joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b50
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
push esi
mov esi, ecx
je 0x10083c0
push edi
xor edi, edi
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x10083ca
cmp eax, edi
je 0x10083e7
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x10083fb
push 2
pop ecx
cmp ebx, ecx
jne 0x1002bca
push 4
pop ecx
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
je 0x10083fb
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 8
cmp ebx, 4
jne 0x10083ee
jmp 0x1002bab
mov eax, 0x8000ffff
jmp 0x1002bc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1002bc4
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002bc4
xor eax, eax
jmp 0x1002bc4
xor ecx, ecx
cmp ebx, 8
sete cl
jmp 0x1002bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1002bc3
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002bc3

Function at 0x1002bda
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [eax], 0
push esi
push 0
lea eax, [ebp - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x1007725
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002c03
push ebx
sub eax, ecx
push edi
lea edi, [eax + esi + 2]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1007742
inc esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100774c
sub edi, eax
push 0x1002b00
lea esi, [eax + ebx]
push edi
push esi
call fcn.01002c83
push dword [ebp + 8]
dec edi
push edi
inc esi
push esi
call fcn.01002c83
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100774c
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor esi, esi
test ebx, ebx
je 0x1002c75
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1007736
mov esi, eax
jmp 0x1002c77
and eax, 0xffff
or eax, 0x80070000
jmp 0x100772f
mov esi, 0x8007000e
jmp 0x1002c6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007760
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1002c6a
Function at 0x1002f8d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x9c4
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.010058cc
test eax, eax
je 0x10061e1
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x10061e9
cmp byte [0x1019001], bl
push esi
push edi
mov dword [ebp - 0xc], ebx
je 0x10061fc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x10061f0
push edi
push esi
push eax
call fcn.01003d9d
add esp, 0xc
push ebx
push dword [ebp - 8]
call fcn.010042ee
xor ecx, ecx
push 4
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
cmp edi, ebx
pop ecx
je 0x1006242
push edi
push dword [ebp - 8]
call fcn.010042ee
cmp eax, 2
mov dword [ebp - 0x10], eax
mov dword [edi + eax*4], ebx
jne 0x100306b
mov esi, dword [edi + 4]
movzx eax, word [esi]
cmp ax, 0x2d
je 0x100624e
cmp ax, 0x2f
je 0x100624e
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
call fcn.010030b0
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x1003084
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.010034c8
cmp dword [ebp - 4], ebx
pop edi
pop esi
jl 0x10062a5
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret 0x10
xor eax, eax
inc eax
jmp 0x10030a6
call fcn.010034c8
jmp 0x10061e1
mov dword [ebp - 4], 0x8007000e
jmp 0x100308d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
mov edi, eax
push edi
push ebx
push ebx
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x10], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x10061f0
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
jmp 0x1003014
mov dword [ebp - 4], 0x8007000e
jmp 0x1003079
push 0xffffffffffffffff
inc esi
push 0x10062e0
inc esi
push esi
call fcn.01001f8d
test eax, eax
jne 0x1006268
call fcn.0100cd71
jmp 0x100629d
push 0xffffffffffffffff
push 0x10062c8
push esi
call fcn.01001f8d
test eax, eax
jne 0x1006280
call fcn.0100d45b
jmp 0x100629d
push 0xffffffffffffffff
push 0x10062b4
push esi
call fcn.01001f8d
test eax, eax
jne 0x100306b
push dword [ebp + 8]
call fcn.0100cc2c
mov dword [ebp - 4], eax
jmp 0x1003079
mov dword [ebp - 0xc], 1
jmp 0x10030a3
Function at 0x100447d
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0xc04]
cmp dword [ebp - 0xc08], ebx
jbe 0x100445e
cmp dword [ebp - 0xc08], 2
ja 0x100839a
push 0xffffffffffffffff
push 0x1004474
lea eax, [ebp - 0xc04]
push eax
mov byte [esi], 1
call fcn.01001f8d
test eax, eax
je 0x100445a
push 0xffffffffffffffff
push 0x1003cb0
lea eax, [ebp - 0xc04]
push eax
call fcn.01001f8d
test eax, eax
je 0x100445a
push 0xffffffffffffffff
push 0x1004468
lea eax, [ebp - 0xc04]
push eax
call fcn.01001f8d
test eax, eax
je 0x100445a
mov byte [esi], 1
xor eax, eax
jmp 0x10044f4
mov byte [esi], bl
jmp 0x1004453
mov eax, 0x80040153
jmp 0x10044f4
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x1019008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp byte [0x1019001], bl
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xc1c], esi
je 0x1008299
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc08]
push ecx
push ebx
push edi
push eax
mov dword [ebp - 0xc0c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10043ed
jle 0x10044f4
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010016d9
leave
ret 0xc
cmp edi, ebx
je 0x1008342
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0xc18], eax
jne 0x10082c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x10044e8
call fcn.0100450b
mov dword [ebp - 0xc10], esp
push ebx
push ebx
push dword [ebp - 0xc18]
push dword [ebp - 0xc10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x10082bc
mov esi, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc08]
push eax
push ebx
push dword [ebp - 0xc10]
mov edi, 0x400
push dword [ebp - 0xc14]
mov dword [ebp - 0xc0c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x10044e8
mov eax, dword [ebp - 0xc0c]
cmp eax, ebx
jne 0x100834a
mov eax, 0x80004005
jmp 0x10044f4
mov dword [ebp - 0xc10], ebx
jmp 0x10082f3
cmp dword [ebp - 0xc08], 1
mov byte [ebp + eax - 0x405], bl
je 0x100836e
cmp dword [ebp - 0xc08], 2
je 0x100836e
lea eax, [ebp - 0x404]
jmp 0x10043f3
push edi
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10082bc
mov eax, dword [ebp - 0xc14]
jmp 0x10043f3
cmp dword [ebp - 0xc08], 4
jne 0x100445e
cmp dword [ebp - 0xc0c], 4
jne 0x100445e
cmp dword [eax], ebx
setne al
mov byte [esi], al
jmp 0x1004453
Function at 0x1004921
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1019001], bl
push esi
push edi
je 0x1008163
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x14]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.010049bb
test eax, eax
jl 0x1008138
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1008142
cmp dword [ebp - 0xc], 1
jne 0x1008157
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x1008138
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010016d9
leave
ret 0x10
mov eax, 0x80040153
jmp 0x10049a2
jle 0x10049a2
and eax, 0xffff
or eax, 0x80070000
jmp 0x10049a2
cmp dword [ebp - 0xc], 2
je 0x1004990
jmp 0x1008138
cmp dword [ebp + 0xc], ebx
je 0x10081a8
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x100818b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x1008142
call fcn.0100450b
mov dword [ebp - 0x10], esp
push ebx
push ebx
push edi
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x1008181
jmp 0x10081ab
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x14]
inc esi
mov eax, esi
call fcn.0100450b
mov edi, esp
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1008142
cmp dword [ebp - 0xc], 1
je 0x10081e9
cmp dword [ebp - 0xc], 2
jne 0x1008138
mov eax, dword [ebp - 8]
cmp byte [edi + eax - 1], bl
jne 0x1008138
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10049a0
jmp 0x1008181
Function at 0x1004d61
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1019001], bl
push esi
push edi
mov dword [ebp - 8], 4
je 0x1008214
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x100827c
jle 0x1004db7
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010016d9
leave
ret 0xc
cmp dword [ebp + 0xc], ebx
je 0x100825c
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x100823f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x1004dab
call fcn.0100450b
mov dword [ebp - 0xc], esp
push ebx
push ebx
push edi
push dword [ebp - 0xc]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x1008232
jmp 0x100825f
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x1004da3
cmp dword [ebp - 0x10], 4
jne 0x100828f
cmp dword [ebp - 8], 4
jne 0x100828f
xor eax, eax
jmp 0x1004db7
mov eax, 0x80040153
jmp 0x1004db7
Function at 0x1004f49
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1019008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
push esi
mov dword [eax], ebx
cmp byte [0x1019001], bl
push edi
je 0x10063c6
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x1004fe0
call fcn.0100450b
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1004fe0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1004fec
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1004fe0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010016d9
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10063af
cmp eax, ebx
jle 0x1004fcc
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004fcc
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x1004fe0
call fcn.0100450b
cmp esp, ebx
mov dword [ebp - 8], esp
jne 0x10063f9
mov eax, 0x8007000e
jmp 0x1004fcc
push ebx
push ebx
push edi
push dword [ebp - 8]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x1004fe0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x1004fe0
call fcn.0100450b
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1004fe0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1002b00
push edi
call sub.VERSION.dll_VerQueryValueA
jmp 0x1004fb3
Function at 0x10052d7
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x1005382
mov ecx, eax
call fcn.0100538e
mov esi, eax
cmp esi, ebx
je 0x1006f09
mov eax, dword [ebp + 8]
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x1006f13
lea eax, [esi + 0x14]
push eax
push ebx
push esi
push 0x100335a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x1006f13
push 0xff
push 0xffffffffffffffff
push ebx
push dword [esi + 0x1c]
call fcn.01002e69
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
cmp eax, ebx
mov dword [esi + 0x1c], ebx
jg 0x1006f2e
mov edi, eax
cmp edi, ebx
jl 0x1005371
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor esi, esi
xor edi, edi
cmp esi, ebx
jne 0x1006f3d
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
xor esi, esi
jmp 0x10052fa
mov edi, 0x8007000e
jmp 0x1005379
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1006f27
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1005371
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005362
push 1
mov ecx, esi
call fcn.01003999
jmp 0x1005379

Function at 0x10058cc
Capabilities:
Check os version

Disassembly:
push 0xa0
push 0x1005998
call fcn.010041c9
mov esi, dword [ebp + 0xc]
mov dword [0x1019024], esi
mov eax, dword [ebp + 8]
mov dword [0x101901c], eax
xor edi, edi
mov dword [ebp - 4], edi
push 0x101902c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1005994
cmp dword [ebp - 0xac], 6
sbb al, al
inc al
mov byte [section..data], al
call fcn.01007cca
mov dword [0x1019020], eax
cmp dword [ebp - 0xa0], 2
jne 0x1005976
mov byte [0x1019001], 1
cmp dword [ebp - 0xac], 5
jb 0x100595a
mov byte [0x1019002], 1
je 0x1005989
cmp dword [ebp - 0xac], 6
jb 0x1005976
cmp esi, 0x7d0
je 0x1007f29
mov byte [0x1019004], 1
xor eax, eax
cmp dword [0x101901c], edi
setne al
call fcn.010059b4
ret 8
cmp dword [ebp - 0xa8], 1
jb 0x100595a
jmp 0x1005963
xor eax, eax
jmp 0x1005981
push edi
call 0x101514c
jmp 0x100596f
Function at 0x1007cca
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x101901c]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010016d9
leave
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1019008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1019020]
test eax, eax
jne 0x10045db
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
mov ecx, esi
and ecx, 0x3ff
movzx eax, cx
cmp ax, 1
je 0x1007d0c
cmp ax, 0xd
jne 0x1007d26
cmp dword [0x1019024], 0x7d0
je 0x10045d5
mov dword [0x10194c8], 0x180000
cmp byte [section..data], 0
jne 0x10045d5
cmp cx, 9
je 0x10045d5
push ebx
push edi
push esi
push dword [0x101901c]
call fcn.010150f1
cmp eax, dword [0x101901c]
jne 0x1007d5b
push eax
call fcn.01015d77
jmp 0x1007d63
test eax, eax
jne 0x1007f18
push 5
lea eax, [ebp - 0xc]
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1007d80
mov eax, dword [0x1019020]
jmp 0x1007f0f
mov esi, 0x104
push esi
lea eax, [ebp - 0x318]
push eax
push 0x3e9
push dword [0x101901c]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x1007d76
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
mov ebx, 0x1007f20
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0100cd12
add esp, 0x14
push esi
lea eax, [ebp - 0x41c]
push eax
push dword [0x101901c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010151c5
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x1007f18
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x1007f18
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jle 0x1007e94
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
mov byte [ebp - 0xa], 0
call fcn.0100da76
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010151c5
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x1007f18
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x1007f18
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 5
lea ecx, [ebp - 0xc]
push ecx
and eax, 0x3ff
or eax, 0x400
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1007d76
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0100da76
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010151c5
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x1007f18
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x1007f18
mov eax, dword [0x101901c]
pop edi
pop ebx
jmp 0x10045da
Function at 0x100f8d3
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100f8e6
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100f8e2
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100f907
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100f946
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100f93c
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100f948
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100f92c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100fb79
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20006
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100fbc6
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x100fbd4
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x100fdd6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1019008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x43
je 0x100fe0d
cmp dword [ebp + 8], 0x57
je 0x100fe01
mov eax, 0x80070057
jmp 0x100ff59
mov dword [ebp - 0x214], 0x100ff68
jmp 0x100fe17
mov dword [ebp - 0x214], 0x100ff70
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x218], ebx
mov edi, 0x104
push ebx
mov esi, 0x80000000
jmp 0x100ff04
cmp eax, ebx
jne 0x100ff4a
cmp byte [ebp - 0x108], 0x2e
jne 0x100fee6
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x100ff4a
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x10086dc
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], ebx
jne 0x100fee6
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x100fee6
mov byte [ebp + eax - 0x109], bl
push 1
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x214]
call fcn.0100fd20
cmp eax, ebx
jl 0x100ff56
inc dword [ebp - 0x218]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x218]
push esi
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x100fe44
mov eax, dword [ebp - 0x214]
push ebx
push 0x100ff78
call fcn.0100fd20
cmp eax, ebx
jl 0x100ff56
mov eax, dword [ebp - 0x214]
push ebx
push 0x100ff80
call fcn.0100fd20
cmp eax, ebx
jl 0x100ff56
xor eax, eax
jmp 0x100ff56
jle 0x100ff56
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010016d9
leave
ret 4