joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100896cf
Capabilities:
Access the windows event log
Get thread local storage value

Disassembly:
push 0x418
mov eax, 0x100e4c77
call fcn.10001af6
mov dword [ebp - 0x420], ecx
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov eax, dword [ebp + 0x18]
or edi, 0xffffffff
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x424], eax
test esi, esi
je 0x1008972b
push eax
push ebx
push esi
push edi
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.100401c9
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
add esp, 0x20
test eax, eax
cmovs eax, edi
test eax, eax
jns 0x1008972e
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x410]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10089734
add ecx, 0xfffffffe
mov al, byte [ecx]
cmp al, 0xa
je 0x10089748
cmp al, 0xd
jne 0x10089757
lea eax, [ebp - 0x410]
cmp ecx, eax
jb 0x10089757
mov byte [ecx], bl
dec ecx
jmp 0x1008973e
mov eax, dword [0x1017ca68]
push 2
pop edi
cmp dword [eax + 4], edi
setne bl
jne 0x10089893
cmp byte [ebp - 0x410], 0
je 0x100898ac
jmp 0x10089788
mov al, byte [ecx]
cmp al, 0xa
je 0x10089784
cmp al, 0xd
jne 0x10089787
mov byte [ecx], 0x20
dec ecx
lea eax, [ebp - 0x410]
cmp ecx, eax
jae 0x1008977a
push eax
lea ecx, [ebp - 0x414]
call fcn.100aa27c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x414]
push 0
call sym.fpsrvutl.dll_Ordinal_2209
mov ecx, dword [ebp + 0x10]
movsx eax, cx
cmp eax, 0xfffffffd
je 0x100897d2
cmp eax, 0xfffffffe
je 0x100897d5
cmp eax, 0xffffffff
je 0x100897cd
test eax, eax
je 0x100897d2
cmp eax, 1
je 0x100897d5
push 4
pop edi
jmp 0x100897d5
xor edi, edi
inc edi
mov eax, dword [ebp - 0x414]
push dword [0x10150ddc]
mov dword [ebp - 0x41c], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
call sym.fpsrvutl.dll_Ordinal_5072
test eax, eax
je 0x1008980f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
jmp 0x10089893
push str.Windows_SharePoint_Services_4.0
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
jne 0x1008982b
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x10089849
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
push 1
push ebx
push 0x3e8
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x1008984b
mov bl, 1
test esi, esi
je 0x10089856
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
and dword [ebp - 4], 0
push dword [0x10150ddc]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
call sym.fpsrvutl.dll_Ordinal_2309
test eax, eax
je 0x1008987b
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x414]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov esi, dword [ebp - 0x418]
test bl, bl
je 0x100898ac
mov ecx, dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0x38]
call fcn.10001b2d
ret 0x14
Function at 0x1008e15a
Capabilities:
Delete registry value

Disassembly:
push 0x214
mov eax, 0x100e4fbe
call fcn.10001af6
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x220]
test ebx, ebx
mov eax, 0x100ea6e8
cmovne eax, ebx
push eax
call fcn.100aa27c
xor edi, edi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.10005575
lea eax, [ebp - 0x220]
push eax
call fcn.100aa27c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov esi, dword [esi + 0xc]
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
push dword [ebp - 0x1c]
push esi
cmp eax, 2
jne 0x1008e1d0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1008e1d6
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
je 0x1008e217
cmp dword [0x1017ca10], 0
push 0x14
je 0x1008e1ef
pop ecx
call fcn.100aa27c
jmp 0x1008e1f6
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1008e217
push ebx
push esi
push edi
push 0x30021
push eax
call sym.fpsrvutl.dll_Ordinal_5274
add esp, 0x14
mov edi, eax
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, edi
call fcn.10001b2d
ret 4
Function at 0x1008e549
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x238
mov eax, 0x100e509b
call fcn.10001af6
mov edi, ecx
lea ecx, [ebp - 0x21c]
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x18]
jle 0x1008e594
push 1
push esi
lea ecx, [ebp - 0x21c]
call fcn.100aa27c
xor esi, esi
mov ecx, ebx
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e5aa
shr eax, 1
mov ebx, dword [edi + 0xc]
mov ecx, 0x10178fec
mov dword [ebp - 0x220], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push ebx
jne 0x1008e60e
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1008e614
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1008e623
mov ecx, eax
call fcn.1008d65e
mov esi, eax
jmp 0x1008e63e
mov eax, dword [ebp - 0x224]
inc eax
mov byte [edi + 0x10], 1
mov dword [edi + 0x58], eax
mov eax, dword [ebp - 0x228]
inc eax
mov dword [edi + 0x54], esi
mov dword [edi + 0x5c], eax
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret
Function at 0x1008e651
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x430
mov eax, 0x100e50e4
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x428]
mov esi, dword [edi + 0x58]
mov dword [ebp - 0x43c], eax
call fcn.10005575
push 0
push esi
call fcn.100aa27c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
mov esi, dword [edi + 0x5c]
call fcn.10005575
xor ebx, ebx
inc ebx
cmp esi, dword [ebp - 0x18]
jle 0x1008e6a2
push ebx
push esi
call fcn.100aa27c
mov ecx, 0x10178fec
mov byte [ebp - 4], bl
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x224]
jne 0x1008e6bc
shr eax, 1
mov esi, dword [edi + 0x54]
mov ecx, 0x10178fec
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x430], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x42c], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x438]
push eax
push 0
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x228]
push esi
push dword [ebp - 0x42c]
jne 0x1008e715
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x1008e71b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1008e777
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
call sym.fpsrvutl.dll_Ordinal_2271
mov ecx, dword [ebp - 0x43c]
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
lea edx, [ebp - 0x42c]
push dword [ebp - 0x430]
push eax
push dword [ebp - 0x438]
call fcn.1008db58
mov ecx, eax
test ecx, ecx
je 0x1008e764
mov eax, dword [ecx]
push ebx
call dword [eax]
mov ecx, dword [ebp - 0x42c]
inc dword [edi + 0x54]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
jmp 0x1008e77d
mov byte [edi + 0x10], 0
xor bl, bl
lea ecx, [ebp - 0x21c]
call fcn.100057a4
lea ecx, [ebp - 0x428]
call fcn.100057a4
mov al, bl
call fcn.10001b2d
ret 4
Function at 0x1008e88d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x238
mov eax, 0x100e509b
call fcn.10001af6
mov edi, ecx
lea ecx, [ebp - 0x21c]
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x18]
jle 0x1008e8d8
push 1
push esi
lea ecx, [ebp - 0x21c]
call fcn.100aa27c
xor esi, esi
mov ecx, ebx
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e8ee
shr eax, 1
mov ebx, dword [edi + 0xc]
mov ecx, 0x10178fec
mov dword [ebp - 0x220], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x23c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push ebx
jne 0x1008e952
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1008e958
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1008e967
mov ecx, eax
call fcn.1008d65e
mov esi, eax
jmp 0x1008e97b
mov eax, dword [ebp - 0x224]
inc eax
mov dword [edi + 0x5c], esi
mov dword [edi + 0x58], eax
mov byte [edi + 0x35], 1
mov dword [edi + 0x54], esi
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov eax, esi
call fcn.10001b2d
ret

Function at 0x1008e98e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x224
mov eax, 0x100e5155
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
mov esi, dword [edi + 0x58]
mov dword [ebp - 0x228], eax
call fcn.10005575
xor ebx, ebx
push ebx
push esi
call fcn.100aa27c
mov ecx, 0x10178fec
mov dword [ebp - 4], ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov eax, dword [ebp - 0x18]
jne 0x1008e9d6
shr eax, 1
mov ecx, dword [ebp - 0x228]
push 0x100ea6e8
mov dword [ebp - 0x220], eax
call fcn.100aa27c
mov eax, dword [edi + 0xc]
mov ecx, 0x10178fec
mov esi, dword [edi + 0x54]
mov dword [ebp - 0x224], eax
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0x224]
jne 0x1008ea2a
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1008ea30
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1008ea4d
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x21c]
push eax
call fcn.100aa27c
inc dword [edi + 0x54]
mov bl, 1
jmp 0x1008ea50
mov byte [edi + 0x35], bl
lea ecx, [ebp - 0x21c]
call fcn.100057a4
mov al, bl
call fcn.10001b2d
ret 4
Function at 0x10094be4
Capabilities:
Compare security identifiers

Disassembly:
push 0x2c
mov eax, 0x100e57cf
call fcn.1000131b
mov ebx, ecx
push ecx
lea ecx, [ebp - 0x14]
call fcn.10001e74
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
add ebx, 0x1c
push eax
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
push dword [eax]
call fcn.100aa27c
mov edi, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
sete byte [ebp - 0xd]
jne 0x10094c7f
lea ecx, [edi + 0xc]
call fcn.100aa27c
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x18]
push eax
call fcn.100aa27c
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x1c]
push eax
call fcn.100aa27c
mov eax, dword [ebp + 0x14]
lea ecx, [edi + 0xc]
mov edx, dword [edi + 0x24]
mov dword [eax], edx
call fcn.100aa27c
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
dec eax
push 1
pop ebx
jne 0x10094d2a
test edi, edi
je 0x10094d2a
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax]
jmp 0x10094d2a
and dword [ebp - 0x38], ecx
lea eax, [ebp - 0x38]
and dword [ebp - 0x34], ecx
mov ecx, ebx
movaps xmm0, xmmword [0x1012c1e0]
or dword [ebp - 0x20], 0xffffffff
push eax
movups xmmword [ebp - 0x30], xmm0
call fcn.100aa27c
test eax, eax
jne 0x10094d1c
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x10094cbe
mov eax, dword [ebp - 0x2c]
cmp eax, 6
ja 0x10094cbe
mov esi, dword [esi + eax*4 + 0x20]
jmp 0x10094cc0
xor esi, esi
lea ecx, [esi + 0xc]
call fcn.100aa27c
mov eax, dword [ebp + 8]
push dword [esi + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10094cfd
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0x18]
push eax
call fcn.100aa27c
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1c]
push eax
call fcn.100aa27c
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x24]
mov byte [ebp - 0xd], bl
mov dword [ecx], eax
lea ecx, [esi + 0xc]
call fcn.100aa27c
cmp byte [ebp - 0xd], 0
jne 0x10094d1a
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.100aa27c
test eax, eax
je 0x10094ca9
mov ebx, edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.100aa27c
mov bl, byte [ebp - 0xd]
lea ecx, [ebp - 0x14]
call fcn.1000221e
mov al, bl
call fcn.100013b7
ret 0x10
Function at 0x10096d8a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jne 0x10096da3
xor eax, eax
jmp 0x10096e4c
lea eax, [ebp - 4]
push eax
push esi
push 0x40000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x10096e32
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x408]
add eax, ecx
mov edx, dword [edi + 0x40c]
cmp eax, edx
jbe 0x10096de2
sub eax, edx
mov ecx, edi
push eax
call fcn.100aa27c
mov ecx, dword [edi + 0x408]
mov eax, dword [edi]
lea eax, [eax + ecx*2]
lea ecx, [ebp - 4]
push ecx
push eax
push 0x40000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x10096e1c
mov eax, dword [edi + 0x408]
mov esi, dword [ebp - 4]
add eax, esi
cmp eax, dword [edi + 0x40c]
ja 0x10096e4a
mov dword [edi + 0x408], eax
jmp 0x10096e4a
mov eax, dword [vtable.VprocessGlobals.0]
push str.Unable_to_write_base_64_encoded_value.
push esi
push esi
push 0x10178fec
call dword [eax + 0x24]
jmp 0x10096e47
mov ecx, dword [vtable.VprocessGlobals.0]
push str.Unable_to_determine_size_of_base_64_encoded_value.
push esi
push esi
push 0x10178fec
call dword [ecx + 0x24]
add esp, 0x10
mov eax, esi
pop edi
pop esi
leave
ret 8
Function at 0x10097396
Capabilities:
Get thread local storage value

Disassembly:
push 0xc
mov eax, 0x100e58bf
call fcn.1000131b
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push dword [0x10150ddc]
movzx esi, di
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1009749e
cmp dword [ebp + 8], 0x80001
je 0x1009749e
test di, di
jne 0x100973d7
movzx edi, word [eax + 0x68]
mov eax, 0x409
cmp di, ax
je 0x1009749e
test si, si
je 0x100973fb
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.100893c6
mov esi, eax
xor eax, eax
inc eax
jmp 0x10097408
lea ecx, [ebp + 0x14]
call fcn.100ab1e5
push 2
mov esi, eax
pop eax
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
lea ebx, [esi - 0xc]
lock inc dword [ebx]
mov dword [ebp - 4], 1
test al, 2
je 0x10097432
mov ecx, dword [ebp + 0x14]
and eax, 0xfffffffd
mov dword [ebp - 0x10], eax
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test al, 1
je 0x10097445
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
cmp dword [esi - 4], 0
je 0x10097495
test di, di
jne 0x10097467
push 0x5c
mov ecx, ebx
call fcn.100aa27c
add eax, 0xfffffffc
add eax, esi
push eax
call fcn.100aa27c
movzx edi, ax
mov eax, 0x409
cmp di, ax
je 0x10097495
push dword [ebp + 0x10]
lea edx, [ebp - 0x18]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1009754d
mov esi, eax
test esi, esi
je 0x10097495
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
jmp 0x100974ce
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_5727
xor ebx, ebx
mov ecx, dword [ebp + 8]
call fcn.100978aa
test eax, eax
js 0x100974cc
push 0xffffffffffffffff
push dword [eax*8 + 0x1014b384]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
push dword [ebp + 0xc]
call fcn.100aa27c
mov ebx, eax
mov eax, ebx
call fcn.100013b7
ret 0x10
Function at 0x100988dd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x100e5a6a
call fcn.10001af6
mov edi, ecx
mov eax, dword [edi + 0x68]
xor ebx, ebx
cmp dword [eax - 4], ebx
je 0x10098903
cmp dword [edi], ebx
je 0x10098903
mov al, 1
jmp 0x10098aa5
push 0x124
lea eax, [ebp - 0x13c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x13c]
mov edx, 0x1011ff30
mov ecx, str.042F907C_714C_41C0_ABDC_004DD2497A1C
push eax
call fcn.100aa27c
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x140]
call fcn.100aa27c
push 0x100ea6e8
lea eax, [ebp - 0x13c]
mov dword [ebp - 4], ebx
push eax
call fcn.100aa27c
test eax, eax
je 0x100989d2
push str.msstko32.dll
lea ecx, [ebp - 0x144]
call fcn.100aa27c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
mov esi, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
push dword [esi - 4]
push esi
push ebx
push dword [eax - 4]
call fcn.100aa27c
lea ecx, [esi - 0xc]
mov byte [ebp - 4], bl
call sym.fpsrvutl.dll_Ordinal_5727
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_4804
mov ecx, eax
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
test bl, bl
je 0x100989d0
xor ebx, ebx
inc ebx
jmp 0x10098a73
xor ebx, ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x144], 0x124
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftShared_ToolsProofing_Tools_stemmer1042Normal
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10098a20
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
push ebx
push str.Engine
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea eax, [ebp - 0x13c]
sete bh
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_1980
mov ecx, eax
mov byte [ebp - 4], 3
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
xor eax, eax
movzx ecx, bh
test bl, bl
cmove ecx, eax
lea eax, [ebp - 0x13c]
mov bl, cl
lea ecx, [ebp - 0x140]
push eax
call fcn.100aa27c
test bl, bl
je 0x10098a95
lea eax, [ebp - 0x140]
push eax
lea ecx, [edi + 0x68]
call fcn.100aa27c
cmp dword [edi], 0
jne 0x10098a95
push dword [ebp - 0x140]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [edi], eax
mov ecx, dword [ebp - 0x140]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov al, bl
call fcn.10001b2d
ret
Function at 0x10098aab
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x100e5a6a
call fcn.10001af6
lea edi, [ecx + 0x6c]
mov eax, dword [edi]
cmp dword [eax - 4], 0
je 0x10098acc
mov al, 1
jmp 0x10098c5c
push 0x124
xor ebx, ebx
lea eax, [ebp - 0x13c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x13c]
mov edx, str.1042Normal
mov ecx, str.CB4C9D1A_87CD_4CB9_A669_00AE2FE75DA5
push eax
call fcn.100aa27c
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x140]
call fcn.100aa27c
push 0x100ea6e8
lea eax, [ebp - 0x13c]
mov dword [ebp - 4], ebx
push eax
call fcn.100aa27c
test eax, eax
je 0x10098b9d
push str.mssp3ko.lex
lea ecx, [ebp - 0x144]
call fcn.100aa27c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x140]
mov esi, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
push dword [esi - 4]
push esi
push ebx
push dword [eax - 4]
call fcn.100aa27c
lea ecx, [esi - 0xc]
mov byte [ebp - 4], bl
call sym.fpsrvutl.dll_Ordinal_5727
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_4804
mov ecx, eax
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
test bl, bl
je 0x10098b9b
xor ebx, ebx
inc ebx
jmp 0x10098c3e
xor ebx, ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x144], 0x124
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftShared_ToolsProofing_Tools_stemmer1042Normal
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10098beb
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
push ebx
push str.Dictionary
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea eax, [ebp - 0x13c]
sete bh
push eax
lea ecx, [ebp - 0x158]
call sym.fpsrvutl.dll_Ordinal_1980
mov ecx, eax
mov byte [ebp - 4], 3
call sym.fpsrvutl.dll_Ordinal_542
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0
mov bl, al
call sym.fpsrvutl.dll_Ordinal_974
xor eax, eax
movzx ecx, bh
test bl, bl
cmove ecx, eax
lea eax, [ebp - 0x13c]
mov bl, cl
lea ecx, [ebp - 0x140]
push eax
call fcn.100aa27c
test bl, bl
je 0x10098c4c
lea eax, [ebp - 0x140]
mov ecx, edi
push eax
call fcn.100aa27c
mov ecx, dword [ebp - 0x140]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov al, bl
call fcn.10001b2d
ret
Function at 0x100a8405
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
push edi
cmp eax, 2
jne 0x100a842b
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
jmp 0x100a8431
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
pop edi
pop esi
pop ecx
ret

Function at 0x100a8435
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
cmp eax, 2
jne 0x100a8456
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
pop esi
ret
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
pop esi
ret

Function at 0x100a8d84
Capabilities:
Enumerate files on windows

Disassembly:
push 0x67c
mov eax, 0x100e76f4
call fcn.10001af6
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x688], eax
call fcn.10005575
mov ebx, 0x10178fec
mov esi, 0x104
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
mov ecx, 0x208
cmove esi, ecx
cmp esi, dword [ebp - 0x1c]
jle 0x100a8dd8
push 1
push esi
lea ecx, [ebp - 0x220]
call fcn.100aa27c
and dword [ebp - 4], 0
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [ebp - 0x1c]
cmp eax, 2
jne 0x100a8ded
shr ecx, 1
lea edx, [ebp - 0x220]
call fcn.100a8405
test eax, eax
je 0x100a8f3e
lea ecx, [ebp - 0x680]
call fcn.10005575
push edi
call fcn.100aa27c
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 1
call fcn.100a8435
test eax, eax
je 0x100a8f24
mov dword [ebp - 0x684], 0x1017c79c
lock inc dword [0x1017c790]
mov ecx, ebx
mov byte [ebp - 4], 2
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x470]
push eax
jne 0x100a8e5d
push 0x100ef5a0
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x100a8e68
push 0x100efcd4
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a8f16
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp - 0x688]
test byte [ebp - 0x470], 0x10
jne 0x100a8ee2
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x444]
jne 0x100a8ea8
push eax
lea ecx, [ebp - 0x684]
call sym.fpsrvutl.dll_Ordinal_3753
jmp 0x100a8ec3
push 0
push eax
call fcn.100aa27c
push eax
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x684]
call sym.fpsrvutl.dll_Ordinal_1496
mov ecx, dword [ebp - 0x684]
mov dl, bl
call fcn.100a8f53
test al, al
je 0x100a8ee2
lea eax, [ebp - 0x684]
mov ecx, edi
push eax
call fcn.100aa27c
mov ecx, 0x10178fec
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
lea eax, [ebp - 0x470]
push eax
push esi
jne 0x100a8f01
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x100a8f07
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x100a8e7c
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp - 0x684]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 0
call fcn.100057a4
lea ecx, [ebp - 0x220]
call fcn.100a8435
lea ecx, [ebp - 0x220]
call fcn.100057a4
call fcn.10001b2d
ret 8