joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10aa7bd
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
push 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], edi
call fcn.0108da1b
mov dword [ebp - 4], eax
cmp eax, edi
je 0x10aa7fa
push eax
push 0x21b0199
call fcn.0108c55a
jmp 0x10aa8bb
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 8]
push edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10aa830
call fcn.01091f43
push eax
push 0x2280199
jmp 0x10aa8b2
mov eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push edi
call esi
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x10aa853
mov eax, 0x8007000e
push eax
push 0x2310199
jmp 0x10aa8b2
push dword [ebp - 0x14]
push edi
call esi
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
jne 0x10aa86f
mov eax, 0x8007000e
push eax
push 0x23a0199
jmp 0x10aa8b2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 8]
push edi
call ebx
test eax, eax
jne 0x10aa896
call fcn.01091f43
push eax
push 0x2470199
jmp 0x10aa8b2
mov eax, dword [ebp - 0x20]
add eax, 0x44
push eax
push esi
call fcn.010ad131
test eax, eax
jne 0x10aa8ba
call fcn.01091f43
push eax
push 0x24f0199
mov dword [ebp - 4], eax
call fcn.0108c55a
pop ebx
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x10abefb
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10abf2d
call fcn.01091f43
mov edi, eax
test esi, esi
jne 0x10abf69
cmp edi, 0x800700ea
jne 0x10abf69
test esi, esi
jne 0x10abf71
mov eax, dword [ebp - 4]
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x10abf09
mov eax, 0x8007000e
push eax
mov edi, eax
push 0x9d101c9
call fcn.0108c55a
test esi, esi
je 0x10abf61
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
leave
ret 8
push edi
push 0x9c601c9
jmp 0x10abf51
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x10abf61
Function at 0x10abf7f
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push edi
push 3
xor ebx, ebx
pop eax
mov dword [ecx], ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x10abfe0
mov edi, 0x80070002
call fcn.01091f43
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x10ac003
cmp dword [ebp - 0xc], 3
jne 0x10ac00a
push edi
push 0x9f401c9
call fcn.0108c55a
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x10abfb1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x10ac017
mov eax, 0x8007000e
push eax
push 0xa0701c9
jmp 0x10ac030
cmp eax, 0x800700ea
je 0x10abfe3
push eax
push 0x9fa01c9
call fcn.0108c55a
jmp 0x10ac04f
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x10ac03a
call fcn.01091f43
push eax
push 0xa0d01c9
mov dword [ebp - 8], eax
call fcn.0108c55a
jmp 0x10ac044
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor edi, edi
mov dword [ebp - 8], ebx
cmp edi, ebx
je 0x10ac04f
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10ac2e6
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x10ac300
mov eax, 0x1002068
push 0x20
pop edx
push 0x22
pop ecx
cmp cx, word [eax]
jne 0x10ac310
push ecx
pop edx
add eax, 2
push ebx
push esi
push edi
jmp 0x10ac324
cmp dx, cx
je 0x10ac330
push 0x5c
inc eax
pop esi
inc eax
cmp si, cx
jne 0x10ac326
mov ebx, eax
movzx ecx, word [eax]
xor esi, esi
cmp si, cx
jne 0x10ac315
sub eax, ebx
shr eax, 1
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x10ac35d
mov eax, 0x8007000e
push eax
push 0xa4401c9
mov esi, eax
call fcn.0108c55a
jmp 0x10ac375
push esi
push ebx
push edi
call sub.msvcrt.dll_memcpy
xor eax, eax
mov word [esi + edi], ax
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [eax], edi
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10ad79d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x10ad7bb
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x10ad7c4
mov dword [eax], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
jmp 0x10ad81a
mov eax, dword [ebp - 0xc]
test esi, esi
jne 0x10ad83a
cmp dword [ebp - 8], 7
je 0x10ad7e9
cmp dword [ebp - 8], 1
jne 0x10ad7fb
mov dword [ebp - 4], 4
test al, 1
je 0x10ad7fb
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 4]
add eax, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10ad86b
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov edi, eax
test edi, edi
je 0x10ad7d6
push 2
push edi
push 0x1f501b5
push dword [ebp + 0xc]
call fcn.0108c4ae
jmp 0x10ad87b
push dword [ebp - 4]
add eax, esi
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
je 0x10ad856
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10ad862
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor edi, edi
jmp 0x10ad87b
mov edi, 0x8007000e
push edi
push 0x20c01b5
call fcn.0108c55a
push edi
call fcn.01091f0e
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10ae37f
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x18], edi
jne 0x10ae3b7
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010ae1d3
mov esi, eax
cmp esi, edi
je 0x10ae3bc
push esi
push 0x8b01b5
jmp 0x10ae400
mov eax, dword [ebp + 8]
jmp 0x10ae3bf
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
je 0x10ae3e3
push esi
push 0x9801b5
jmp 0x10ae400
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, 2
je 0x10ae407
cmp esi, edi
je 0x10ae407
push esi
push 0x9d01b5
call fcn.0108c55a
jmp 0x10ae409
xor esi, esi
cmp dword [ebp - 4], edi
je 0x10ae417
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x10ae425
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.01091f0e
pop edi
pop esi
leave
ret 0x14
Function at 0x10ae457
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x2c], ebx
jne 0x10ae49b
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.010ae1d3
mov esi, eax
cmp esi, ebx
je 0x10ae49b
push esi
push 0x17401b5
jmp 0x10ae554
cmp dword [ebp + 8], ebx
je 0x10ae4cb
lea eax, [ebp - 4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
cmp esi, ebx
je 0x10ae4d2
push esi
push 0x17a01b5
push dword [ebp + 8]
call fcn.0108c595
jmp 0x10ae55d
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x2c], ebx
jne 0x10ae4dd
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x28]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x10ae506
push esi
push 0x18901b5
jmp 0x10ae554
cmp dword [ebp + 0x1c], ebx
je 0x10ae55b
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
cmp eax, ebx
je 0x10ae519
cmp edi, ebx
jne 0x10ae538
cmp ecx, ebx
jbe 0x10ae538
cmp ecx, 2
jbe 0x10ae530
cmp ecx, 7
jne 0x10ae538
mov eax, 0x1001cfc
push 4
jmp 0x10ae537
mov eax, 0x1002068
push 2
pop edi
push edi
push eax
push ecx
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x10ae55b
push esi
push 0x1a301b5
call fcn.0108c55a
jmp 0x10ae55d
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x10ae576
cmp dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
je 0x10ae576
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x10ae584
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], ebx
je 0x10ae58e
push dword [ebp - 0xc]
call edi
push esi
call fcn.01091f0e
pop edi
pop esi
pop ebx
leave
ret 0x28
Function at 0x10afefc
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
cmp ebx, ecx
je 0x10aff37
mov dword [ebx], ecx
cmp eax, ecx
je 0x10aff3d
mov dword [eax], ecx
cmp edi, ecx
je 0x10b001c
xor eax, eax
cmp ax, word [edi]
je 0x10b001c
push edi
call fcn.01054072
test al, al
je 0x10b001c
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.0108d318
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x10aff7e
push esi
push 0x3701ce
jmp 0x10affff
lea eax, [ebp - 0x210]
push eax
xor eax, eax
cmp byte [ebp + 0xc], al
push edi
sete al
push edi
dec eax
and eax, 7
add eax, 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
je 0x10affac
push esi
push 0x4101ce
jmp 0x10affff
lea eax, [ebp - 0x214]
push eax
push edi
push 0x1020828
lea eax, [ebp - 0x210]
push eax
call fcn.0108df83
mov esi, eax
cmp esi, edi
je 0x10affd3
push esi
push 0x4801ce
jmp 0x10affff
cmp dword [ebp - 0x21c], edi
je 0x10b0006
push dword [ebp - 0x21c]
push edi
push dword [ebp - 0x218]
push dword [ebp - 0x214]
call fcn.0108df83
mov esi, eax
cmp esi, edi
je 0x10b0006
push esi
push 0x4f01ce
call fcn.0108c55a
jmp 0x10b0031
cmp ebx, edi
je 0x10b0018
mov eax, dword [ebp - 0x214]
mov dword [ebx], eax
mov dword [ebp - 0x214], edi
xor esi, esi
jmp 0x10b0031
mov eax, 0x80070057
push eax
push 0x3101ce
push edi
mov esi, eax
call fcn.0108c595
xor edi, edi
cmp dword [ebp - 0x218], edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x10b0047
push dword [ebp - 0x218]
call edi
cmp dword [ebp - 0x214], 0
je 0x10b0058
push dword [ebp - 0x214]
call edi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01077dc7
leave
ret 0x10
Function at 0x10b3a27
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x14]
push eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10b3a7b
call fcn.01091f43
push eax
push 0x19a01c0
mov dword [ebp - 4], eax
call fcn.0108c55a
jmp 0x10b3b12
mov eax, dword [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push ebx
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x10b3aa7
mov eax, 0x8007000e
push eax
push 0x1a301c0
mov dword [ebp - 4], eax
call fcn.0108c55a
jmp 0x10b3b03
push dword [ebp - 0xc]
push ebx
call esi
mov esi, eax
cmp esi, ebx
jne 0x10b3ac0
mov eax, 0x8007000e
push eax
push 0x1ac01c0
jmp 0x10b3ae7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x10b3af1
call fcn.01091f43
push eax
push 0x1b901c0
mov dword [ebp - 4], eax
call fcn.0108c55a
jmp 0x10b3af8
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor esi, esi
cmp esi, ebx
je 0x10b3b03
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
cmp dword [ebp - 0x10], ebx
je 0x10b3b12
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc

Function at 0x10b86a0
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1000
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x10b8762
push edi
lea ecx, [ebp - 4]
push ecx
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10b874e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 1
push dword [ebp - 4]
mov dword [ebp + 8], ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10b874d
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10b8720
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10b874d
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push eax
push 1
push dword [ebp - 4]
call esi
test eax, eax
je 0x10b874d
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10b874d
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
pop esi
push dword [ebp - 0xc]
call edi
pop edi
cmp dword [ebp - 8], ebx
je 0x10b8762
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8
Function at 0x10b9056
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 0xc], edi
jmp 0x10b906b
mov edi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp - 8], eax
jne 0x10b908a
test ecx, ecx
jne 0x10b9098
test edx, edx
jne 0x10b9098
mov dword [ebp - 8], edi
jmp 0x10b9102
cmp eax, 0xffffffff
jne 0x10b9098
mov dword [ebp - 8], 0xfffffffe
jmp 0x10b9102
mov eax, dword [esi + 0x24]
lea eax, [edi + eax - 0x106]
cmp ecx, eax
jb 0x10b9102
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x10b90c9
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x10b90e8
add dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x10b91a5
mov ebx, dword [esi + 0x6c]
add ebx, dword [esi + 0x64]
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 8]
add ebx, dword [esi + 0x30]
mov dword [ebp - 4], eax
cmp eax, ecx
jbe 0x10b9127
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x10b9131
xor eax, eax
jmp 0x10b9166
sub eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x10b9150
push dword [ebp - 4]
push dword [edi]
push dword [edi + 0x30]
call fcn.010ba196
mov dword [edi + 0x30], eax
push dword [ebp - 4]
push dword [edi]
push ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x6c], eax
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x10b9191
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x10b91a5
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x10b9068
pop edi
pop ebx
leave
ret
Function at 0x10bf0ee
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x10d3e98], edi
jne 0x10bf20a
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x10bf155
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x10d3e98], edi
pop esi
je 0x10bf1dd
dec eax
jne 0x10bf20a
cmp dword [ebp - 0x11c], 5
jne 0x10bf1ca
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x10bf1be
dec eax
je 0x10bf1ab
dec eax
je 0x10bf191
mov dword [0x10d3e98], 0x14
jmp 0x10bf20a
cmp word [ebp - 0xc], 1
jb 0x10bf1a2
mov dword [0x10d3e98], 0x10
or dword [0x10d3e98], 4
jmp 0x10bf20a
cmp word [ebp - 0xc], 2
jb 0x10bf1a2
mov dword [0x10d3e98], 8
jmp 0x10bf1a2
mov dword [0x10d3e98], 4
jmp 0x10bf20a
cmp dword [ebp - 0x11c], 4
ja 0x10bf21c
mov dword [0x10d3e98], 2
cmp dword [ebp - 0x11c], 4
jne 0x10bf20a
cmp dword [ebp - 0x118], edi
je 0x10bf200
cmp dword [ebp - 0x118], 0xa
je 0x10bf200
cmp dword [ebp - 0x118], 0x5a
jne 0x10bf20a
mov dword [0x10d3e98], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x10d3e98]
xor ecx, ebp
pop edi
call fcn.01077dc7
leave
ret
mov dword [0x10d3e98], 0x20
jmp 0x10bf20a

Function at 0x10bf22d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10bf281
push 3
lea eax, [ebp - 0x44]
push 0x10273e8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01077dc7
leave
ret
Function at 0x10bf296
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x10d3e9c]
jne 0x10bf331
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x1027318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10bf330
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10273d0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x10bf330
push 3
push dword [esi*8 + 0x1027168]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x10bf322
inc esi
cmp esi, 0x1c
jb 0x10bf301
jmp 0x10bf330
mov ax, word [esi*8 + 0x102716c]
mov word [0x10d3e9c], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x10d3e9c]
xor ecx, ebp
call fcn.01077dc7
leave
ret
Function at 0x402d00
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x20
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x402ddf
push 0x100
push 0x40
call edi
push 0x30
push 0x40
mov dword [esi], eax
call edi
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test ecx, ecx
mov dword [esi + 4], eax
je 0x402de7
test eax, eax
je 0x402de4
mov al, 4
mov edi, 0x10
mov byte [esi + 8], al
mov byte [esi + 9], al
mov eax, 0x42400000
push ebx
push ebp
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
xor edx, edx
mov ecx, edx
xor eax, eax
shl ecx, 4
mov ebp, dword [esi]
mov bl, dl
add ebp, ecx
xor bl, al
mov byte [eax + ebp], bl
inc eax
cmp eax, edi
jl 0x402d70
inc edx
cmp edx, edi
jl 0x402d69
xor ecx, ecx
xor ebp, ebp
xor ebx, ebx
xor edi, edi
mov eax, edi
add edi, 0x32
cdq
and edx, 0xf
add ecx, 3
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 0x2b
mov byte [ecx + edx - 3], al
mov eax, ebx
cdq
and edx, 0xf
add ebx, 0x1b
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 0x19
mov byte [edx + ecx - 2], al
mov eax, ebp
cdq
and edx, 0xf
add ebp, 0xe
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 9
cmp edi, 0x320
mov byte [edx + ecx - 1], al
jl 0x402d8d
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
ret
push ecx
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x402df1
push eax
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
ret
Function at 0x407cd7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push dword [ebp + 0xc]
lea eax, [ebp - 0x800]
push eax
call sub.MSVCRT.dll_strcpy
push 7
push str.config_
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0x14
test eax, eax
jne 0x407d0a
add dword [ebp + 8], 7
push 0x45e580
lea eax, [ebp - 0x800]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push dword [0x45b9a4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
leave
ret