joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1040f47
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x21c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x224], eax
push 0x109
lea eax, [ebp - 0x218]
push eax
call fcn.01040dd4
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1040ff0
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1041075
test byte [ecx + 0x1c], 2
je 0x1041075
push eax
lea eax, [ebp - 0x218]
push eax
push 0x100a994
push 0xf
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040d61
jmp 0x1041075
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x1c]
push 0
push esi
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov edi, 0x100a994
mov ebx, section..data
je 0x104103c
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x1041046
test byte [ecx + 0x1c], 2
je 0x1041046
push eax
push esi
push dword [ebp - 0x224]
push edi
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010392fd
jmp 0x1041046
mov dword [ebp - 0x21c], 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1041075
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x1041075
test byte [ecx + 0x1c], 2
je 0x1041075
push eax
push edi
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101420b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01035675
leave
ret 0x18

Function at 0x1041091
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
push 0x109
lea eax, [ebp - 0x218]
push eax
xor edi, edi
call fcn.01040dd4
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push edi
lea eax, [ebp - 0x218]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104112a
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x21c]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x104112a
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x104112a
test byte [ecx + 0x1c], 2
je 0x104112a
push eax
push 0x100a994
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101420b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01035675
leave
ret 8
Function at 0x1041141
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x220], ecx
mov ecx, dword [ebp + 0x14]
push 0x109
lea eax, [ebp - 0x218]
xor edi, edi
push eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], edi
call fcn.01040dd4
cmp dword [ebp + 0xc], edi
jne 0x10411c7
push esi
mov ebx, 0x20019
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
push SysReAllocStringLen
call edi
test eax, eax
je 0x10411c5
push esi
push ebx
push 0
lea eax, [ebp - 0x218]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x104122d
xor edi, edi
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push edi
push dword [ebp - 0x224]
push dword [ebp - 0x220]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10411f8
mov dword [ebp - 0x21c], 1
jmp 0x104122d
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x104122b
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x104122b
test byte [ecx + 0x1c], 2
je 0x104122b
push eax
push 0x100a994
push 0x13
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101420b
mov dword [esi], edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01035675
leave
ret 0x10
Function at 0x10412bb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x21c], eax
xor eax, eax
cmp dword [ebp + 0x18], 2
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
mov esi, 0x208
je 0x1041309
cmp dword [ebp + 0x18], eax
jne 0x1041337
push eax
push eax
push 2
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push SysReAllocStringLen
call fcn.01040e1d
test eax, eax
mov dword [ebp - 0x210], eax
jne 0x1041335
mov dword [ebp - 0x214], 1
xor eax, eax
cmp dword [ebp + 0x18], 1
je 0x104134b
cmp dword [ebp + 0x18], 2
jne 0x104136b
cmp dword [ebp - 0x214], eax
je 0x104136b
push eax
push eax
push 2
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.01040e1d
mov dword [ebp - 0x210], eax
xor eax, eax
cmp dword [ebp - 0x210], eax
je 0x10413c0
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov ebx, eax
lea edi, [ebx + ebx + 2]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov ecx, dword [ebp - 0x218]
mov dword [ecx], eax
je 0x10413c0
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x10413c0
mov eax, dword [ebp - 0x21c]
mov dword [eax], edi
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01035675
leave
ret 0x14

Function at 0x1042239
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x98]
push eax
mov esi, ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, 1
jne 0x10422d8
cmp dword [ebp - 0x88], 2
jne 0x10422d8
cmp dword [esi + 0x10], 0
jne 0x104228a
push 0x100aafc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10422d8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100aaec
push eax
call edi
push 0x100aad8
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
call edi
push 0x100aac8
push dword [esi + 0x10]
mov dword [esi + 0x18], eax
call edi
push 0x100aaac
push dword [esi + 0x10]
mov dword [esi + 0x20], eax
call edi
push 0x100aa9c
push dword [esi + 0x10]
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x24], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01035675
leave
ret
Function at 0x1048c3e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x100c850
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1048c9f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x100c810
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1048c9f
cmp dword [ebp - 0xc], 4
jne 0x1048c9f
cmp dword [ebp - 0x10], 1
sete al
leave
ret
xor eax, eax
leave
ret

Function at 0x1048ce1
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 8
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
test eax, eax
jne 0x1048d13
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 2
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
leave
ret 8

Function at 0x104ba57
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.01035675
leave
ret

Function at 0x104bd76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.0104bbb1
mov esi, eax
test esi, esi
jne 0x104bdb3
mov eax, dword [section..data]
cmp eax, section..data
je 0x104bdda
test byte [eax + 0x1c], 2
je 0x104bdda
push 0x100ce94
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141c0
jmp 0x104bdda
movzx eax, word [ebp + 0xc]
push 5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x104bdda
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x104bdda
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x104c266
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10541e0]
cmp eax, 1
push esi
mov esi, 0x80004005
je 0x104c27f
cmp eax, 3
jne 0x104c389
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x1055404], eax
call esi
push 0x105555c
mov dword [0x1055408], eax
call fcn.0104c0f9
mov esi, eax
test esi, esi
jge 0x104c2da
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c389
test byte [eax + 0x1c], 2
je 0x104c389
push esi
push 0x100cf68
push 0x100cf10
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040d61
jmp 0x104c389
push 0x1055570
call fcn.0104c4de
mov esi, eax
test esi, esi
jge 0x104c313
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c389
test byte [eax + 0x1c], 2
je 0x104c389
push esi
push 0x100cf20
push 0x100cf10
push 0xb
jmp 0x104c2ca
and dword [0x105540c], 0
push edi
xor eax, eax
mov edi, 0x1055560
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0104c665
mov esi, eax
test esi, esi
pop edi
jge 0x104c357
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c389
test byte [eax + 0x1c], 2
je 0x104c389
push 0x100cf10
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141c0
jmp 0x104c389
call fcn.0104c8ba
mov esi, eax
test esi, esi
jge 0x104c37d
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c389
test byte [eax + 0x1c], 2
je 0x104c389
push 0x100cf10
push 0xd
jmp 0x104c34a
mov dword [0x10541e0], 2
xor esi, esi
mov eax, esi
pop esi
ret
Function at 0x104d391
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
jne 0x104d3c2
push 3
pop eax
jmp 0x104d4b6
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
mov edi, 0x100d4d4
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x104d409
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push 0x100d4c8
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x104d417
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
cmp eax, ebx
jne 0x104d46f
cmp dword [ebp - 8], 2
jne 0x104d43b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x100d4bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 8], 1
je 0x104d44b
cmp eax, ebx
jne 0x104d44b
cmp dword [ebp - 0x10], 0x14
je 0x104d4a4
cmp dword [ebp - 0x14], ebx
je 0x104d474
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x104d474
push 0x13
pop eax
jmp 0x104d4b5
push dword [ebp + 8]
call fcn.0104d2dc
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x104d4a4
push 0x14
push dword [ebp + 8]
push 3
push ebx
push 0x100d4bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x104d4a4
mov dword [ebp - 0xc], 0x15
cmp dword [ebp - 4], ebx
je 0x104d4b2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x104d510
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x18
mov dword [esp + 0x10], ebp
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], ebx
mov eax, dword [edx]
mov ebx, dword [edx + 4]
mov ebp, dword [edx + 0xc]
mov edx, dword [edx + 8]
mov esi, dword [ecx + 0x1d0]
add esi, ecx
mov dword [esp + 4], esi
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor edx, dword [ecx + 8]
xor ebp, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
mov dword [esp], ecx
add eax, 0
push ebp
movzx ecx, al
mov ecx, dword [ecx*4 + 0x100dc00]
movzx esi, ah
shr eax, 0x10
mov ebp, dword [esi*4 + 0x100e000]
movzx edi, ah
mov edi, dword [edi*4 + 0x100e800]
movzx eax, al
mov eax, dword [eax*4 + 0x100e400]
movzx esi, bl
xor edi, dword [esi*4 + 0x100dc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [esi*4 + 0x100e000]
movzx esi, bl
xor ebp, dword [esi*4 + 0x100e400]
movzx ebx, bh
xor eax, dword [ebx*4 + 0x100e800]
pop ebx
movzx esi, dl
xor eax, dword [esi*4 + 0x100dc00]
movzx esi, dh
xor edi, dword [esi*4 + 0x100e000]
shr edx, 0x10
movzx esi, dl
xor ecx, dword [esi*4 + 0x100e400]
movzx edx, dh
xor ebp, dword [edx*4 + 0x100e800]
mov esi, dword [esp]
movzx edx, bl
xor ebp, dword [edx*4 + 0x100dc00]
movzx edx, bh
xor eax, dword [edx*4 + 0x100e000]
shr ebx, 0x10
movzx edx, bl
xor edi, dword [edx*4 + 0x100e400]
movzx ebx, bh
xor ecx, dword [ebx*4 + 0x100e800]
mov edx, dword [esi + 8]
xor edx, eax
mov eax, dword [esi]
xor eax, ecx
xor ebp, dword [esi + 0xc]
mov ebx, dword [esi + 4]
xor ebx, edi
add esi, 0x10
cmp esi, dword [esp + 4]
mov dword [esp], esi
jb 0x104d550
push ebp
movzx ecx, al
movzx ecx, byte [ecx + 0x100d800]
movzx esi, ah
shr eax, 0x10
movzx ebp, byte [esi + 0x100d800]
movzx edi, ah
shl ebp, 8
movzx edi, byte [edi + 0x100d800]
movzx eax, al
shl edi, 0x18
movzx eax, byte [eax + 0x100d800]
shl eax, 0x10
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
or edi, esi
movzx esi, bh
shr ebx, 0x10
movzx esi, byte [esi + 0x100d800]
shl esi, 8
or ecx, esi
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
movzx ebx, bh
shl esi, 0x10
movzx ebx, byte [ebx + 0x100d800]
or ebp, esi
shl ebx, 0x18
or eax, ebx
movzx esi, dl
movzx esi, byte [esi + 0x100d800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx + 0x100d800]
or eax, esi
shl ebx, 8
movzx esi, dl
movzx esi, byte [esi + 0x100d800]
or edi, ebx
pop ebx
movzx edx, dh
movzx edx, byte [edx + 0x100d800]
shl esi, 0x10
or ecx, esi
shl edx, 0x18
or ebp, edx
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
movzx edx, bh
shr ebx, 0x10
movzx edx, byte [edx + 0x100d800]
or ebp, esi
shl edx, 8
or eax, edx
mov edx, dword [esp]
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
movzx ebx, bh
movzx ebx, byte [ebx + 0x100d800]
shl esi, 0x10
shl ebx, 0x18
or edi, esi
or ecx, ebx
xor ecx, dword [edx]
xor edi, dword [edx + 4]
xor eax, dword [edx + 8]
xor ebp, dword [edx + 0xc]
mov ebx, dword [esp + 0x1c]
mov dword [ebx], ecx
mov dword [ebx + 4], edi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ebp
mov dword [esp - 4], ebx
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
add esp, 0x18
ret 4
Function at 0x104ea1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x104ea57
xor eax, eax
jmp 0x104ea82
test eax, eax
jle 0x104ea67
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x104ea82
cmp dword [ebp + 0x10], 4
je 0x104ea76
mov eax, 0x8007000d
jmp 0x104ea82
cmp dword [ebp - 4], 0
jne 0x104ea82
mov dword [edi], 1
pop edi
leave
ret 0xc

Function at 0x104ea8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x104eac8
xor eax, eax
jmp 0x104eaf3
test eax, eax
jle 0x104ead8
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x104eaf3
cmp dword [ebp + 0x10], 4
je 0x104eae7
mov eax, 0x8007000d
jmp 0x104eaf3
cmp dword [ebp - 4], 0
je 0x104eaf3
mov dword [edi], 1
pop edi
leave
ret 0xc

Function at 0x104f226
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x104f27a
push 3
lea eax, [ebp - 0x44]
push 0x1011710
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01035675
leave
ret
Function at 0x104f2a0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x104f2f9
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x104f34d
dec ecx
jne 0x104f370
cmp edx, 5
jne 0x104f345
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x104f341
dec ecx
je 0x104f336
dec ecx
je 0x104f327
push 0x14
jmp 0x104f398
cmp word [ebp - 0xc], 1
jb 0x104f331
push 0x10
pop eax
or eax, 4
jmp 0x104f370
cmp word [ebp - 0xc], 2
jb 0x104f331
push 8
jmp 0x104f330
push 4
jmp 0x104f398
cmp edx, 4
ja 0x104f37c
push 2
pop eax
cmp edx, 4
jne 0x104f370
cmp dword [ebp - 0x118], 0
je 0x104f36d
cmp dword [ebp - 0x118], 0xa
je 0x104f36d
cmp dword [ebp - 0x118], 0x5a
jne 0x104f370
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01035675
leave
ret
cmp edx, 6
jne 0x104f39b
cmp dword [ebp - 0x118], 0
jne 0x104f39b
cmp dword [ebp - 0x114], 0x1554
jae 0x104f39b
push 0x40
pop eax
jmp 0x104f370
push 0x20
jmp 0x104f398

Function at 0x104f4cb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x1055538], si
jne 0x104f563
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x1011640
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104f563
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10116f8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x104f563
push 3
push dword [esi*8 + 0x1011490]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x104f555
inc esi
cmp esi, 0x1c
jb 0x104f534
jmp 0x104f563
mov ax, word [esi*8 + 0x1011494]
mov word [0x1055538], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x1055538]
xor ecx, ebp
pop esi
call fcn.01035675
leave
ret
Function at 0x403f80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov eax, edx
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov dword [edx*4 + 0x416b20], eax
inc edx
cmp edx, 0x100
jb 0x403f82
push esi
mov eax, 0x416b24
mov esi, 0x1c0
mov edx, dword [eax - 4]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x416b20]
lea eax, [eax + 0x10]
mov dword [eax + 0x3ec], edx
mov edx, dword [eax - 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x416b20]
mov dword [eax + 0x3f0], edx
mov edx, dword [eax - 0xc]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x416b20]
mov dword [eax + 0x3f4], edx
mov edx, dword [eax - 8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x416b20]
mov dword [eax + 0x3f8], edx
dec esi
jne 0x404027
mov dword [0x416b04], 0x4040c0
mov dword [0x416afc], 0x4040c0
mov dword [0x416b00], 0x404160
call fcn.00405c60
mov ecx, dword [0x416afc]
mov edx, 0x404160
test eax, eax
cmove ecx, edx
mov dword [0x416afc], ecx
pop esi
ret

Function at 0x405020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
jne 0x40503a
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x400000
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, esi
cmp esi, 0x400000
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x405089
test ecx, ecx
je 0x405082
mov ecx, 0x400000
test esi, esi
jne 0x405043
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x405120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
jne 0x40513a
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x400000
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, esi
cmp esi, 0x400000
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x405189
test ecx, ecx
je 0x405182
mov ecx, 0x400000
test esi, esi
jne 0x405143
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]