joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b40
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b8b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b84
test esi, esi
je 0x401b84
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b60
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d70
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e94
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401dfe
cmp eax, 4
jne 0x401e20
test esi, esi
je 0x401e12
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401e04
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e5f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e51
cmp ecx, 0x40
je 0x401e12
cmp ecx, 4
je 0x401e12
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d70
lea esi, [esi]
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x1003141
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push esi
mov esi, ecx
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push dword [esi + 0x34]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10502fe
lea eax, [ebp - 0xc]
push eax
push fcn.01003190
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
pop esi
leave
ret
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x34]
call fcn.01003190
test eax, eax
jne 0x1003173
mov eax, dword [ebp - 8]
jmp 0x1003188
Function at 0x10039b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x8004
cmp edi, eax
mov esi, ecx
jg 0x103db65
je 0x1003bf6
cmp edi, 6
jg 0x104f306
je 0x100b286
dec edi
je 0x100a684
dec edi
jne 0x1003bee
push dword [ebp + 0xc]
call fcn.01008206
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
dec edi
dec edi
jne 0x100e1a6
push 1
push dword [ebp + 0xc]
call fcn.010074ec
jmp 0x10039f5
push dword [ebp + 0xc]
call fcn.01003957
test eax, eax
jne 0x10039f5
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0100a727
jmp 0x10039f5
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 4
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0xc]
call fcn.01003871
test eax, eax
jl 0x10039f5
cmp edi, 0x8006
je 0x103db76
mov esi, dword [esi + 0x94]
mov eax, dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [eax + 0x18]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10039f5
dec edi
jne 0x10039f5
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 4]
push ecx
push dword [eax]
mov ecx, esi
call fcn.0100e1ca
xor eax, eax
inc eax
jmp 0x10039f7
cmp edi, 0x8006
jne 0x10039f5
jmp 0x100b286
push 3
pop ebx
jmp 0x100b2b0
sub edi, 7
je 0x1060bea
sub edi, 3
je 0x1060bdb
dec edi
dec edi
je 0x1060bc2
sub edi, 3
jne 0x10039f5
jmp 0x1060ba4
push 0x502
push 0x1060c78
call fcn.01012644
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0109767f
jmp 0x10039f5
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x48]
shr eax, 0x10
and eax, 0xfff
push eax
call fcn.0106e5bb
jmp 0x10039f7
push 0
push dword [ebp + 0xc]
call fcn.0109582e
jmp 0x10039f5
mov eax, dword [esi + 0x48]
xor ebx, ebx
cmp dword [eax + 0x1c], ebx
jne 0x1060c31
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x1060c31
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10b00f0]
xor edx, edx
cmp eax, dword [0x10b00ec]
sete dl
cmp ecx, ebx
je 0x1060c23
cmp eax, ecx
jne 0x1060c23
xor edx, edx
inc edx
mov edi, dword [esi + 0x38]
cmp edi, ebx
jne 0x1060c54
cmp edx, ebx
jne 0x1060c31
mov dword [esi + 0x38], eax
push ebx
push ebx
push 0x504
push dword [0x10b00ec]
call dword [sym.imp.USER32.dll_PostMessageW]
push 2
push ebx
push ebx
push ebx
call dword [sym.imp.dwmapi.dll_Ordinal_113]
jmp 0x100e1bd
cmp edx, ebx
je 0x1060c31
mov ecx, esi
call fcn.010956a9
push edi
call fcn.01078f29
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esi + 0x38], ebx
jmp 0x100e1bd
Function at 0x1007fa4
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
and dword [esi + 0x14], 0
push 0
mov dword [esi], 0x100359c
mov dword [esi + 4], 0x1007f44
mov dword [esi + 8], 0x1007f54
mov dword [esi + 0xc], 0x1007f64
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and dword [esi + 0x20], 0
and dword [esi + 0x24], 0
mov dword [esi + 0x1c], eax
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100ab87
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push dword [esi + 0xc]
xor edi, edi
mov dword [esi + 0x3c], edi
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x100abdc
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0xc]
push 2
push 0x42
call dword [sym.imp.SHLWAPI.dll_AssocQueryKeyW]
test eax, eax
jl 0x100abdc
push edi
push edi
push edi
push 0x100abe0
push edi
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1050f6a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
mov dword [esi + 0x3c], 1
jmp 0x100abd3
Function at 0x101043d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x40000069
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x105d8c8
lea eax, [ebp - 4]
push eax
add esi, 0x24
push esi
push 0
push 0x100f960
push 0x100f870
push 0x80000001
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1010489
mov dword [esi], 0xa
pop esi
leave
ret
and dword [esi + 0x24], 0
jmp 0x1010489

Function at 0x101080b
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov eax, dword [edi]
mov dword [ebp + 8], ebx
test eax, eax
jne 0x105d9d1
xor eax, eax
test eax, eax
jne 0x105d9d8
test ebx, ebx
je 0x1010863
mov eax, dword [ebx]
test eax, eax
jne 0x105d9d8
push eax
push 0x1090195
lea ecx, [ebp + 8]
call fcn.01009838
lea ecx, [ebp + 8]
call fcn.010097f6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
jmp 0x101083b
mov eax, dword [eax]
jmp 0x101082d
push 0
push 0x1090195
mov ecx, edi
call fcn.01009838
mov eax, dword [esi + 0xc]
and dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [esi + 0x18]
push 0xca
mov dword [edi], ebx
push dword [eax + 0x44]
call fcn.01037588
mov ebx, 0x105da90
push ebx
mov esi, 0x80000001
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
inc esi
test eax, eax
jne 0x105da7d
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x105da49
mov eax, dword [eax]
jmp 0x105da4b
xor eax, eax
cmp ebx, eax
jge 0x105da74
push ebx
push dword [edi]
mov dword [ebp - 8], esi
call dword [fcn.01002b70]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0x18
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
inc ebx
jmp 0x105da3f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.010097f6
mov eax, esi
jmp 0x101085c
Function at 0x10138f1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call edi
test eax, 0x10000000
je 0x1055ed2
lea eax, [esi + 0xb4]
cmp word [eax], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
je 0x10214f2
lea eax, [esi + 0x10]
cmp word [eax], 0
je 0x102150f
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp + 8]
mov ecx, esi
push eax
call fcn.010139ee
push 6
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*4]
push eax
push dword [ebp - 8]
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 0xffffffffffffffec
push dword [esi + 4]
call edi
push eax
push ebx
push 0xfffffffffffffff0
push dword [esi + 4]
call edi
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov esi, dword [esi + 0x1ac]
cmp esi, ebx
je 0x10139b0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 1
push ebx
push esi
call dword [sym.imp.UxTheme.dll_GetThemeBackgroundExtent]
test eax, eax
jl 0x10139b0
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x10b00c0]
mov eax, dword [0x10b00bc]
mov edx, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 0x14]
mov esi, ecx
sub esi, edx
cmp esi, eax
pop ebx
jl 0x1055ed9
sub ecx, edx
movzx eax, cx
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop edi
pop esi
leave
ret 8
push 0x28
push eax
push 0x1003
push 0x400
call ebx
xor eax, eax
mov word [esi + 0x104], ax
jmp 0x101392c
push 0x28
push eax
push 0x1f
push 0x400
call ebx
xor eax, eax
mov word [esi + 0x60], ax
jmp 0x1013939
xor eax, eax
jmp 0x10139e3
lea ecx, [eax + edx]
jmp 0x10139d0
Function at 0x1013f58
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 0x18]
mov dword [esi + 0x350], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x354], eax
call edi
mov ebx, 0x10000000
test ebx, eax
je 0x1056add
push dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
call edi
test eax, eax
je 0x1026c2e
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0101350d
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
pop edi
pop esi
pop ebx
leave
ret 8
push dword [0x10b00ec]
call edi
test eax, eax
je 0x1013fa4
jmp 0x1056b43
push 0xffffffffffffffff
push 3
lea ecx, [esi + 0x29c]
call fcn.010123f7
test eax, eax
jne 0x1013f91
push 0xffffffffffffffff
push 3
lea ecx, [esi + 0x2ac]
call fcn.010123f7
test eax, eax
jne 0x1013f91
push 0xffffffffffffffff
push 3
lea ecx, [esi + 0x2bc]
call fcn.010123f7
test eax, eax
jne 0x1013f91
push 0xfffffffffffffff0
push dword [esi + 0x28]
call edi
test ebx, eax
jne 0x1013f91
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x1013fc6
push 5
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1013fa4

Function at 0x101613d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10161c1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10161c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10161ba
and dword [ebp + 0xc], 0xf
jbe 0x101618b
mov ecx, dword [ebp + 0xc]
dec ecx
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x1016181
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x10161b1
push esi
movzx esi, word [eax]
neg esi
sbb esi, esi
lea edx, [eax + 2]
and esi, edx
mov dword [ecx], esi
mov ecx, dword [ebp + 0x18]
pop esi
mov ax, word [eax]
mov word [ecx], ax
xor eax, eax
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x10161a5
jmp 0x10161ab
mov eax, 0x80004005
jmp 0x10161ad
call fcn.0107a091
jmp 0x10161ad
Function at 0x1018c40
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_618]
test eax, eax
je 0x1018ced
jmp 0x105dd93
xor eax, eax
jmp 0x1018d0b
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and dword [eax], 0
push edi
mov edi, ecx
mov eax, dword [edi + 0x28]
test eax, eax
je 0x1018c62
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_618]
test eax, eax
jne 0x1018c34
mov eax, dword [edi + 0x2c]
test eax, eax
jne 0x1018d10
mov eax, dword [edi + 0x34]
push esi
mov esi, dword [edi + 0x38]
and esi, 3
test eax, eax
je 0x1018ce2
push ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0x18
push eax
mov ebx, 0x100f4a0
push ebx
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueFromHKCUHKLM]
test eax, eax
je 0x105dd7a
mov ecx, edi
call fcn.01018b9d
mov dword [ebp + 8], eax
test eax, eax
je 0x1018ce1
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push ebx
push 0x80000001
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x105dd8b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, dword [edi + 0x30]
test eax, eax
jne 0x1018c20
and esi, 3
cmp esi, 2
je 0x105dd9b
cmp esi, 1
jne 0x1018d08
test byte [edi + 0x38], 0x10
jne 0x105ddad
mov eax, esi
pop esi
pop edi
leave
ret 4
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_618]
test eax, eax
je 0x1018c6d
jmp 0x1018c34
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [eax], 1
jmp 0x1018ce1
mov esi, dword [ebp - 8]
jmp 0x1018cd8
xor esi, esi
inc esi
jmp 0x1018ced
test byte [edi + 0x38], 8
jne 0x1018d08
xor esi, esi
inc esi
jmp 0x1018d08
push 2
pop esi
jmp 0x1018d08
Function at 0x101cf05
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x630], ecx
mov esi, 0x80070057
test eax, eax
je 0x101cfec
push edi
push eax
mov edi, 0x201
push edi
lea eax, [ebp - 0x428]
push eax
call fcn.010065a0
mov esi, eax
test esi, esi
jl 0x101cfeb
push ebx
push 0x5c
lea eax, [ebp - 0x428]
push eax
call sub.SHLWAPI.dll_StrChrW
mov ebx, eax
test ebx, ebx
je 0x101cfcf
lea ecx, [ebp - 0x428]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
push 0x100
lea eax, [ebp - 0x628]
push eax
call fcn.0101f87f
mov esi, eax
test esi, esi
jl 0x101cfea
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x62c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, 1
jne 0x10655cf
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10655bc
push 0x2b
pop eax
mov word [ebx], ax
test esi, esi
jl 0x101cfea
lea eax, [ebp - 0x428]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x630]
call fcn.010065a0
mov esi, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret 0xc
add ebx, 2
push ebx
push edi
lea eax, [ebp - 0x428]
push eax
call fcn.010065a0
jmp 0x10655d4
call fcn.0101d802
mov esi, eax
jmp 0x101cfcf
Function at 0x101d01b
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [ebp - 8], eax
jne 0x101d0d7
jmp 0x105dc77
cmp dword [ebp - 4], eax
jmp 0x101d00b
and dword [ebp - 8], 0
jmp 0x101d059
cmp dword [ebp - 4], eax
je 0x101d0d7
jmp 0x105dc5e
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x1d
mov ebx, ecx
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_IsOS]
push 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
pop ecx
cmp eax, ecx
je 0x101c9a8
cmp eax, 0x1b
je 0x101c9a8
cmp eax, 0x2f
ja 0x105dc47
cmp dword [ebp - 4], 0
jne 0x105dc55
lea edx, [ebx + 4]
mov edi, 0x100ef44
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x101d0de
push 4
pop ecx
mov edi, 0x10171c4
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x101d148
push 4
pop ecx
mov edi, 0x10171b4
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x101d148
push 4
pop ecx
mov edi, 0x1018a48
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x101d148
push 4
pop ecx
mov edi, 0x101c5c4
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x101c992
push 4
pop ecx
mov edi, 0x101c5b4
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x101d008
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x101d0d7
test eax, eax
je 0x101d0d7
push eax
push 0x101c780
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x101c9a0
mov ecx, dword [ebx]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov eax, ecx
inc eax
neg eax
sbb eax, eax
and eax, ecx
push eax
push 0x101c6d8
call esi
test eax, eax
je 0x101d148
mov ecx, dword [ebx]
mov eax, ecx
inc eax
neg eax
sbb eax, eax
and eax, ecx
push eax
push 0x101c630
call esi
test eax, eax
je 0x101d153
mov ecx, dword [ebx]
mov eax, ecx
inc eax
neg eax
sbb eax, eax
and eax, ecx
push eax
push 0x101c5d8
call esi
test eax, eax
jne 0x101d0d7
cmp dword [ebp - 4], 0
je 0x101d0d7
jmp 0x105dc77
cmp dword [ebp - 4], eax
je 0x101d0d7
jmp 0x105dc6c
cmp eax, 0x31
jbe 0x101c9a8
jmp 0x101d059
and dword [ebp - 8], 0
jmp 0x101d063
mov eax, dword [ebx + 0x38]
and eax, 0xfffffffd
or eax, 1
mov dword [ebx + 0x38], eax
jmp 0x105dc7b
mov eax, dword [ebx + 0x38]
and eax, 0xfffffffe
or eax, 2
jmp 0x105dc67
and dword [ebx + 0x38], 0xfffffffc
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x18
push dword [ebx + 0x34]
mov edi, 0x100f4a0
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, 2
je 0x105dcb1
cmp eax, 3
jne 0x101d0d7
mov eax, dword [ebx + 0x38]
push 4
and eax, 3
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0x18
push dword [ebx + 0x34]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
jmp 0x101d0d7
Function at 0x101f7ce
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov ebx, 0x80004005
test edi, edi
je 0x101f868
push esi
push 0x5c
push edi
call sub.SHLWAPI.dll_StrChrW
mov esi, eax
test esi, esi
je 0x1065524
lea eax, [esi + 2]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x2c]
call fcn.010065a0
mov ebx, eax
test ebx, ebx
jl 0x101f867
sub esi, edi
sar esi, 1
push esi
mov esi, dword [ebp - 0x28]
push edi
push dword [ebp + 0x10]
push esi
call fcn.0101f87f
mov ebx, eax
test ebx, ebx
jl 0x101f867
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, 1
jne 0x101f867
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x106551c
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 0x14
mov word [esi], ax
jmp 0x101f867
push edi
push dword [ebp + 0x18]
push dword [ebp - 0x2c]
call fcn.010065a0
mov ebx, eax
test ebx, ebx
jl 0x101f867
cmp dword [ebp + 0x10], 0
jbe 0x101f867
mov ecx, dword [ebp - 0x28]
xor eax, eax
mov word [ecx], ax
jmp 0x101f867
Function at 0x101fa83
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x424], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x428], ecx
mov esi, 0x104
push esi
lea ecx, [ebp - 0x414]
push ecx
push eax
call fcn.0101cf05
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl 0x101fb94
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101f98c
mov edi, eax
cmp edi, ebx
jl 0x101fb94
push 0x101fbb4
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101237f
mov edi, eax
cmp edi, ebx
jl 0x101fb94
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101237f
mov edi, eax
cmp edi, ebx
jl 0x101fb94
push 0x101fba8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101237f
mov edi, eax
cmp edi, ebx
jl 0x101fb94
push ebx
push 0x80
push 3
push ebx
push 1
push 1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp eax, 0xffffffff
je 0x10656d6
lea ecx, [ebp - 0x41c]
push ecx
push eax
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [ebp - 0x41c], ebx
ja 0x101fb83
cmp esi, ebx
jne 0x1065660
mov edi, 0x800703ee
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 0xc
cmp esi, 0xffffffff
je 0x101fb83
lea eax, [ebp - 0x418]
push eax
push esi
call fcn.0101b551
mov edi, eax
cmp edi, ebx
jl 0x101fb88
push ebx
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x418]
push eax
push esi
push ebx
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10656c3
cmp dword [ebp - 0x418], esi
je 0x10656af
mov edi, 0x80004005
jmp 0x10656ca
mov eax, dword [ebp - 0x424]
mov dword [eax], ebx
mov eax, dword [ebp - 0x428]
mov dword [eax], esi
xor ebx, ebx
jmp 0x10656ca
call fcn.0107a814
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x101fb88
call fcn.0107a814
mov edi, eax
jmp 0x101fb94