joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10128b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 3
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1012937
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1012910
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x101292e
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x101293f
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 3
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10129ad
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10129a4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jb 0x10129a4
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x1012a51
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push 0x10046f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1012ba2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 4]
push eax
push 0x1037824
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10046d8
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x1037828
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10046c0
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x1037838
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x100469c
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x103782c
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1004674
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x1037834
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1004650
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x1037830
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1004624
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x10360c8
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10045f4
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
push 0x10360d0
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10045c0
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
push eax
push 0x10360cc
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1004594
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
push 0x10360c4
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1004564
push dword [ebp - 8]
mov dword [ebp - 4], edi
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1012cd4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10046f0
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1012d24
mov eax, dword [edi + 0x10]
lea eax, [eax + eax + 2]
push eax
push dword [edi + 0xc]
push 1
push esi
push 0x1004748
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x101563c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x1036118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x18]
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
call fcn.0100c141
push 0
push ebx
lea ecx, [ebp - 0x9c]
call fcn.0101368e
push dword [ebp - 0xa4]
push dword [esi + 0xc]
push dword [ebp - 0xa0]
push 0
push dword [ebp - 0x90]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x9c]
mov esi, eax
mov dword [ebp - 0x9c], 0x1004b94
call fcn.0101889f
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101f9b2
leave
ret 0x14

Function at 0x101611e
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push 0x10046f0
mov edi, 0x80000001
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x101617d
mov ecx, dword [ebp + 8]
push 0x104
push 0x1004748
push dword [ebp - 8]
call fcn.01015d95
test eax, eax
jl 0x101616f
mov dword [ebp - 4], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
jne 0x10161b9
lea eax, [ebp - 0xc]
push eax
push 1
push ebx
push 0x1004930
push edi
call esi
test eax, eax
jne 0x10161b9
mov ecx, dword [ebp + 8]
push 0x104
push 0x100491c
push dword [ebp - 0xc]
call fcn.01015d95
test eax, eax
jl 0x10161b0
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10183a1
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1036118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x1004b38
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x101840c
push 0x1004b24
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1018405
lea ecx, [ebp - 0x13c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x108], 2
pop esi
jne 0x101842f
cmp word [ebp - 0x13c], 6
je 0x101842a
cmp word [ebp - 0x13c], 9
jne 0x101842f
xor eax, eax
inc eax
jmp 0x1018431
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0101f9b2
leave
ret

Function at 0x101ea76
Capabilities:
Accept command line arguments

Disassembly:
push 0xf0
push 0x10345f8
call fcn.01022024
push dword [0x1036100]
call fcn.01021fe3
pop ecx
mov dword [0x1036100], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x101ea66
mov ecx, dword [ebp - 0xa4]
and ecx, 0x7fff
mov edi, dword [ebp - 0xa0]
cmp edi, 2
je 0x101e90d
or ecx, 0x8000
mov edx, dword [ebp - 0xac]
mov eax, edx
shl eax, 8
mov esi, dword [ebp - 0xa8]
add eax, esi
mov dword [0x1037874], edi
mov dword [0x103787c], eax
mov dword [0x1037880], edx
mov dword [0x1037884], esi
mov dword [0x1037878], ecx
call fcn.0101e84d
mov dword [ebp - 0xb8], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.01021f18
pop ecx
test eax, eax
jne 0x101e95e
push 0x1c
call fcn.0101e81f
pop ecx
call fcn.01021d37
test eax, eax
jne 0x101e96f
push 0x10
call fcn.0101e81f
pop ecx
mov dword [ebp - 4], ebx
call fcn.010215ff
test eax, eax
jge 0x101e983
push 0x1b
call fcn.010209d5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1039478], eax
call fcn.010214c3
mov dword [0x103785c], eax
call fcn.010213cf
test eax, eax
jge 0x101e9a9
push 8
call fcn.010209d5
pop ecx
call fcn.010210b1
test eax, eax
jge 0x101e9ba
push 9
call fcn.010209d5
pop ecx
push ebx
call fcn.01020b15
pop ecx
test eax, eax
je 0x101e9cc
push eax
call fcn.010209d5
pop ecx
call fcn.0102104d
test byte [ebp - 0xd4], bl
je 0x101e9e2
movzx ecx, word [ebp - 0xd0]
jmp 0x101e9e5
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call main
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb8], 0
jne 0x101ea08
push eax
call fcn.01020c75
call fcn.01020cab
jmp 0x101ea49
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0xb4]
jmp 0x101ea6b
mov eax, 0xff
call fcn.0102206c
ret
call fcn.01022211
jmp 0x101e899
Function at 0x10200cf
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x1020100
call fcn.010223a9
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01022352
add esp, 0x14
or eax, 0xffffffff
jmp 0x102017c
push esi
call fcn.01021974
push 0x214
push 1
call fcn.010297ed
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x1020164
call fcn.01021b55
push dword [eax + 0x6c]
push esi
call fcn.01021a07
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
pop ecx
pop ecx
mov dword [esi + 0x54], edi
cmp eax, ebx
jne 0x1020141
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x1020053
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x102017b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call fcn.0101f40a
pop ecx
cmp dword [ebp - 4], ebx
je 0x1020179
push dword [ebp - 4]
call fcn.010223d9
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x1020d1a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x1036128]
je 0x1020d40
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x17
jb 0x1020d2e
cmp esi, 0x17
jae 0x1020e9a
push 3
call fcn.0102a7e6
pop ecx
cmp eax, 1
je 0x1020e64
push 3
call fcn.0102a7e6
pop ecx
test eax, eax
jne 0x1020d73
cmp dword [0x1036100], 1
je 0x1020e64
cmp edi, 0xfc
je 0x1020e9a
push 0x1008a8c
mov edi, 0x314
push edi
mov esi, 0x10378b8
push esi
call fcn.0102277a
add esp, 0xc
test eax, eax
je 0x1020da9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.010222a7
add esp, 0x14
mov byte [0x10379d5], bl
push 0x104
mov ebx, 0x10378d1
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1020dec
push 0x1008a74
push 0x2fb
push ebx
call fcn.0102277a
add esp, 0xc
test eax, eax
je 0x1020dec
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.010222a7
add esp, 0x14
push ebx
push edi
push esi
call fcn.0102a76d
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x1020e0a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.010222a7
add esp, 0x14
push 0x1008a70
push edi
push esi
call fcn.0102a76d
add esp, 0xc
test eax, eax
je 0x1020e2a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.010222a7
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x103612c]
push edi
push esi
call fcn.0102a76d
add esp, 0xc
test eax, eax
je 0x1020e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.010222a7
add esp, 0x14
push 0x12010
push 0x1008a48
push esi
call fcn.0102a5c6
add esp, 0xc
jmp 0x1020e9a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x1020e9a
cmp edi, 0xffffffff
je 0x1020e9a
mov edx, dword [esi*8 + 0x103612c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1020e83
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1021d37
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x1008ab8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x1021d89
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1008b24
push edi
call esi
push 0x1008b18
push edi
mov dword [0x1037cdc], eax
call esi
push 0x1008b0c
push edi
mov dword [0x1037ce0], eax
call esi
push 0x1008b04
push edi
mov dword [0x1037ce4], eax
call esi
mov dword [0x1037ce8], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x1037cdc], ebx
je 0x1021daf
cmp dword [0x1037ce0], ebx
je 0x1021daf
cmp dword [0x1037ce4], ebx
je 0x1021daf
cmp dword [0x1037ce8], ebx
jne 0x1021dd3
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x1037ce0], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x1037cdc], 0x102193c
mov dword [0x1037ce4], esi
mov dword [0x1037ce8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x103628c], eax
cmp eax, 0xffffffff
je 0x1021e46
push dword [0x1037ce0]
push eax
call esi
test eax, eax
je 0x1021e46
call fcn.01020cd3
push dword [0x1037cdc]
call fcn.0102183e
push dword [0x1037ce0]
mov dword [0x1037cdc], eax
call fcn.0102183e
push dword [0x1037ce4]
mov dword [0x1037ce0], eax
call fcn.0102183e
push dword [0x1037ce8]
mov dword [0x1037ce4], eax
call fcn.0102183e
add esp, 0x10
mov dword [0x1037ce8], eax
call fcn.0102416f
test eax, eax
jne 0x1021e4c
call fcn.010219c5
xor eax, eax
pop edi
pop esi
pop ebx
ret
push fcn.01021b74
push dword [0x1037cdc]
call fcn.010218c4
pop ecx
call eax
mov dword [0x1036290], eax
cmp eax, 0xffffffff
je 0x1021e41
push 0x214
push 1
call fcn.0102a8ab
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x1021e41
push esi
push dword [0x1036290]
push dword [0x1037ce4]
call fcn.010218c4
pop ecx
call eax
test eax, eax
jne 0x1021e9f
push esi
call fcn.0101f40a
pop ecx
jmp 0x1021e41
push ebx
push esi
call fcn.01021a07
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x1021e48
Function at 0x1022e94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and al, 8
push esi
push dword [ebp + 0x18]
movsx esi, al
mov eax, dword [ebp + 0x10]
neg esi
sbb esi, esi
dec dword [edi]
movzx eax, word [eax]
push eax
call fcn.01022e40
mov eax, dword [ebp + 8]
pop ecx
and eax, 1
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1022ede
mov eax, dword [ebp + 0x14]
dec dword [ebp + 0x14]
test eax, eax
je 0x1022fd3
push dword [ebp + 0x18]
inc dword [edi]
call fcn.0102ace5
pop ecx
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov ecx, 0xffff
mov word [ebp - 0x10], ax
cmp cx, ax
je 0x1022fc0
test byte [ebp + 8], 0x10
jne 0x1022f59
test byte [ebp + 8], 0x20
je 0x1022f1f
cmp ax, 9
jb 0x1022f19
cmp ax, 0xd
jbe 0x1022f1f
cmp ax, 0x20
jne 0x1022f59
test byte [ebp + 8], 0x40
je 0x1022fc0
mov cx, ax
shr cx, 3
movzx edx, cx
cmp ax, dx
jb 0x1022fc0
mov ecx, eax
and ecx, 7
xor eax, eax
inc eax
shl eax, cl
movzx ecx, dx
mov edx, dword [ebp + 0xc]
movsx ecx, byte [ecx + edx]
xor ecx, esi
test ecx, eax
je 0x1022fc0
mov eax, dword [ebp - 0x10]
test byte [ebp + 8], 4
jne 0x1022fb7
test byte [ebp + 8], 2
je 0x1022f72
mov ecx, dword [ebx]
mov word [ecx], ax
add dword [ebx], 2
jmp 0x1022eca
and dword [ebp - 8], 0
push eax
push 5
push dword [ebx]
lea eax, [ebp - 8]
push eax
call fcn.0102b1c5
xor ecx, ecx
add esp, 0x10
cmp eax, ecx
je 0x1022fad
cmp eax, 0x16
je 0x1022f9b
cmp eax, 0x22
jne 0x1022eca
push ecx
push ecx
push ecx
push ecx
push ecx
call fcn.010222a7
add esp, 0x14
jmp 0x1022eca
mov eax, dword [ebp - 8]
add dword [ebx], eax
jmp 0x1022eca
add dword [ebp - 4], 2
jmp 0x1022eca
dec dword [edi]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push dword [ebp + 0x18]
push eax
call fcn.01022e40
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop esi
cmp eax, dword [ebx]
je 0x1023002
test byte [ebp + 8], 4
jne 0x1022ffe
mov eax, dword [ebp + 0x1c]
inc dword [eax]
test byte [ebp + 8], 0x10
jne 0x1022ffe
test byte [ebp + 8], 2
mov eax, dword [ebx]
je 0x1022ffb
xor ecx, ecx
mov word [eax], cx
jmp 0x1022ffe
mov byte [eax], 0
xor eax, eax
leave
ret
or eax, 0xffffffff
leave
ret
Function at 0x102a5c6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.010218b6
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x10381d4], ebx
jne 0x102a69f
push ebx
push ebx
push 0x1008d7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x102a60a
xor eax, eax
jmp 0x102a763
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1008d70
push edi
call esi
cmp eax, ebx
je 0x102a603
push eax
call fcn.0102183e
mov dword [esp], 0x1008d60
push edi
mov dword [0x10381d4], eax
call esi
push eax
call fcn.0102183e
mov dword [esp], 0x1008d4c
push edi
mov dword [0x10381d8], eax
call esi
push eax
call fcn.0102183e
mov dword [0x10381dc], eax
lea eax, [ebp - 8]
push eax
call fcn.01020a8e
pop ecx
pop ecx
test eax, eax
je 0x102a66d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.010222a7
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x102a69f
push 0x1008d30
push edi
call esi
push eax
call fcn.0102183e
pop ecx
mov dword [0x10381e4], eax
cmp eax, ebx
je 0x102a69f
push 0x1008d18
push edi
call esi
push eax
call fcn.0102183e
pop ecx
mov dword [0x10381e0], eax
mov eax, dword [0x10381e0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x102a718
cmp dword [0x10381e4], esi
je 0x102a718
push eax
call fcn.010218c4
pop ecx
call eax
cmp eax, ebx
je 0x102a6e5
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x10381e4]
call fcn.010218c4
pop ecx
call eax
test eax, eax
je 0x102a6e5
test byte [ebp - 0x18], 1
jne 0x102a718
lea eax, [ebp - 0xc]
push eax
call fcn.01020acf
pop ecx
test eax, eax
je 0x102a700
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.010222a7
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x102a70f
or dword [ebp + 0x10], 0x200000
jmp 0x102a749
or dword [ebp + 0x10], 0x40000
jmp 0x102a749
mov eax, dword [0x10381d8]
cmp eax, esi
je 0x102a749
push eax
call fcn.010218c4
pop ecx
call eax
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x102a749
mov eax, dword [0x10381dc]
cmp eax, esi
je 0x102a749
push dword [ebp - 4]
push eax
call fcn.010218c4
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x10381d4]
call fcn.010218c4
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102f8b9
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1036118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
call fcn.01020a8e
pop ecx
test eax, eax
je 0x102f8ee
push esi
push esi
push esi
push esi
push esi
call fcn.010222a7
add esp, 0x14
push 4
pop eax
call fcn.01032470
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102fa0a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec edi
neg edi
sbb edi, edi
and edi, 0x103
inc edi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], esi
jne 0x102f983
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1008cf8
call esi
test eax, eax
jne 0x102f95a
push 0x1004b38
call esi
test eax, eax
je 0x102f983
push 0x100a05c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x102f983
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
call eax
cmp eax, 1
jne 0x102f983
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x102f983
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea esi, [ebx - 1]
push esi
push dword [ebp - 8]
call fcn.010211bc
add esp, 0xc
test eax, eax
jl 0x102fa0a
not esi
and dword [ebp - 8], esi
je 0x102f9b5
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.010211bc
add esp, 0xc
test eax, eax
jl 0x102fa0a
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x102f9c0
mov dword [ebp - 8], eax
lea esi, [ebx - 1]
not esi
and esi, dword [ebp - 0x14]
sub esi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x102f9d4
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp esi, ebx
jb 0x102fa0a
push 4
push 0x1000
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x102fa0a
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x102fa0a
xor eax, eax
inc eax
jmp 0x102fa0c
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0101f9b2
leave
ret
Function at 0x401920
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x401958
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x401946
mov al, 1
jmp 0x4019b7
cmp dword [ebx + 0x54], ecx
jne 0x40194f
mov al, 2
jmp 0x4019b7
cmp dword [ebx + 0x7c], ecx
jne 0x4019b7
mov al, 3
jmp 0x4019b7
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x40196d
mov al, 4
jmp 0x4019b7
cmp ecx, 5
jne 0x40198d
cmp ebx, 0
jne 0x40197b
mov al, 5
jmp 0x4019b7
cmp ebx, 1
jne 0x401984
mov al, 6
jmp 0x4019b7
cmp ebx, 2
jne 0x40198d
mov al, 7
jmp 0x4019b7
cmp ecx, 6
jne 0x4019b5
cmp ebx, 0
jne 0x40199b
mov al, 8
jmp 0x4019b7
cmp ebx, 1
jne 0x4019a2
mov al, 9
cmp ebx, 2
jne 0x4019a9
mov al, 0xa
cmp ebx, 3
jne 0x4019b0
mov al, 0xb
cmp ebx, 4
jne 0x4019b7
mov al, 0xc
pop ebx
leave
ret