joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e6d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x477b97
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e789
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e772
test esi, esi
jbe 0x41e789
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088a4
test eax, eax
jne 0x41e764
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e789
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e741
jmp 0x41e789
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e789
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477b9e
ret
Function at 0x41efb4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x478563
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41efef
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41f008
lea eax, [ebp - 0x10]
mov edx, dword [0x48e208]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41f01b
lea eax, [ebp - 0x10]
mov edx, dword [0x48e208]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41f027
adc edx, 0
mov edx, dword [edx*4 + 0x48d0ac]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41f135
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41f128
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f128
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d94
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41f128
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f128
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f128
cmp dx, 0x150
ja 0x41f128
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41f128
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f128
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f14d
inc ebx
cmp ebx, 0x19
jne 0x41efe1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47856a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x445af7
Capabilities:
Encode data using xor

Disassembly:
pop es
ror dword [edi], 1
adc byte [0xc4cc1b28], cl
xor eax, 0xf6249ea4
push esp
xchg edx, eax
cmp eax, 0x5de00f6c
xor dword gs:[ebx + 0x36d2a1ce], ebx
rcr byte [edx - 0x14a719dc], 0x8a
adc byte [edi], bl
sub byte [ecx + esi + 0x15], bl
movsb byte es:[edi], byte [esi]
sbb esi, dword [ecx + 0x6b]
cmp al, 0x73
dec esp
xchg esi, eax
xchg esp, eax
in eax, dx
mov dl, 0xc5
sub dword [edx + 0x420914b4], edi
mov ebx, 0x124b5c0c
sub edi, 0x429db580
scasb al, byte es:[edi]
mov ah, 0xc5
mov edx, 0x3761d58d
add al, byte [ecx + 0x4b]
mov dl, 0x30
jae 0x445b0d
fimul dword [edi - 0x30]
pop ds
push edi
hlt

Function at 0x49c287
Capabilities:
Encode data using xor

Disassembly:
retf
stosb byte es:[edi], al
jnp 0x49c0bf
push ds
jle 0x49c149
inc eax
outsb dx, byte [esi]
mov dh, 0xe2
or eax, edi
pop edx
rol byte [edi], 1
nop
or eax, ebx
lea edx, [ecx + 0x41]
int 0xaa
loop 0x49c11c
invalid
stosb byte es:[edi], al
into
not dword [edi + 0x3b]
daa
jmp 0x49c10f
push ds
outsd dx, dword [esi]
pop ds
xchg ebp, eax
jo 0x49c1b4
imul edx, dword [ebp - 0x3ef35280], 0
cmp bl, byte [edi]
pop ds
push ecx
lcall 0x9374, 0x318033f6
cmpsb byte [esi], byte es:[edi]
inc ebx
and dl, ah
rcr byte [ebp + edi*8 - 0x648916d], 0xc5
cmp al, byte [esi]
add bl, bh
pop ss
pop esp
mov ecx, 0xa5d135f4
mov ah, 0xb8
imul esp, dword [eax], 0xffffffe9
jo 0x49c1f2
push ebp
push ebp
into
mov dl, 0xae
nop
and dword [edi + 0x63], ecx
cmp ebp, edx
cmp edx, dword [ebx]
popfd
pop ecx
jne 0x49c1b1
dec ebx
in al, dx
invalid
daa
mov es, word [ebp - 0x6fe3cd2c]
aam 0x32
sbb al, 0x90
jbe 0x49c181
mov ch, 0xa6
mov ebp, 0x6054b078
imul ebx, dword [ecx], 0x9a16882
jecxz 0x49c210
jecxz 0x49c158
call 0x7e416112
mov cl, 0xca
inc edx
cmp eax, 0xa5a86c0
mov al, byte [0xd11d8e8f]
push esi
sti
cmp bh, 0x69
iretd
sahf
stosd dword es:[edi], eax
rol byte [ebx], cl
rcr dword [esi + 0x3bc3ff9a], 1
xor al, 0x29
pop edx
jo 0x49c280
mov dword [0xbdb8d4e1], eax
invalid
int3
hlt
leave
pop es
in eax, 0x69
test al, 0x9c
or eax, 0xbab5d288
push ds
push ebx
rcl byte [ecx - 0x4e99fa61], 0xb
sbb eax, dword [ebx]
jb 0x49c2a9
invalid
out dx, al
jno 0x49c221
jnp 0x49c25f
mov byte [0x998a538c], al
rcr ch, 1
bound edx, qword [eax + 0x1ec268f7]
mov byte [0xd31cf7b3], al
test eax, 0xc52c64d3
fyl2x
cmp bh, bh
jle 0x49c2c7
wait
movsb byte es:[edi], byte [esi]
loope 0x49c2fd
push ebx
sbb byte [edi - 0x6c4dd86f], cl
Function at 0x4bf53e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c72f0
cmp edx, dword [eax]
je 0x4bf560
add eax, 8
inc ecx
cmp eax, 0x4c7380
jl 0x4bf551
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c72f0]
jne 0x4bf68e
mov eax, dword [0x4cb9dc]
cmp eax, 1
je 0x4bf668
test eax, eax
jne 0x4bf591
cmp dword [0x4c7234], 1
je 0x4bf668
cmp edx, 0xfc
je 0x4bf68e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf5c8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bfc50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bfe80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bf60b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bfe80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c3b70
push edi
call fcn.004c1650
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bfc50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bfc60
lea eax, [ebp - 0xa0]
push 0x4c3b50
push eax
call fcn.004bfc60
push dword [esi + 0x4c72f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bfc60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c15c4
add esp, 0x2c
pop edi
jmp 0x4bf68e
lea eax, [ebp + 8]
lea esi, [esi + 0x4c72f4]
push 0
push eax
push dword [esi]
call fcn.004bfe80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x61df6382
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x16c32a7a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4014c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x5e1be0
push 0x5e0c20
push section..data
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0x10
mov esi, esp
push 0x5e0c20
call dword [sym.imp.ucrtbased.dll_perror]
add esp, 4
cmp esi, esp
call fcn.00401159
push 0x5e0c20
push 0x40b038
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0xc
mov esi, esp
push 1
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.00401159
pop esi
cmp ebp, esp
call fcn.00401159
pop ebp
ret

Function at 0x401550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x5e1be0
push 0x5e0c20
push str._s:_I_O_error_reading___s__possible_reason_follows._n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0x10
mov esi, esp
push 0x5e0c20
call dword [sym.imp.ucrtbased.dll_perror]
add esp, 4
cmp esi, esp
call fcn.00401159
push 0x5e0c20
push 0x40b0a0
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0xc
mov esi, esp
push 1
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.00401159
pop esi
cmp ebp, esp
call fcn.00401159
pop ebp
ret

Function at 0x4015e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push 0x5e0c20
push str._s:_malloc_failed_on_request_for__d_bytes._n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0x10
push 0x5e0c20
push str._s:_warning:_output_file_s__may_be_incomplete._n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0xc
mov esi, esp
push 1
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.00401159
pop esi
cmp ebp, esp
call fcn.00401159
pop ebp
ret
Function at 0x401660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push 0x5e1be0
push 0x5e0c20
push str._s:___s_appears_to_contain_more_than__d_blocks_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0x14
push 0x5e0c20
push str._s:_and_cannot_be_handled.__To_fix__increase_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0xc
push 0x5e0c20
push str._s:_BZ_MAX_HANDLED_BLOCKS_in_bzip2recover.c__and_recompile._n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.00401159
push eax
call fcn.0040114f
add esp, 0xc
mov esi, esp
push 1
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.00401159
pop esi
cmp ebp, esp
call fcn.00401159
pop ebp
ret
Function at 0x1000102f
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x3004]
mov eax, 0x3004
call fcn.10039d10
push 0xffffffffffffffff
push 0x10055d85
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x3000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x3c
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
mov esi, ecx
call fcn.10039d40
lea ecx, [ebp]
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp + 0x2000]
lea eax, [ebp + 0x1000]
mov dword [ebp - 0x30], ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0x58], eax
mov eax, 0x800
add esp, 0xc
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], eax
cmp ecx, ebx
je 0x100010b5
mov eax, dword [ecx]
jmp 0x100010b7
xor eax, eax
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x100010ba
sub eax, edi
sar eax, 1
cmp ecx, ebx
je 0x100010d1
mov ecx, dword [ecx]
jmp 0x100010d3
xor ecx, ecx
lea edx, [ebp - 0x5c]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
mov ax, word [ebp - 0x44]
mov word [esi + 0x1c], ax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001309
mov edi, eax
push 0x1005a614
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.10001309
mov ebx, eax
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10001309
push ebx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10001582
push edi
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.10001582
push eax
lea ecx, [esi + 0x18]
call fcn.1000147f
mov ecx, dword [ebp - 0x18]
xor edi, edi
cmp ecx, edi
je 0x10001155
call fcn.10001441
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x10001164
call fcn.10001441
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x1c]
cmp ecx, edi
je 0x10001173
call fcn.10001441
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x20]
cmp ecx, edi
je 0x10001182
call fcn.10001441
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp ecx, edi
je 0x10001195
call fcn.10001441
mov dword [ebp - 0x10], edi
lea eax, [ebp]
push eax
lea ecx, [esi + 0x14]
call fcn.100014b2
mov eax, dword [ebp - 0x2c]
cmp eax, edi
je 0x100011e5
cmp eax, 1
je 0x100011e5
xor ecx, ecx
cmp word [ebp + eax*2 + 0x1ffe], 0x2f
sete cl
sub eax, 2
cmp word [ebp + eax*2 + 0x2000], 0x2f
je 0x100011cc
dec eax
jmp 0x100011be
cmp ecx, edi
lea ecx, [esi + 0xc]
je 0x100011dc
lea eax, [ebp + eax*2 + 0x2000]
jmp 0x100011ee
lea eax, [ebp + eax*2 + 0x2002]
jmp 0x100011ee
lea eax, [ebp + 0x2000]
lea ecx, [esi + 0xc]
push eax
call fcn.100014b2
add esi, 0x10
mov ecx, esi
cmp dword [ebp - 0x2c], edi
je 0x10001203
push dword [ebp - 0x30]
jmp 0x10001208
push 0x1005a61c
call fcn.100014b2
cmp dword [ebp - 0x24], edi
je 0x1000121c
push dword [ebp - 0x28]
mov ecx, esi
call fcn.100014b2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x3004
leave
ret
Function at 0x10001fd9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xbb4]
sub esp, 0xc34
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0xbb0], eax
mov eax, dword [ebp + 0xbc4]
mov ecx, dword [ebp + 0xbbc]
mov dword [ebp - 0x5c], eax
call fcn.10001d8e
test al, al
je 0x10002016
mov eax, 0x80004005
jmp 0x100020ee
push esi
push edi
push str.https:__javadl_esd_secure.oracle.com_update_baseline.version
push 0x1005c8d4
mov esi, 0x800
lea eax, [ebp + 0x3b0]
push esi
push eax
call fcn.10004bac
add esp, 0x10
lea eax, [ebp - 0x58]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1005c8e0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100020a0
push ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push edi
push edi
push str.URLOverride
push dword [ebp - 0x58]
mov dword [ebp - 0x60], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x58]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
pop ebx
jne 0x100020a0
lea eax, [ebp - 0x50]
push eax
push 0x1005c94c
lea eax, [ebp + 0x3b0]
push esi
push eax
call fcn.10004bac
add esp, 0x10
lea eax, [ebp + 0x3b0]
push eax
call fcn.1000f2f3
dec eax
neg eax
sbb al, al
pop ecx
inc al
push 0xb
pop eax
mov word [ebp - 0x70], ax
push 0
pop eax
sete al
lea esi, [ebp - 0x70]
lea edi, [ebp - 0x80]
dec eax
mov word [ebp - 0x68], ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x5c]
lea esi, [ebp - 0x80]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x70]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp + 0xbb0]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0xbb4
leave
ret 0xc
Function at 0x1000707d
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xff8]
mov eax, 0x1078
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0xff4], eax
mov eax, dword [ebp + 0x1004]
push ebx
push esi
mov esi, dword [ebp + 0x1000]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x1005d148]
fld qword [0x1005d140]
fdiv st(1), st(0)
fxch st(1)
call fcn.1003aca0
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1008]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1003aca0
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x1005d138]
fadd qword [0x1005d130]
call fcn.1003aca0
neg eax
mov dword [ebp - 0x68], eax
mov eax, 0x800
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0x1002
push eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
push 5
lea eax, [ebp - 0xc]
push 0x1005d0d8
push eax
call fcn.1003b150
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
jne 0x100071ab
push 0x1005d0e4
jmp 0x100071ae
push dword [ebp - 0x78]
push 0x20
push eax
call fcn.1003b150
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0xff4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039bc2
add ebp, 0xff8
leave
ret 0xc
Function at 0x1000d65a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x790], eax
push esi
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareJavaSoftJava_Deployment_Toolkit
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000d6ce
push edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push str.Allow_Unsigned_Installers
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1000d6ce
xor eax, eax
inc eax
jmp 0x1000d6f9
push str.TOOLKIT_ALLOW_UNSIGNED
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1003b936
add esp, 0xc
test eax, eax
jne 0x1000d6f7
cmp dword [ebp - 0x78], esi
je 0x1000d6f7
push dword [ebp - 0x78]
call fcn.1003b150
pop ecx
jmp 0x1000d6c9
xor eax, eax
mov ecx, dword [ebp + 0x790]
xor ecx, ebp
pop esi
call fcn.10039bc2
add ebp, 0x794
leave
ret
Function at 0x1000d74c
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x37c4]
mov eax, 0x3844
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x37c0], eax
push ebx
xor ebx, ebx
cmp dword [0x1008250c], ebx
je 0x1000d93f
push esi
push edi
xor eax, eax
mov esi, 0xffe
push esi
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push ebx
push eax
call fcn.10039d40
xor eax, eax
push esi
mov word [ebp + 0xfc0], ax
lea eax, [ebp + 0xfc2]
push ebx
push eax
call fcn.10039d40
push 0x7ff
lea eax, [ebp + 0x2fc1]
push ebx
push eax
mov byte [ebp + 0x2fc0], bl
call fcn.10039d40
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x24
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
push 0x1005dc88
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x800
call edi
test eax, eax
jne 0x1000d93d
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push 0x1005dce0
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x40]
push eax
push 0x1005dd00
push 0x1005dd58
lea eax, [ebp + 0xfc0]
push 0x1000
push eax
call fcn.10004bac
add esp, 0x14
cmp dword [ebp - 0x74], ebx
jne 0x1000d934
lea eax, [ebp - 0x80]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0xfc0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1000d934
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x2fc0]
push eax
push ebx
push ebx
push 0x1005dd64
push dword [ebp - 0x80]
mov edi, 0x800
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000d934
push esi
mov word [ebp + 0x1fc0], ax
lea eax, [ebp + 0x1fc2]
push ebx
push eax
call fcn.10039d40
lea eax, [ebp + 0x2fc0]
push eax
push str._slib_bundles
lea eax, [ebp + 0x1fc0]
push 0x1000
push eax
call fcn.10004bac
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1fc0]
push eax
call fcn.1003b150
add esp, 0x24
test eax, eax
jne 0x1000d92b
push str._requested.list
lea eax, [ebp + 0x1fc0]
push edi
push eax
mov dword [ebp - 0x74], ebx
call fcn.1003b150
push 0x1005ddb8
lea eax, [ebp + 0x1fc0]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.1003b150
add esp, 0x18
test eax, eax
jne 0x1000d92b
mov ecx, dword [0x1008250c]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x1000d905
push dword [ebp - 0x74]
sub eax, esi
sar eax, 1
push eax
push 2
push ecx
call fcn.1003c319
push dword [ebp - 0x74]
call fcn.1003c14e
add esp, 0x14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp + 0x37c0]
xor ecx, ebp
pop ebx
call fcn.10039bc2
add ebp, 0x37c4
leave
ret