joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ae8e
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101aeb1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
jmp 0x101aef9
cmp dword [ebp + 8], 0
jne 0x101aebb
xor eax, eax
jmp 0x101aef9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
push dword [ebp + 0x14]
neg eax
push dword [ebp + 0x10]
sbb eax, eax
push dword [ebp + 0xc]
and eax, edi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x101b08e
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101b0be
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x101b244
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x101b0d0
and dword [ebp - 8], 0
jmp 0x101b0fe
push dword [ebp + 8]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 8]
push ebx
call fcn.01018b35
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x101b10a
and dword [ebp - 4], 0
jmp 0x101b138
push dword [ebp + 0xc]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01018b35
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x101b16c
push dword [ebp + 0x10]
call esi
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x10]
push edi
call fcn.01018b35
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
cmp dword [ebp + 0x1c], 0
jne 0x101b176
xor esi, esi
jmp 0x101b1a3
push dword [ebp + 0x1c]
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x1c]
push edi
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [ebp + 0x18]
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov eax, esp
push esi
lea esi, [edi + edi]
push esi
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp + 0x10], eax
push dword [ebp - 8]
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0x1c], eax
push dword [ebp + 0x14]
call fcn.01018b5b
test eax, eax
jne 0x101b241
mov eax, edi
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x10]
push ebx
call fcn.01018b5b
test eax, eax
je 0x101b241
xor eax, eax
cmp dword [ebp + 8], eax
je 0x101b227
cmp dword [ebp + 0xc], eax
je 0x101b227
push edi
push ebx
push dword [ebp + 0x14]
mov word [esi + ebx - 2], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [edi - 1]
jmp 0x101b244
push edi
push ebx
push dword [ebp + 0x14]
mov word [esi + ebx - 2], ax
mov word [ebx + edi*2 - 4], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [edi - 2]
jmp 0x101b244
mov eax, dword [ebp + 0x1c]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x101b2e6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101b307
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x101b37c
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
jne 0x101b322
cmp dword [ebp + 8], esi
je 0x101b322
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x101b37c
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x101b379
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push ebx
push dword [ebp - 8]
call edi
test eax, eax
je 0x101b379
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 8]
jbe 0x101b361
mov dword [ebp - 4], eax
jmp 0x101b379
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
call fcn.01018b5b
cmp eax, esi
mov dword [ebp - 4], eax
je 0x101b379
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101b4b9
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101b4db
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x101b542
mov edi, dword [ebp + 0x10]
lea esi, [edi + edi]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0x10], esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x101b531
push 0xffffffffffffffff
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01018b5b
mov ebx, eax
test ebx, ebx
jne 0x101b52e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x101b52e
mov eax, dword [ebp + 0xc]
and word [esi + eax - 2], 0
mov ebx, edi
dec ebx
jmp 0x101b540
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x101b540
test edi, edi
jle 0x101b540
and word [eax], 0
mov eax, ebx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x101b971
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101b993
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x101ba0a
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp dword [ebp + 8], esi
je 0x101b9cd
push dword [ebp + 8]
call edi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push ebx
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x101b9ff
push dword [ebp + 0xc]
call edi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01018b35
neg eax
sbb eax, eax
and eax, ebx
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x101ba19
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101ba38
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x101baac
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp dword [ebp + 8], esi
je 0x101ba72
push dword [ebp + 8]
call edi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push ebx
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x101baa4
push dword [ebp + 0xc]
call edi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01018b35
neg eax
sbb eax, eax
and eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x101bc93
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101bcc9
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x101bde4
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
je 0x101bddf
mov esi, dword [ebp + 0x14]
cmp esi, ecx
je 0x101bddf
mov ebx, dword [ebp + 0x24]
cmp ebx, ecx
jne 0x101bcef
cmp dword [ebp + 0x20], ecx
jne 0x101bddf
cmp dword [ebp + 0x1c], ecx
mov dword [ebp - 8], ecx
jne 0x101bcfd
lea eax, [ebp - 8]
mov dword [ebp + 0x1c], eax
cmp ebx, ecx
mov eax, dword [esi]
mov dword [ebp - 4], eax
je 0x101bd08
mov ecx, dword [ebx]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp + 0x24], ecx
call fcn.01044e40
mov edi, esp
push ebx
push dword [ebp + 0x20]
lea eax, [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x101bdda
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
inc eax
cmp ecx, eax
jae 0x101bd4a
mov eax, ecx
push 0xffffffffffffffff
push eax
push edi
push dword [ebp + 0x10]
call fcn.01018b5b
dec eax
cmp dword [ebp + 0x20], 0
mov dword [esi], eax
je 0x101bdc1
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
test eax, eax
jbe 0x101bdda
cmp eax, 2
jbe 0x101bd7b
cmp eax, 7
jne 0x101bdda
mov dword [ebp + 0x14], 0x80004005
jmp 0x101bdda
mov esi, dword [ebx]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edx, esp
mov ecx, esi
mov esi, dword [ebp + 0x20]
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx]
shr eax, 1
push eax
push edx
push dword [ebp + 0x20]
call fcn.01018b5b
shl eax, 1
mov dword [ebx], eax
jne 0x101bdda
mov dword [ebp + 0x14], 0xea
jmp 0x101bdda
test ebx, ebx
je 0x101bdda
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
test eax, eax
jbe 0x101bdda
cmp eax, 2
jbe 0x101bdd8
cmp eax, 7
jne 0x101bdda
shl dword [ebx], 1
mov eax, dword [ebp + 0x14]
jmp 0x101bde4
mov eax, 0x80004003
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x20

Function at 0x101bdf3
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101be11
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x101be57
cmp dword [ebp + 0xc], 0
jne 0x101be1e
mov eax, 0x3f2
jmp 0x101be57
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.01018b35
neg eax
sbb eax, eax
and eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8
Function at 0x101be65
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101be83
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x101bec3
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x101beb9
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.01018b35
neg eax
sbb eax, eax
and eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8

Function at 0x101c0ab
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.0101a42a
test al, al
je 0x101c0c0
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp + 0xc], 0
je 0x101c0e0
cmp dword [ebp + 0x10], 0
je 0x101c0db
push 4
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x101c0e0
push 0x57
pop eax
jmp 0x101c111
push esi
push dword [ebp + 0x34]
mov esi, dword [ebp + 0x2c]
push dword [ebp + 0x30]
push esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test esi, esi
je 0x101c110
shl dword [esi], 1
pop esi
pop ebp
ret 0x30
Function at 0x101c11a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101c148
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101c23c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x101c182
push dword [ebp + 0xc]
call edi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push ebx
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x101c1f4
cmp eax, 2
je 0x101c1f4
cmp eax, 7
jne 0x101c1eb
mov ebx, dword [ebp + 0x18]
xor eax, eax
test ebx, ebx
jne 0x101c1a1
xor ecx, ecx
jmp 0x101c1e5
push ebx
call fcn.01018bc4
cmp eax, 0xffffffff
push ebx
jne 0x101c1b2
call edi
inc eax
jmp 0x101c1b7
call fcn.01018bc4
lea edi, [eax + eax]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0x18], esp
push ebx
call fcn.01018bc4
push eax
push edi
push ebx
push dword [ebp + 0x18]
call fcn.01018b35
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp + 0x18]
push eax
push ecx
push 7
jmp 0x101c22f
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
jmp 0x101c22f
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 0x18], ecx
je 0x101c22a
push dword [ebp + 0x18]
call edi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x18]
push ebx
call fcn.01018b35
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, ebx
push eax
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x101c24b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101c27b
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x101c3c9
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x101c286
xor esi, esi
jmp 0x101c2b7
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.01018b35
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x101c3c9
cmp dword [ebp + 0x18], ebx
mov ecx, dword [ebp - 4]
jne 0x101c315
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x101c303
cmp ecx, ebx
jbe 0x101c2fe
cmp ecx, 2
jbe 0x101c2f7
cmp ecx, 7
jne 0x101c2fe
mov edx, dword [ebp - 8]
add edx, edx
jmp 0x101c301
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x101c3c6
mov dword [eax], ecx
jmp 0x101c3c6
cmp ecx, ebx
jbe 0x101c32a
cmp ecx, 2
jbe 0x101c323
cmp ecx, 7
jne 0x101c32a
mov eax, dword [ebp - 8]
add eax, eax
jmp 0x101c32d
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x1c]
cmp dword [ebx], eax
jae 0x101c348
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101c33f
mov dword [eax], ecx
mov dword [ebp + 0xc], 0xea
jmp 0x101c3c6
test ecx, ecx
jbe 0x101c3b3
cmp ecx, 2
jbe 0x101c356
cmp ecx, 7
jne 0x101c3b3
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0x1c], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x101c3c6
cmp dword [ebp - 4], eax
jbe 0x101c3c6
cmp dword [ebp - 4], 2
jbe 0x101c390
cmp dword [ebp - 4], 7
jne 0x101c3c6
push dword [ebp - 8]
push dword [ebx]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.01018b5b
shl eax, 1
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101c3c6
mov ecx, dword [ebp - 4]
jmp 0x101c30e
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x101c8ff
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101c91d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x101c960
cmp dword [ebp + 8], 0
jne 0x101c927
xor eax, eax
jmp 0x101c960
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
push dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8
Function at 0x101c9fe
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101ca49
mov eax, dword [0x104a2ac]
test eax, eax
jne 0x101ca3f
push 0x10034f0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x10034e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x104a2ac], eax
je 0x101cbb6
push dword [ebp + 8]
call eax
jmp 0x101cbb6
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
push 0xf
pop ecx
mov esi, ebx
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x101ca69
and dword [ebp - 0x30], 0
jmp 0x101ca99
push eax
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push edi
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.01018b35
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x101caa5
and dword [ebp - 0x2c], eax
jmp 0x101caf0
push eax
call fcn.01018bc4
cmp eax, 0xffffffff
push dword [ebx + 0x10]
jne 0x101cab8
call esi
inc eax
jmp 0x101cabd
call fcn.01018bc4
lea edi, [eax + eax]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 8], esp
push dword [ebx + 0x10]
call fcn.01018bc4
push eax
push edi
push dword [ebx + 0x10]
push dword [ebp + 8]
call fcn.01018b35
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x101cafc
and dword [ebp - 0x28], eax
jmp 0x101cb2c
push eax
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push edi
push dword [ebx + 0x14]
push dword [ebp + 8]
call fcn.01018b35
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x101cb38
and dword [ebp - 0x24], eax
jmp 0x101cb68
push eax
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push edi
push dword [ebx + 0x18]
push dword [ebp + 8]
call fcn.01018b35
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x101cb74
and dword [ebp - 0x14], eax
jmp 0x101cba0
push eax
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebx + 0x28]
push edi
call fcn.01018b35
neg eax
sbb eax, eax
and eax, edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 0x1c]
mov dword [ebx + 0x20], ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101ce08
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101ce3e
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101cefe
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp esi, ebx
je 0x101ce63
mov eax, dword [esi]
shl eax, 1
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 4], eax
je 0x101ce66
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0x14], esp
jmp 0x101ce69
mov dword [ebp - 4], ebx
mov dword [ebp + 0x14], ebx
mov edi, dword [ebp + 0x20]
cmp edi, ebx
je 0x101ce8c
mov eax, dword [edi]
shl eax, 1
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 8], eax
je 0x101ce8f
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov dword [ebp + 0x20], esp
jmp 0x101ce92
mov dword [ebp - 8], ebx
mov dword [ebp + 0x20], ebx
push dword [ebp + 0x24]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 4]
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
jne 0x101cefe
cmp esi, ebx
je 0x101ced4
push 0xffffffffffffffff
push dword [esi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.01018b5b
cmp dword [ebp - 4], ebx
je 0x101ced2
cmp eax, ebx
je 0x101cef5
mov dword [esi], eax
cmp edi, ebx
je 0x101cefc
cmp dword [ebp + 0x1c], ebx
je 0x101cefc
push 0xffffffffffffffff
push dword [edi]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call fcn.01018b5b
cmp dword [ebp - 8], ebx
je 0x101cefa
cmp eax, ebx
jne 0x101cefa
push 0x6f
pop eax
jmp 0x101cefe
mov dword [edi], eax
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x20

Function at 0x101cf91
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0101a42a
test al, al
je 0x101cfb6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x101d012
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x101d003
cmp dword [ebp + 0x10], 0
je 0x101d003
lea esi, [edi + edi]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01044e40
mov ebx, esp
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x101cff4
push eax
push edi
push ebx
push dword [ebp + 0x10]
call fcn.01018b5b
jmp 0x101d012
test edi, edi
jle 0x101cfff
mov eax, dword [ebp + 0x10]
and word [eax], 0
xor eax, eax
jmp 0x101d012
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10