joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b786
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0101b71b
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x101b7f9
cmp dword [ebp - 0x94], 5
jb 0x101b81a
jmp 0x101b816
cmp dword [ebp - 0x88], 1
jne 0x101b81a
cmp dword [ebp - 0x94], 4
ja 0x101b816
jne 0x101b81a
cmp dword [ebp - 0x90], 0
jbe 0x101b81a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10036b8
call fcn.010154fd
test eax, eax
jge 0x101b83b
mov byte [0x1031638], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0101bc5d
leave
ret
Function at 0x101bb77
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x102d670
call fcn.0101beec
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1036ea0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101b932
cmp eax, esi
jne 0x101b925
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x101b935
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101b90c
xor esi, esi
inc esi
mov eax, dword [0x1036e9c]
cmp eax, esi
jne 0x101b948
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101b977
mov eax, dword [0x1036e9c]
test eax, eax
jne 0x101b971
mov dword [0x1036e9c], esi
push 0x1001718
push 0x100170c
call fcn.0101b86e
pop ecx
pop ecx
test eax, eax
je 0x101b977
jmp 0x101ba9b
mov dword [0x1036b4c], esi
mov eax, dword [0x1036e9c]
cmp eax, esi
jne 0x101b99b
push 0x1001708
push 0x10016f0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1036e9c], 2
cmp dword [ebp - 0x20], ebx
jne 0x101b9a8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1036eac], ebx
je 0x101b9c9
push 0x1036eac
call fcn.0101c289
pop ecx
test eax, eax
je 0x101b9c9
push ebx
push 2
push ebx
call dword [0x1036eac]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x101ba9b
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x101ba33
cmp cx, bx
je 0x101b9ee
cmp dword [ebp - 0x1c], ebx
jne 0x101ba33
movzx ecx, word [eax]
cmp cx, bx
je 0x101ba03
cmp cx, 0x20
ja 0x101ba03
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x101b9ee
test byte [ebp - 0x40], 1
je 0x101ba0f
movzx ecx, word [ebp - 0x3c]
jmp 0x101ba12
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1036b48], eax
cmp dword [0x1036b3c], ebx
jne 0x101ba78
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x101ba44
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x101b9d8
cmp dword [0x1036b4c], ebx
jne 0x101ba86
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1036b48]
jmp 0x101baa7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0101bf31
ret
call fcn.0101c3d6
jmp 0x101b8cf
Function at 0x101cdc1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x1c
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x101cdec
mov dword [ebp + 8], 8
jmp 0x101ce6c
push edi
push 7
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
push edi
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x10]
push eax
push ebx
push esi
push 0x101cd30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x101ce36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x101ce31
mov eax, 0x54f
mov dword [ebp + 8], eax
jmp 0x101ce51
lea eax, [edi + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [eax + 4], esi
inc dword [edi + 0x34]
inc dword [edi + 0x3c]
xor esi, esi
mov dword [ebp + 8], ebx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
cmp esi, ebx
je 0x101ce6c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x101d6db
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test byte [esi + 0x14], 4
je 0x101d722
mov eax, dword [esi]
test eax, eax
je 0x101d700
push 2
push dword [esi + 4]
push esi
call eax
test eax, eax
je 0x101d700
or dword [esi + 0x14], 8
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x101d716
or dword [esi + 0x14], 8
test byte [esi + 0x14], 8
je 0x101d722
push esi
call fcn.0101d070
pop esi
pop ebp
ret 4
Function at 0x101f1d6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x60
xor edi, edi
push edi
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x101f217
push 8
pop ebx
jmp 0x101f36b
push 0x60
push edi
push esi
call sub.msvcrt.dll_memset
lea eax, [esi + 0x18]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x20]
mov dword [eax + 4], eax
mov dword [eax], eax
add esp, 0xc
lea eax, [esi + 0x30]
push esi
mov dword [eax + 4], eax
mov dword [eax], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x50], 0x65
mov dword [esi + 0x54], 0x32
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1036e80
mov dword [ebp - 0x88], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push eax
push 0x1003858
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.0101d67b
push 0x30
pop ebx
push ebx
lea eax, [ebp - 0xbc]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x94], eax
add esp, 0x20
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], 0x800
mov dword [ebp - 0xb4], 0x101e34b
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov word [esi + 0x38], ax
cmp ax, di
jne 0x101f2ed
push 0x583
call fcn.0101cf8b
mov ebx, eax
jmp 0x101f34d
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 0x2c], eax
cmp eax, edi
jne 0x101f312
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x101f2e9
mov eax, 0x54f
jmp 0x101f2e9
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 0x4c], eax
cmp eax, edi
je 0x101f301
lea eax, [esi + 0x44]
push eax
push edi
push esi
push 0x101f094
push edi
push edi
mov dword [esi + 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x40], eax
cmp eax, edi
je 0x101f301
mov eax, dword [ebp - 0x8c]
mov dword [eax], esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0x88], edi
je 0x101f361
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, edi
je 0x101f36b
push esi
call fcn.0101ded9
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 8
Function at 0x101f4d6
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x101f517
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x101f510
mov eax, 0x54f
mov ebx, eax
jmp 0x101f5a1
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
mov ebx, eax
cmp ecx, 0xffffffff
jne 0x101f53c
cmp ebx, edi
jne 0x101f58b
cmp dword [ebp - 0xc], edi
je 0x101f546
push 0x18
pop ebx
jmp 0x101f58b
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x101f54f
mov dword [eax], ecx
push edi
push edi
push edi
push 2
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x101f574
call esi
cmp eax, edi
jne 0x101f570
mov eax, 0x54f
mov ebx, eax
jmp 0x101f58b
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
je 0x101f565
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor ebx, ebx
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 4], edi
je 0x101f5a0
push dword [ebp - 4]
call esi
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x101f5ae
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
and dword [ebp + 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
add eax, edx
add ecx, esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0x10], ecx
cmp edx, eax
jae 0x101f69c
mov eax, dword [ebp - 0xc]
push 3
sub eax, edx
pop ecx
mov dword [ebp - 8], eax
cmp eax, ecx
jb 0x101f607
movzx eax, byte [edx]
movzx ebx, byte [edx + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [edx + 2]
push 4
shl eax, 8
mov dword [ebp - 8], ecx
pop edi
or eax, ebx
jmp 0x101f624
push 2
pop edi
cmp eax, edi
movzx eax, byte [edx]
jne 0x101f621
movzx ebx, byte [edx + 1]
shl eax, 8
or eax, ebx
mov edi, ecx
shl eax, 8
jmp 0x101f624
shl eax, 0x10
mov dword [ebp + 0xc], 4
sub dword [ebp + 0xc], edi
mov dword [ebp + 0x14], ecx
lea ebx, [esi + 1]
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x14], ecx
jl 0x101f661
mov ecx, dword [ebp - 4]
mov edi, eax
shr edi, cl
and edi, 0x3f
cmp edi, 0x41
jae 0x101f6a5
cmp esi, dword [ebp + 0x10]
jae 0x101f6ac
mov cl, byte [edi + 0x1003990]
mov byte [esi], cl
jmp 0x101f669
cmp esi, dword [ebp + 0x10]
jae 0x101f6ac
mov byte [esi], 0x3d
inc esi
inc ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x4c
jb 0x101f687
cmp ebx, dword [ebp + 0x10]
jae 0x101f6ac
mov byte [esi], 0xd
inc esi
inc ebx
mov byte [esi], 0xa
inc esi
inc ebx
and dword [ebp + 8], 0
dec dword [ebp + 0x14]
sub dword [ebp - 4], 6
jns 0x101f63b
add edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jb 0x101f5db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, 0x54f
jmp 0x101f69e
push 0x7a
pop eax
jmp 0x101f69e
Function at 0x101fedd
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x208], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x20c], eax
push 0x88
lea eax, [ebp - 0x208]
push eax
call fcn.0101cfa6
mov esi, dword [ebp - 0x208]
mov edi, eax
test edi, edi
jne 0x1020012
or dword [esi], 0xffffffff
or dword [esi + 0x84], 1
push edi
push edi
push 2
push edi
push edi
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x101ff62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x101ff5b
mov eax, 0x54f
mov edi, eax
jmp 0x1020012
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x1036e84
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push dword [ebp - 0x210]
lea edi, [esi + 4]
push dword [ebp - 0x214]
push dword [0x1030140]
push 0x80
push edi
call fcn.0100c705
add esp, 0x1c
test eax, eax
jl 0x101ff5b
push edi
push dword [0x103013c]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0100c705
add esp, 0x10
test eax, eax
jl 0x101ff5b
lea eax, [ebp - 0x204]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101ffd3
push 0
lea ecx, [ebp - 0x218]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x204]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1020006
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x101ff54
mov eax, dword [ebp - 0x20c]
mov dword [eax], esi
xor esi, esi
xor edi, edi
test esi, esi
je 0x102001c
push esi
call fcn.0101f3b9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 8
Function at 0x1020360
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push dword [0x1030148]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0100c705
add esp, 0x10
test eax, eax
jl 0x10203e4
lea eax, [ebp - 0x204]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10203a4
push 0
lea ecx, [ebp - 0x208]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x204]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10203db
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10203e4
mov eax, 0x54f
jmp 0x10203e4
or dword [esi + 0x84], 2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0101bc5d
leave
ret 4

Function at 0x10204bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0101f76f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x10204fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10204f5
mov eax, 0x54f
mov edi, eax
jmp 0x102059c
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x10204e6
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10204e6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10204e6
cmp dword [ebp + 0x18], 0
jne 0x1020548
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x1c]
push edi
push eax
call fcn.0101f3f1
mov edi, eax
test edi, edi
jne 0x1020584
mov ebx, dword [ebp - 4]
jmp 0x102054f
shr edi, 1
mov ebx, eax
mov dword [ebp + 0xc], edi
push dword [ebp + 0xc]
push esi
call fcn.0101f791
mov edi, eax
test edi, edi
jne 0x1020584
push dword [ebp + 0xc]
push ebx
push dword [esi + 8]
push dword [esi]
call fcn.0101fd24
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1020571
sub eax, ecx
sar eax, 1
mov dword [esi + 4], eax
xor edi, edi
cmp dword [ebp - 4], 0
je 0x102059c
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1020f0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x524], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x100
lea eax, [ebp - 0x204]
push eax
mov eax, dword [esi]
add eax, 0x28
push eax
call fcn.0101fc37
mov ebx, eax
test ebx, ebx
jne 0x1021157
lea eax, [ebp - 0x204]
push eax
lea eax, [esi + 0x338]
push eax
push 0x10043fc
push dword [edi + 4]
push edi
call fcn.0102049d
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1021157
push 0x100
lea eax, [ebp - 0x204]
push eax
mov eax, dword [esi]
add eax, 0x28
push eax
call fcn.0101fcbe
mov ebx, eax
test ebx, ebx
jne 0x1021157
lea eax, [ebp - 0x204]
push eax
push 0x10043ec
push dword [edi + 4]
push edi
call fcn.0102049d
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1021157
push 0x100
lea eax, [ebp - 0x204]
push eax
mov eax, dword [esi]
add eax, 0x30
push eax
call fcn.0101fcbe
mov ebx, eax
test ebx, ebx
jne 0x1021157
lea eax, [ebp - 0x204]
push eax
push 0x10043dc
push dword [edi + 4]
push edi
call fcn.0102049d
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1021157
mov eax, dword [esi]
push dword [eax + 0x10]
lea ecx, [esi + 0xfb8]
push ecx
push dword [eax + 0x14]
lea ecx, [esi + 0xef0]
push ecx
push dword [eax + 0xc]
lea eax, [esi + 0xe28]
push eax
push 0x10043a4
push dword [edi + 4]
push edi
call fcn.0102049d
mov ebx, eax
add esp, 0x24
test ebx, ebx
jne 0x1021157
mov ebx, 0x11c
push ebx
push eax
lea eax, [ebp - 0x520]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x520]
push eax
mov dword [ebp - 0x520], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1021081
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1021155
mov eax, 0x54f
jmp 0x1021155
lea eax, [ebp - 0x528]
push eax
movzx eax, word [ebp - 0x40a]
push eax
movzx eax, word [ebp - 0x40c]
push eax
push dword [ebp - 0x518]
push dword [ebp - 0x51c]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x1021069
lea eax, [ebp - 0x524]
push eax
push 0x1004348
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test ebx, ebx
jne 0x1021157
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push 0x1004330
push dword [ebp - 0x524]
mov dword [ebp - 0x52c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x1021157
push dword [ebp - 0x528]
mov word [ebp - 0x206], ax
push dword [ebp - 0x510]
movzx eax, word [ebp - 0x40a]
push eax
movzx eax, word [ebp - 0x40c]
push eax
push dword [ebp - 0x518]
lea eax, [ebp - 0x404]
push dword [ebp - 0x51c]
add esi, 0x270
push eax
push esi
push 0x10042f0
push dword [edi + 4]
push edi
call fcn.0102049d
add esp, 0x2c
mov ebx, eax
cmp dword [ebp - 0x524], 0
je 0x102116c
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 8
Function at 0x1022c12
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x18c8
call fcn.0101bc80
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
mov dword [ebp - 0x18c0], eax
xor eax, eax
lea edi, [ebp - 0x18c8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x720], ax
lea eax, [ebp - 0x18c8]
push eax
call fcn.01022a4f
mov edi, eax
test edi, edi
jne 0x1022de5
mov eax, dword [esi + 8]
xor ecx, ecx
cmp cx, word [eax]
je 0x1022cac
lea eax, [ebp - 0x720]
push eax
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1022c96
cmp eax, edi
jae 0x1022c96
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1022cac
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1022ca5
mov eax, 0x54f
mov edi, eax
jmp 0x1022de5
test byte [esi + 0xc], 1
je 0x1022cdc
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1022cdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x1022cdc
cmp edi, 0x490
je 0x1022cdc
cmp edi, 2
jne 0x1022de5
mov edi, 0x978
push edi
lea eax, [ebp - 0x18bc]
push 0
push eax
call sub.msvcrt.dll_memset
or dword [ebp - 0x1870], 0xffffffff
add esp, 0xc
mov dword [ebp - 0x18bc], edi
lea eax, [ebp - 0x108]
mov dword [ebp - 0x187c], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x310]
push eax
push dword [esi + 4]
mov dword [ebp - 0x18b8], 4
push 0
mov dword [ebp - 0x1898], 5
mov dword [ebp - 0x188c], 1
mov dword [ebp - 0x1880], 0x1022bd1
call dword [sym.imp.SHLWAPI.dll_Ordinal_216]
test eax, eax
jg 0x1022d5a
mov edi, 0x80004005
jmp 0x1022de5
push 0x824
lea eax, [ebp - 0xf44]
push eax
lea eax, [ebp - 0x310]
push eax
push 0xfde9
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToAnsiCP]
test eax, eax
jle 0x1022d50
xor esi, esi
lea eax, [ebp - 0xf44]
mov dword [ebp - 0x18b4], eax
cmp dword [ebp + 0x10], esi
jbe 0x1022de3
mov eax, dword [ebp - 0x18c0]
push dword [eax + esi*4]
lea eax, [ebp - 0x108]
push 0x100531c
push 0x1005328
push edi
push eax
call fcn.0100c705
add esp, 0x14
test eax, eax
jl 0x1022ca5
lea eax, [ebp - 0x108]
mov dword [ebp - 0x18b0], eax
lea eax, [ebp - 0x18bc]
push eax
call fcn.01023f75
test eax, eax
jne 0x1022e1b
or dword [ebp - 0x1870], 0xffffffff
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x1022d8f
xor edi, edi
xor eax, eax
cmp ax, word [ebp - 0x720]
je 0x1022dfd
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x18c8]
push eax
call fcn.01022a0e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0101bc5d
leave
ret 0xc
mov edi, 0x3e4
jmp 0x1022de5
Function at 0x1022e27
Capabilities:
Get session information
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 5
push 0xffffffffffffffff
mov dword [esi], ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [edi], ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1022e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1022e68
mov eax, 0x54f
mov esi, eax
jmp 0x1022e94
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 7
push 0xffffffffffffffff
push ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1022e59
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [edi], eax
mov dword [ebp - 8], ebx
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x1022ea1
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 8], ebx
je 0x1022eae
push dword [ebp - 8]
call sub.WTSAPI32.dll_WTSFreeMemory
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8