joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102d6450
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x103a9498]
sub esp, 0x18
push ebx
push esi
push edi
mov dword [0x103a97d4], eax
mov eax, dword [0x103a97bc]
xor edi, edi
cmp eax, edi
je 0x102d648c
push eax
call fcn.102d62fd
push dword [0x103a9498]
mov dword [0x103a97d4], eax
push dword [0x103a97bc]
call fcn.102d5e91
jmp 0x102d6502
mov eax, dword [0x103a97c0]
cmp eax, edi
je 0x102d6502
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 8]
push ecx
push 0x2001f
push eax
push SysReAllocString
mov dword [ebp - 0x18], 4
call fcn.101f6366
test eax, eax
jne 0x102d6502
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov esi, 0x1013dff8
push esi
push dword [ebp - 8]
call fcn.102d7a4c
test eax, eax
jne 0x102d64f9
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x18]
mov dword [0x103a97d4], eax
mov eax, dword [0x103a9498]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp - 8]
call fcn.102d7a6a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1039efc4], edi
je 0x102d651b
call fcn.102d642f
push eax
push dword [0x1039efc4]
call fcn.102d5e91
call fcn.102d642f
mov esi, eax
call fcn.102d640e
mov ebx, eax
cmp esi, ebx
je 0x102d6631
movzx eax, si
push eax
call fcn.101ed996
test eax, eax
jne 0x102d654f
movzx eax, bx
push eax
call fcn.101ed996
test eax, eax
je 0x102d6631
lea eax, [ebp - 4]
push eax
push 0x20019
push 0x10149eb0
call fcn.102d5daf
test eax, eax
jne 0x102d6631
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x102d6631
imul eax, eax, 0x104
push eax
lea eax, [ebp - 0xc]
mov esi, 0x104
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
call fcn.102ea902
test eax, eax
jne 0x102d65b9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102d6631
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x102d6605
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x102d6605
add dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
add ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x102d65d7
mov ebx, dword [ebp - 8]
cmp ebx, edi
jle 0x102d6620
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add edi, esi
dec ebx
jne 0x102d660c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.102eaa09
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102d7ee1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x414], ecx
test esi, esi
jne 0x102d7f21
xor eax, eax
jmp 0x102d8091
and dword [esi], 0
push ebx
push edi
mov edi, dword [ebp + 0x20]
xor ebx, ebx
inc ebx
push ebx
push edi
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x420], ebx
call fcn.102eebd2
and dword [ebp - 0x410], 0
and dword [ebp - 0x418], 0
shr edi, 0x1a
not edi
mov dword [ebp - 0x408], eax
and edi, ebx
cmp dword [ebp - 0x408], 0
je 0x102d7f86
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x17
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [esi], eax
cmp dword [esi], 0
jne 0x102d8022
test edi, edi
je 0x102d8022
and dword [ebp - 0x40c], 0
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.102eea94
test eax, eax
je 0x102d8008
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.102ee67b
cmp dword [ebp - 0x40c], 5
jne 0x102d8008
cmp dword [ebp - 0x418], 0
jne 0x102d8008
mov dword [ebp - 0x418], ebx
jmp 0x102d7f61
cmp dword [esi], 0
je 0x102d8022
xor eax, eax
cmp dword [ebp - 0x40c], 0xb7
setne al
mov dword [ebp - 0x410], eax
mov eax, dword [esi]
xor ecx, ecx
cmp eax, ecx
je 0x102d802f
cmp eax, 0xffffffff
jne 0x102d804e
cmp edi, ecx
je 0x102d803e
push ecx
push 0x787a6c65
call fcn.102d8670
xor ecx, ecx
mov dword [esi], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x420], ecx
pop edi
pop ebx
cmp dword [ebp - 0x41c], ecx
je 0x102d8079
mov eax, dword [ebp - 0x408]
cmp eax, ecx
jne 0x102d8067
mov eax, 0x1003de80
push dword [ebp + 0x14]
push dword [ebp - 0x41c]
push eax
call fcn.102d5f36
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x102d808b
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102f77a6
leave
ret 0x1c
Function at 0x102e7eb8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [0x103a9498]
mov edi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.102e783b
add esp, 0x10
call fcn.102e7c7c
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.102e783b
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.102e783b
call fcn.102d6636
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.102e783b
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.102e77e2
add esp, 0x30
pop edi
pop esi
pop ebp
ret
Function at 0x102ea4b7
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x102ea4d8
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x102ea4d8
cmp edx, eax
jb 0x102ea4d8
add eax, 0x10000
cmp eax, ecx
jae 0x102ea503
mov eax, dword [0x1039efd0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.102d8670
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
ret

Function at 0x102eabab
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 4]
push eax
push 1
push ecx
xor esi, esi
push edx
mov dword [esp + 0x14], esi
call fcn.101f638d
test eax, eax
jne 0x102eac15
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x102eac15
cmp dword [esp + 0x10], 4
jne 0x102eac15
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x102eac2c
push eax
mov dword [esp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x102eae11
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [0x1039f730], 0xffffffff
movzx eax, ax
mov dword [ebp - 0x44], eax
jne 0x102eaf5c
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0x1014a050
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], ebx
mov dword [0x1039f730], ebx
call fcn.102d5daf
test eax, eax
jne 0x102eaf5c
cmp dword [ebp - 0x34], ebx
je 0x102eaf5c
push 9
pop edi
push 0x12
pop esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
jmp 0x102eaf3d
inc dword [ebp - 0x40]
cmp dword [ebp - 0x48], 1
jne 0x102eaf53
cmp dword [ebp - 0x3c], 8
jne 0x102eaf53
cmp dword [ebp - 0x38], esi
jne 0x102eaf53
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.101f024c
test eax, eax
je 0x102eaf26
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x4c], eax
movzx eax, word [ebp - 0x30]
push eax
call fcn.101ed8ca
test eax, eax
je 0x102eaf26
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.101f024c
test eax, eax
je 0x102eaf26
movzx ebx, word [ebp - 0x30]
push ebx
call fcn.101ed8ca
test eax, eax
je 0x102eaf24
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x102eaf24
mov eax, dword [0x1039f730]
cmp eax, 0x10
jae 0x102eaf24
mov cx, word [ebp - 0x4c]
mov word [eax*2 + 0x103ac298], cx
inc eax
mov dword [0x1039f730], eax
xor ebx, ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
call fcn.102d7a92
test eax, eax
je 0x102eae90
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1039f730], ebx
jle 0x102eafce
mov ax, word [ebp - 0x44]
cmp ax, word [ebx*2 + 0x103ac298]
jne 0x102eafc5
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x102eafc5
lea eax, [ebp - 0x18]
push eax
call fcn.102d3415
pop ecx
cmp eax, 8
jne 0x102eafc5
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.101f024c
test eax, eax
je 0x102eafc5
movzx esi, word [ebp - 0x30]
movzx edi, word [ebp - 0x30]
push esi
call fcn.101ed8ca
test eax, eax
je 0x102eafc5
push 2
push esi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x102eafc5
movzx eax, di
mov dword [ebp - 0x44], eax
inc ebx
cmp ebx, dword [0x1039f730]
jl 0x102eaf64
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x44]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret
Function at 0x102ebb9e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x102ebbb9
mov eax, 0xa0
jmp 0x102ebc90
push edi
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jmp 0x102ebc3b
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
je 0x102ebbea
push eax
call fcn.101f06af
mov edi, eax
cmp edi, ebx
jne 0x102ebbea
push ebx
push 0x77626966
call fcn.102d8670
mov dword [ebp - 0xc], 8
jmp 0x102ebc01
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x102ebbf6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x102ebc0b
push edi
call fcn.102eaa09
push dword [ebp - 0xc]
call fcn.102eb0a2
pop ecx
test eax, eax
je 0x102ebc77
push 0x796d7466
push ebx
call fcn.102d86c4
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb443
lea ecx, [ebp - 4]
mov dword [ebp + 8], ebx
call fcn.102eb22d
lea ecx, [ebp - 4]
call fcn.102eb209
movzx eax, word [esi + 0xc]
shr eax, 1
push ebx
and eax, 0x10
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.102eb4a1
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x102ebbc2
lea ecx, [ebp - 4]
call fcn.102eb22d
mov eax, edi
jmp 0x102ebc8f
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb36e
lea ecx, [ebp - 4]
call fcn.102eb22d
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x102ebc96
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x102ebcae
xor eax, eax
jmp 0x102ebda4
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x102ebcbe
cmp dword [0x103a9750], ebx
je 0x102ebcd0
mov dword [ebp - 4], ebx
call fcn.102eb009
test eax, eax
je 0x102ebcd7
test byte [edi + 0xc], 0x10
jne 0x102ebcd7
xor eax, eax
jmp 0x102ebda3
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call fcn.102eb209
movzx eax, word [edi + 0xc]
neg esi
sbb esi, esi
shr eax, 1
and esi, 2
and eax, 0x10
mov dword [ebp - 0xc], esi
or eax, esi
jmp 0x102ebd66
mov eax, dword [edi]
cmp eax, ebx
je 0x102ebd0b
push eax
call fcn.101f06af
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x102ebd17
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x102ebd34
push dword [ebp - 4]
call fcn.102eaa09
push esi
call fcn.102eb0a2
pop ecx
test eax, eax
je 0x102ebd87
push 0x796d7468
push ebx
call fcn.102d86c4
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb443
movzx eax, word [edi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebp + 8], ebx
push ebx
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [edi + 8]
call fcn.102eb4a1
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x102ebcfc
jmp 0x102ebd94
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb36e
lea ecx, [ebp - 0x10]
call fcn.102eb22d
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop edi
pop ebx
leave
ret
Function at 0x102ec171
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x102ec187
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
pop ebx
mov esi, eax
cmp dword [ebp - 4], ebx
jae 0x102ec1b9
cmp dword [ebp + 0xc], 1
je 0x102ec1b7
cmp dword [ebp + 0xc], ebx
jne 0x102ec1b9
mov esi, ebx
push esi
call fcn.102eb0a2
pop ecx
test eax, eax
je 0x102ec1df
push 0x796d746b
push 0
call fcn.102d86c4
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb443
jmp 0x102ec23f
test esi, esi
jne 0x102ec232
cmp dword [ebp + 0xc], ebx
je 0x102ec1ee
cmp dword [ebp + 0xc], 1
jne 0x102ec1fa
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
cmp dword [ebp + 0xc], ebx
je 0x102ec204
cmp byte [ebp + 0x1c], bl
jne 0x102ec21d
mov eax, dword [ebp + 0x18]
shr eax, 1
push eax
push edi
call fcn.102d5dda
pop ecx
pop ecx
test eax, eax
jne 0x102ec21d
mov esi, 0xea
jmp 0x102ec232
movzx eax, byte [ebp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.102eafe1
pop ecx
pop ecx
test eax, eax
jne 0x102ec232
mov esi, ebx
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb36e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x102ec246
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
or edi, 0xffffffff
cmp dword [ebp - 4], ebx
jne 0x102ec270
cmp dword [0x103a9750], ebx
je 0x102ec27f
mov dword [ebp - 0xc], 2
jmp 0x102ec28c
cmp dword [ebp - 4], 1
jne 0x102ec27f
call fcn.102eb009
test eax, eax
je 0x102ec289
test byte [esi + 0xc], 0x10
je 0x102ec37c
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x18]
call fcn.102eb209
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.102eb4a1
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x102ec372
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x102ec2d9
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.102eb0a2
pop ecx
test eax, eax
je 0x102ec33e
push 0x796d746c
xor edi, edi
push edi
call fcn.102d86c4
push ebx
mov ecx, 0x103ac2c8
call fcn.102eb443
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], edi
call fcn.102eb4a1
mov edi, eax
add esp, 0x14
test edi, edi
je 0x102ec2c5
jmp 0x102ec372
push ebx
mov ecx, 0x103ac2c8
call fcn.102eb36e
test edi, edi
jne 0x102ec372
movzx eax, word [esi + 0xc]
mov ecx, eax
and ecx, 0xf
cmp dword [ebp - 0x14], ecx
je 0x102ec390
cmp dword [ebp - 0x14], 3
jne 0x102ec36f
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 4
jne 0x102ec36f
and al, 0xf
cmp al, 4
je 0x102ec390
push 2
pop edi
lea ecx, [ebp - 0x18]
call fcn.102eb22d
xor ebx, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x102ec257
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x18]
mov dword [eax], 1
call fcn.102eb22d
xor eax, eax
jmp 0x102ec38b
Function at 0x102ec5c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x102ec5dd
xor eax, eax
jmp 0x102ec73a
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.102eb009
mov eax, dword [esi]
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x102ec5fa
push eax
call fcn.101f06af
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
push ebx
or ebx, 0xffffffff
cmp dword [ebp - 8], edi
jne 0x102ec617
cmp dword [0x103a9750], edi
je 0x102ec626
mov dword [ebp - 0x18], 2
jmp 0x102ec633
cmp dword [ebp - 8], 1
jne 0x102ec626
call fcn.102eb009
test eax, eax
je 0x102ec630
test byte [esi + 0xc], 0x10
je 0x102ec6e6
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], edi
call fcn.102eb209
jmp 0x102ec69d
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x102ec64c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov ebx, eax
jae 0x102ec677
cmp dword [ebp - 0x10], 1
je 0x102ec674
cmp dword [ebp - 0x10], 2
jne 0x102ec677
push 2
pop ebx
push ebx
call fcn.102eb0a2
pop ecx
test eax, eax
je 0x102ec6cd
push 0x796d746f
push edi
call fcn.102d86c4
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb443
mov dword [ebp + 8], edi
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], edi
call fcn.102eb4a1
mov ebx, eax
add esp, 0x14
cmp ebx, edi
je 0x102ec640
jmp 0x102ec6de
push dword [ebp + 8]
mov ecx, 0x103ac2c8
call fcn.102eb36e
cmp ebx, edi
je 0x102ec6f5
lea ecx, [ebp - 0x1c]
call fcn.102eb22d
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x102ec5fe
jmp 0x102ec6fd
lea ecx, [ebp - 0x1c]
call fcn.102eb22d
cmp ebx, edi
jne 0x102ec71c
cmp dword [ebp - 0x10], 2
je 0x102ec710
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x102ec71c
push dword [ebp - 4]
call fcn.102d5e76
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], edi
je 0x102ec729
push dword [ebp - 0x14]
call fcn.102eaa09
cmp ebx, edi
pop ebx
je 0x102ec737
push esi
call fcn.102d626d
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x102ec740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.102ec5c5
Function at 0x102ecca9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x102ecccb
xor esi, esi
jmp 0x102ecd51
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x102eccc4
push esi
call fcn.102f7fef
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x102eccf3
push ebx
push 0x33753468
jmp 0x102ecd3c
push eax
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x102ecd0a
push ebx
push 0x33753469
jmp 0x102ecd3c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x10003b00
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x102ecd36
cmp dword [ebp - 4], 0x34
jne 0x102ecd36
mov esi, dword [ebp - 8]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
jmp 0x102ecd43
push ebx
push 0x3375346a
call fcn.102d8670
xor esi, esi
cmp dword [ebp + 0xc], ebx
je 0x102ecd51
push dword [ebp + 0xc]
call fcn.102f72fe
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x102ed332
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.102d7c19
test eax, eax
jne 0x102ed34f
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push edi
push eax
push 0x11
call fcn.102d5cef
push dword [ebp - 0x1c]
push 0x12
call fcn.102d5cef
push 0x1001fea4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp eax, edi
je 0x102ed450
push esi
push 0x1014a3bc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x102ed44f
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x102ed44f
push dword [ebp - 4]
call fcn.102ea79d
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x102ed447
lea ecx, [ebp - 4]
push ecx
push eax
call esi
test eax, eax
je 0x102ed447
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor esi, esi
mov dword [ebp - 8], edi
cmp eax, edi
jbe 0x102ed447
mov edx, dword [ebp - 0xc]
push ebx
mov ebx, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x102ed3fe
dec eax
dec eax
jne 0x102ed40f
push dword [edx]
call fcn.102ec922
pop ecx
cmp edi, eax
ja 0x102ed40f
mov edi, eax
jmp 0x102ed40f
push dword [edx]
inc dword [ebp - 8]
call fcn.102ec922
pop ecx
cmp esi, eax
ja 0x102ed40f
mov esi, eax
add edx, 0x18
dec ebx
jne 0x102ed3e2
pop ebx
test esi, esi
je 0x102ed425
push esi
push 0x19e1
call fcn.102d5cef
test edi, edi
je 0x102ed434
push edi
push 0x19e2
call fcn.102d5cef
cmp dword [ebp - 8], 0
je 0x102ed447
push dword [ebp - 8]
push 0x19e0
call fcn.102d5cef
push dword [ebp - 0xc]
call fcn.102ea7d1
pop esi
call fcn.102ea076
pop edi
test eax, eax
jne 0x102ed463
push dword [ebp - 0x1c]
call fcn.102ed21f
pop ecx
leave
ret