push dword [eax]
mov dword [ebp - 0x10], esi
push dword [ebp - 8]
call edi
add dword [ebp - 4], 4
add ebx, esi
dec dword [ebp - 0xc]
jne 0x1004bf3
lea eax, [ebp - 0x14]
push eax
push 0x1014b7c
push 0
push 0
push 0x10018b4
push dword [ebp - 8]
mov dword [ebp - 0x14], 4
call edi
test eax, eax
pop ebx
je 0x1004c47
mov dword [0x1014b7c], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x100775e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x190
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x7c]
xor ebx, ebx
push dword [ebp + 0x74]
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x64], ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x1007892
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
call esi
test eax, eax
je 0x10077ba
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edi, eax
cmp edi, ebx
jne 0x1007892
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp + 0x5c]
push eax
push ebx
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp + 0x7c], ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, 0x80
jmp 0x100781e
push dword [ebp + 0x74]
lea eax, [ebp - 0xa4]
push eax
push dword [ebp + 0x5c]
lea eax, [ebp - 0x24]
push 0
push eax
push dword [ebp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc dword [ebp + 0x7c]
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp + 0x5c]
push eax
push 0
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
mov dword [ebp + 0x74], esi
mov dword [ebp + 0x60], esi
call ebx
mov edi, eax
test edi, edi
je 0x10077e3
cmp edi, 0x103
jne 0x1007890
and dword [ebp + 0x7c], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
lea eax, [ebp - 0x124]
push eax
push 0
jmp 0x100787b
lea eax, [ebp - 0x124]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x68]
call fcn.0100775e
mov edi, eax
cmp edi, 0x103
je 0x100786d
test edi, edi
jne 0x1007890
inc dword [ebp + 0x7c]
push esi
lea eax, [ebp - 0x124]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
call ebx
mov edi, eax
test edi, edi
je 0x100784d
cmp edi, 0x103
jne 0x1007890
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10078a2
push dword [ebp + 0x68]
call esi
cmp dword [ebp + 0x64], ebx
je 0x10078ac
push dword [ebp + 0x64]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc