joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004af1a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
je 0x1004af44
call fcn.1004afa6
test al, al
je 0x1004af3b
push 0x80070006
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 8]
push eax
push edi
push esi
push 0x1004aee0
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
test eax, eax
jne 0x1004af69
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::ThrowLastError_void_]
ret 0xc

Function at 0x1004cc48
Capabilities:
Get memory capacity

Disassembly:
push 0x68
mov eax, 0x10078cb6
call fcn.1007568d
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], esi
cmp esi, dword [edi + 0xc0]
jb 0x1004cc6f
push 0x80070057
call dword [sym.imp.PhotoBase.dll_void___stdcall_ATL::BaseAtlThrow_long_int_]
mov ecx, dword [edi + 0xbc]
mov ebx, esi
shl ebx, 7
mov eax, dword [ecx + ebx + 0x68]
or eax, dword [ecx + ebx + 0x6c]
jne 0x1004cd97
push esi
lea eax, [ebp - 0x74]
mov ecx, edi
push eax
call fcn.1004ce56
cmp esi, dword [edi + 0xc0]
jae 0x1004cc64
mov eax, dword [edi + 0xbc]
mov edx, 0x10004c20
add eax, 0x44
add eax, ebx
xor ecx, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [eax + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x1004cd13
mov eax, dword [ebp - 0x60]
inc ecx
cmp ecx, 4
jne 0x1004ccb1
and dword [ebp - 0x58], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
mov eax, dword [edi + 0xec]
push ecx
push dword [ebp - 0x68]
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x34]
call dword [0x10089918]
call dword [esi + 0x34]
test eax, eax
js 0x1004cd2d
mov eax, dword [ebp - 0x58]
push dword [ebp - 0x60]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x10089918]
call esi
test eax, eax
js 0x1004cd2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1000af40
mov esi, dword [ebp - 0x68]
mov edx, dword [ebp - 0x60]
mov ecx, dword [edi + 0xe8]
call fcn.10045cc0
mov ecx, eax
cmp ecx, 0x10
jbe 0x1004cd3f
push 4
pop eax
jmp 0x1004cd48
lea ecx, [ebp - 0x58]
call fcn.1000af40
xor al, al
call fcn.1002c4f4
ret 4
xor eax, eax
cmp ecx, 8
seta al
inc eax
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push ecx
lea ecx, [ebp - 0x64]
push ecx
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x74]
call fcn.1004d228
mov ecx, eax
call fcn.1004d24d
mov ecx, eax
call fcn.1004d24d
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp esi, dword [edi + 0xc0]
jae 0x1004cc64
push 0
push 3
push eax
push ecx
call fcn.10075810
mov ecx, dword [edi + 0xbc]
mov dword [ecx + ebx + 0x68], eax
mov dword [ecx + ebx + 0x6c], edx
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1004cd35
cmp esi, dword [edi + 0xc0]
jae 0x1004cc64
mov ecx, dword [edi + 0xbc]
mov eax, dword [ecx + ebx + 0x6c]
cmp eax, dword [ebp - 0x40]
ja 0x1004cd35
jb 0x1004cdda
mov eax, dword [ecx + ebx + 0x68]
cmp eax, dword [ebp - 0x44]
jae 0x1004cd35
mov al, 1
jmp 0x1004cd37
Function at 0x100513e7
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x64
pop esi
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10051466
cmp dword [ebp - 0x114], 6
jb 0x10051466
and dword [ebp - 0x11c], 0
lea edx, [ebp - 0x120]
and dword [ebp - 0x120], 0
lea ecx, [ebp - 0x11c]
call fcn.10051350
test eax, eax
js 0x10051466
cmp dword [ebp - 0x11c], 6
jae 0x10051469
push 0x50
pop esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10074c00
mov esp, ebp
pop ebp
ret

Function at 0x1005147a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100514db
cmp dword [ebp - 0x114], 5
jae 0x100514dd
cmp dword [ebp - 0x114], 4
jne 0x100514db
cmp dword [ebp - 0x110], 0x5a
jae 0x100514dd
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c4f4
mov esp, ebp
pop ebp
ret

Function at 0x10052e9c
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x10076879
call fcn.1007568d
mov edi, ecx
cmp byte [edi + 0x10], 0
jne 0x10052ebb
push 0x80004005
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
push 2
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov eax, dword [edi + 0x50]
push ecx
push 1
push eax
mov esi, dword [eax]
mov ecx, dword [esi + 0x18]
call dword [0x10089918]
call dword [esi + 0x18]
test eax, eax
jns 0x10052ee9
push eax
jmp 0x10052eb5
mov eax, dword [edi + 0x4c]
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
mov esi, dword [eax]
mov ecx, dword [esi + 0x18]
call dword [0x10089918]
call dword [esi + 0x18]
test eax, eax
js 0x10052ee6
xor eax, eax
cmp byte [edi + 0x64], al
setne al
lea eax, [eax*2 + 1]
push eax
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp - 0x14], 0
je 0x10052f2d
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EndDeferWindowPos]
call fcn.1007563c
ret
Function at 0x10055a01
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x84], 0
je 0x10055b0e
mov edx, dword [esi + 0x80]
test edx, edx
je 0x10055b0e
movzx eax, word [ebp + 8]
cmp eax, 0x25
ja 0x10055ac6
je 0x10055aa6
sub eax, 9
je 0x10055a74
sub eax, 4
je 0x10055a6a
sub eax, 0x14
je 0x10055a60
sub eax, 1
jne 0x10055b0e
mov eax, dword [edx]
mov esi, dword [eax + 0x20]
jmp 0x10055b01
mov eax, dword [edx]
mov esi, dword [eax + 0x1c]
jmp 0x10055b01
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
jmp 0x10055b01
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x80]
push ecx
mov esi, dword [ecx]
test ax, ax
jns 0x10055a98
mov ecx, dword [esi + 0x2c]
call dword [0x10089918]
call dword [esi + 0x2c]
jmp 0x10055b12
mov ecx, dword [esi + 0x28]
call dword [0x10089918]
call dword [esi + 0x28]
jmp 0x10055b12
call fcn.10064ea2
mov ecx, dword [esi + 0x80]
push ecx
mov esi, dword [ecx]
test al, al
jne 0x10055aee
mov ecx, dword [esi + 0xc]
call dword [0x10089918]
call dword [esi + 0xc]
jmp 0x10055b12
sub eax, 0x26
je 0x10055afc
sub eax, 1
je 0x10055adc
sub eax, 1
jne 0x10055b0e
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
jmp 0x10055b01
call fcn.10064ea2
mov ecx, dword [esi + 0x80]
push ecx
mov esi, dword [ecx]
test al, al
jne 0x10055ab8
mov ecx, dword [esi + 0x10]
call dword [0x10089918]
call dword [esi + 0x10]
jmp 0x10055b12
mov eax, dword [edx]
mov esi, dword [eax + 0x14]
push edx
mov ecx, esi
call dword [0x10089918]
call esi
jmp 0x10055b12
and dword [esi + 0x74], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10074c00
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10055e41
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x10079505
call fcn.100756c3
mov esi, ecx
push 7
push dword [esi + 0x8c]
mov byte [esi + 0xac], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebp - 4], 0
mov edx, 0x10006310
mov ecx, 0x10006490
call fcn.10056ded
call fcn.10075628
ret 4
Function at 0x100598d2
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
inc esi
xor edi, edi
push esi
push dword [ebx + 0xdcc]
lea eax, [ebx + 0x7c]
push esi
push 0xea62
push ecx
push ecx
push edi
push edi
push 0x36b8
push eax
call fcn.10059a41
push esi
push dword [ebx + 0xdcc]
lea eax, [ebx + 0x234]
push esi
push 0xea65
push ecx
push ecx
push edi
push edi
push 0x36bb
push eax
mov ecx, ebx
call fcn.10059a41
push esi
push dword [ebx + 0xdcc]
lea eax, [ebx + 0x3ec]
push 2
push 0xea67
push ecx
push ecx
push edi
push edi
push 0x36bd
push eax
mov ecx, ebx
call fcn.10059a41
push esi
push dword [ebx + 0xdcc]
lea eax, [ebx + 0x5a4]
push esi
push 0xea66
push ecx
push ecx
push edi
push edi
push 0x36dd
push eax
mov ecx, ebx
call fcn.10059a41
push esi
push dword [ebx + 0xdcc]
lea eax, [ebx + 0x75c]
push esi
push 0xea68
push ecx
push ecx
push edi
push edi
push 0x36be
push eax
mov ecx, ebx
call fcn.10059a41
push esi
push 0
push 2
push 0xea69
push ecx
push ecx
push 0x36cc
push 0x36bf
lea edi, [ebx + 0x914]
push 0
push edi
mov ecx, ebx
call fcn.10059a41
xor eax, eax
lea esi, [ebx + 0xacc]
push eax
push eax
push 2
push 0xea6a
push ecx
push ecx
push 0x36cd
push 0x36c0
push eax
push esi
mov ecx, ebx
call fcn.10059a41
push ecx
push ecx
mov ecx, edi
call fcn.1005983b
push ecx
mov ecx, esi
call fcn.10067f2f
push 0
lea esi, [ebx + 0x918]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
mov edi, 0x20000
lea ecx, [ebx + 0x80]
push edi
push 0
call fcn.1005679a
push ecx
push edi
push 0
mov ecx, esi
call fcn.1005679a
push 4
add ebx, 0x238
pop esi
push ecx
push 0
push 0x10000
mov ecx, ebx
call fcn.1005679a
add ebx, 0x1b8
sub esi, 1
jne 0x10059a23
pop edi
pop esi
pop ebx
ret
Function at 0x1005d92c
Capabilities:
Get file system object information

Disassembly:
push 0x2cc
mov eax, 0x10079be4
call fcn.1007568d
mov dword [ebp - 0x2d0], edx
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1005dac7
call dword [sym.imp.PhotoBase.dll_public:_static_class_ATL::CAtlStringMgr____stdcall_Base::String::GetBaseStringManager_void_]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.1000fe1b
xor eax, eax
mov dword [ebp - 4], eax
call dword [sym.imp.PhotoBase.dll_public:_static_class_ATL::CAtlStringMgr____stdcall_Base::String::GetBaseStringManager_void_]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.1000fe1b
xor eax, eax
mov byte [ebp - 4], 1
push 0x2b4
push eax
lea eax, [ebp - 0x2c4]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
test esi, esi
je 0x1005da69
lea eax, [ebp - 0x2d4]
mov ecx, esi
push eax
call fcn.1005eadb
test eax, eax
js 0x1005da0a
push 0x210
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0x80
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor esi, esi
test eax, eax
je 0x1005da6b
lea ecx, [ebp - 0x2b8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1005d9e6
sub ecx, edx
lea eax, [ebp - 0x2b8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c8]
call fcn.1002c18e
jmp 0x1005da6b
lea eax, [ebp - 0x2c8]
push 0x105
mov ecx, eax
mov dword [ebp - 0x2d8], eax
call fcn.1000fbd2
mov dword [ebp - 0x2d4], eax
push 0x104
push esi
push ecx
mov edx, 0x105
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.1005eb38
test eax, eax
jns 0x1005da4a
push eax
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c8]
call fcn.1000dd7d
push eax
lea ecx, [ebp - 0x2c8]
call fcn.1000fc33
mov byte [ebp - 4], 1
xor esi, esi
mov eax, dword [ebp - 0x2c8]
cmp dword [eax - 0xc], esi
je 0x1005da8f
push edi
push eax
push dword [ebp - 0x2d0]
lea eax, [ebp - 0x2cc]
push eax
call fcn.1005ea21
add esp, 0x10
jmp 0x1005daa3
mov ecx, edi
call fcn.1000dd7d
push eax
push edi
lea ecx, [ebp - 0x2cc]
call fcn.1002c18e
mov esi, dword [ebp - 0x2cc]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [esi - 0x10]
call fcn.1000fe6d
mov ecx, dword [ebp - 0x2c8]
lea ecx, [ecx - 0x10]
call fcn.1000fe6d
call fcn.1007563c
ret 8

Function at 0x1005dacf
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, 0x102
mov eax, dword [edi + 4]
cmp eax, 0x100
je 0x1005daf1
cmp eax, 0x101
je 0x1005daf1
cmp eax, ecx
jne 0x1005db4f
xor ebx, ebx
cmp eax, ecx
push esi
sete bl
dec ebx
and ebx, 0xffffff80
add ebx, 0x84
cmp dword [edi + 8], 9
mov esi, ebx
je 0x1005db36
cmp dword [edi + 8], 0x24
jbe 0x1005db39
cmp dword [edi + 8], 0x28
ja 0x1005db39
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1005db39
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1005db39
or esi, 1
jmp 0x1005db39
or esi, 2
push edi
push 0
push 0x87
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
test esi, eax
pop esi
setne bl
pop edi
mov al, bl
pop ebx
ret
Function at 0x1005dc8f
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x10079c61
call fcn.1007568d
mov dword [ebp - 0x1c], edx
mov edi, ecx
test edi, edi
jne 0x1005dcaf
push 0x80070057
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
mov esi, dword [edi]
push 1
push eax
push edi
mov ecx, dword [esi + 0x34]
call dword [0x10089918]
call dword [esi + 0x34]
cmp eax, 0x80030002
je 0x1005dda4
test eax, eax
jns 0x1005dcde
push eax
jmp 0x1005dca9
push 0x7f02
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ebx, eax
test ebx, ebx
je 0x1005dd04
call dword [sym.imp.USER32.dll_GetCursor]
mov esi, eax
push ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1005dd09
xor esi, esi
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
mov eax, dword [edi]
push edi
mov edi, dword [eax + 0x38]
mov ecx, edi
call dword [0x10089918]
call edi
test eax, eax
js 0x1005dcdb
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
push eax
call fcn.100737e9
cmp dword [ebp - 0x28], 0
ja 0x1005dd52
push 0x80070057
call dword [sym.imp.PhotoBase.dll_void___stdcall_ATL::BaseAtlThrow_long_int_]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.1002c357
mov ebx, eax
lea edi, [ebx + 0x10]
mov dword [ebp - 0x30], edi
push edi
mov byte [ebp - 4], 3
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005dca4
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
mov ecx, edi
push dword [ebp + 8]
call fcn.1005ddde
mov ecx, ebx
call fcn.1000fe6d
lea ecx, [ebp - 0x2c]
call fcn.1000c7f2
test esi, esi
je 0x1005dda4
push esi
call dword [sym.imp.USER32.dll_SetCursor]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1005ddbf
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x10089918]
call esi
call fcn.1007563c
ret 8
Function at 0x1005ebba
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, ecx
xor ebx, ebx
push esi
push edi
mov esi, ebx
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1005ebdb
sub edx, edi
mov eax, 0x104
sar edx, 1
cmp edx, eax
jb 0x1005ebfe
push 0x80070057
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
push ecx
mov edx, eax
lea ecx, [ebp - 0x20c]
call fcn.1005eb81
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1005ec84
push 0x5c
pop edi
lea eax, [ebp - 0x20c]
inc esi
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x1005ec80
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1005ec20
jmp 0x1005ec80
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1005ec56
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
dec esi
push ebx
push eax
mov word [ebp + ecx*2 - 0x20c], di
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1005ec95
test esi, esi
jne 0x1005ec4d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10074c00
mov esp, ebp
pop ebp
ret
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::ThrowLastError_void_]
int3

Function at 0x10064510
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 0x10006ac8
mov esi, 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
xor ebx, ebx
call fcn.1002bfee
add esp, 0x10
test eax, eax
js 0x100645df
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x61c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100645df
lea eax, [ebp - 0x638]
mov dword [ebp - 0x634], 1
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x638], esi
push eax
lea eax, [ebp - 0x634]
push eax
push ebx
push 0x10005134
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100645d3
cmp dword [ebp - 0x634], 1
jne 0x100645d3
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x100645d3
mov bl, 1
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.10074c00
mov esp, ebp
pop ebp
ret
Function at 0x100646c6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push ecx
push 0x10064690
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x1006471e
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1006470e
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1006470e
mov esi, dword [ebp - 4]
jmp 0x10064715
call fcn.100644c4
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10064725
call fcn.100644c4
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006492b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push esi
push edi
push eax
push 0x20019
xor edi, edi
push edi
push 0x10006a10
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, edi
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10064a41
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10064a24
cmp dword [ebp - 0x214], esi
jbe 0x10064a33
test esi, esi
js 0x10064a33
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x218]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x10064a0e
push 4
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.100643bd
mov esi, eax
jmp 0x10064a19
jle 0x10064a19
movzx esi, si
or esi, 0x80070000
inc edi
cmp edi, dword [ebp - 0x214]
jb 0x100649b0
jmp 0x10064a33
jg 0x10064a2a
mov esi, eax
jmp 0x10064a33
movzx esi, ax
or esi, 0x80070000
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10064a4d
cmp eax, 2
je 0x10064a4d
call fcn.100644c4
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10074c00
mov esp, ebp
pop ebp
ret 4
Function at 0x10064b39
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x10064b5c
xor al, al
jmp 0x10064bed
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
xor ebx, ebx
inc ebx
jmp 0x10064bcc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jl 0x10064bd0
push ebx
push eax
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x10064be9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x10064b8b
push ebx
push 0xffffffffffffffff
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
sete bl
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10074c00
mov esp, ebp
pop ebp
ret
Function at 0x10064fa3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10087d94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x60], eax
xor ebx, ebx
lea eax, [ebp - 0x5c]
push 0x40
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x68], esi
mov dword [edi], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5c]
push 0x20
push eax
push 0x1014
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100650bb
push ebx
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], ebx
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
sub eax, 1
je 0x100650b5
sub eax, 1
jne 0x100650bb
push 0x10006ba0
push esi
mov dword [edi], 1
call dword [sym.imp.msvcrt.dll_wcspbrk]
pop ecx
pop ecx
test eax, eax
je 0x100650bb
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push 0xb
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
push 0x13
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100650bb
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x1006505f
sub esi, ecx
mov ecx, dword [ebp - 0x60]
sar esi, 1
push esi
call fcn.1000fbd2
mov edx, eax
test esi, esi
jle 0x100650a8
mov edi, dword [ebp - 0x68]
mov ebx, esi
sub edi, edx
movzx ecx, word [edi + edx]
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x1006509d
movzx eax, word [ebp + ecx*2 - 0x7c]
test ax, ax
je 0x1006509d
mov ecx, eax
mov word [edx], cx
add edx, 2
sub ebx, 1
jne 0x10065084
mov ecx, dword [ebp - 0x60]
push esi
call fcn.1000fc33
mov bl, 1
jmp 0x100650bb
mov dword [edi], 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10074c00
mov esp, ebp
pop ebp
ret 4