joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d20b0
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x11b9af9
call fcn.010aa5f6
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 8]
push 0x104
mov ecx, edi
mov dword [esi], 0x1015828
call fcn.01081fbb
mov eax, dword [edi]
xor ebx, ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov byte [esi + 0x22], bl
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x10d210e
mov ecx, dword [edi]
cmp eax, dword [ecx + 4]
ja 0x10d210e
mov ecx, edi
call fcn.01084449
jmp 0x10d2115
mov ecx, edi
call fcn.010831c6
mov ecx, esi
call fcn.010d2053
mov eax, esi
call fcn.010aa6e2
ret

Function at 0x10d2365
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 4
mov esi, ecx
push esi
push 0x10d22ac
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x10d2397
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10d23dc
mov ecx, dword [esi + 0x30]
xor edx, edx
inc edx
shl edx, cl
mov dword [esi + 0x2e4], eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
test eax, eax
je 0x10d238f
mov ecx, dword [esi + 0x30]
xor eax, eax
inc eax
shl eax, cl
push ecx
push dword [esi + 0x2e4]
mov dword [esi + 0x2c0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
cmp eax, 0xffffffff
je 0x10d238f
mov eax, dword [ebp + 8]
mov dword [esi + 0x2b8], eax
xor eax, eax
pop esi
leave
ret 4
Function at 0x10d515d
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
push 0xc
mov eax, 0x11ba059
call fcn.010aa62e
mov esi, ecx
mov eax, dword [esi + 0x34c]
xor edi, edi
cmp eax, edi
jne 0x10d524e
push 0x1015da8
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.0107f008
mov eax, dword [ebp - 0x14]
mov ebx, 0xf0000048
push ebx
push 0x18
mov dword [ebp - 0x18], 4
mov eax, dword [eax + 0xc]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea ecx, [esi + 0x350]
push ecx
mov byte [ebp - 4], 1
call edi
test eax, eax
jne 0x10d51f6
push 0x1015d8c
lea ecx, [ebp - 0x14]
call fcn.010830c4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
push ebx
push 0x18
push eax
push 0
lea eax, [esi + 0x350]
push eax
call edi
test eax, eax
jne 0x10d51f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.0107d6e4
mov eax, esi
jmp 0x10d528b
lea edi, [esi + 0x354]
push edi
push 0
push 0x6610
push dword [esi + 0x350]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x10d51df
push 0
lea eax, [ebp - 0x18]
push eax
lea ebx, [esi + 0x368]
push ebx
push 8
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x10d51df
mov eax, dword [ebx]
add eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [esi + 0x36c], eax
call fcn.0107d6e4
jmp 0x10d5284
cmp eax, 1
jne 0x10d5276
push 0xf0000040
push eax
push edi
push edi
lea ebx, [esi + 0x350]
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10d527b
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10d528b
cmp eax, 2
jne 0x10d5288
mov eax, dword [ebp + 8]
mov dword [esi + 0x36c], eax
xor eax, eax
jmp 0x10d528b
push 0x57
pop eax
call fcn.010aa6e2
ret 4
Function at 0x10db7ef
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [eax], 0x1d4c0
lea eax, [ebp - 8]
push eax
push 3
xor esi, esi
push esi
push 0x1016978
push 0x80000002
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10db84f
jle 0x10db82e
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x10]
mov edi, eax
push edi
push 0x1016a04
push esi
push 0x494
add ecx, 8
call fcn.010dd415
mov eax, edi
pop edi
pop esi
leave
ret 4
push 4
pop edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, 0x10169e4
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10db896
cmp dword [ebp - 0x14], edi
jne 0x10db896
cmp dword [ebp - 0xc], edi
jne 0x10db896
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10db849
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1d4c0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10db887
jle 0x10db8bf
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x10]
mov esi, eax
push esi
push 0x1016a04
push 0
push 0x4b4
add ecx, 8
call fcn.010dd415
jmp 0x10db889

Function at 0x10e2f94
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [eax], 0x1d4c0
lea eax, [ebp - 8]
push eax
push 3
xor esi, esi
push esi
push 0x1017ca0
push 0x80000002
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10e2ff4
jle 0x10e2fd3
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x10]
mov edi, eax
push edi
push 0x1017c70
push esi
push 0x36b
add ecx, 0x20
call fcn.010dd415
mov eax, edi
pop edi
pop esi
leave
ret 4
push 4
pop edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, 0x1017c4c
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10e303b
cmp dword [ebp - 0x14], edi
jne 0x10e303b
cmp dword [ebp - 0xc], edi
jne 0x10e303b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10e2fee
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1d4c0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10e302c
jle 0x10e3064
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x10]
mov esi, eax
push esi
push 0x1017c70
push 0
push 0x38b
add ecx, 0x20
call fcn.010dd415
jmp 0x10e302e
Function at 0x10e549a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x101830c
mov dword [esi], 0x1018308
mov dword [esi + 4], 0x80004005
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x10e5507
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10e54ff
and eax, 0xffff
or eax, 0x80070000
mov dword [esi + 4], eax
jmp 0x10e55f5
push 0x10182f8
call edi
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x10e54eb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10182ec
push dword [esi + 8]
call edi
mov dword [esi + 0x10], eax
cmp eax, ebx
je 0x10e54eb
push 0x10182e0
push dword [esi + 8]
call edi
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x10e54eb
push 0x10182d0
push dword [esi + 0xc]
call edi
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x10e54eb
push 0x10182b0
push dword [esi + 0xc]
call edi
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x10e54eb
push 0x1018298
push dword [esi + 0xc]
call edi
mov dword [esi + 0x20], eax
cmp eax, ebx
je 0x10e54eb
push 0x1018280
push dword [esi + 0xc]
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x10e54eb
push 0x1018268
push dword [esi + 0xc]
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
je 0x10e54eb
push 0x1018254
push dword [esi + 0xc]
call edi
mov dword [esi + 0x2c], eax
cmp eax, ebx
je 0x10e54eb
push 0x101823c
push dword [esi + 0xc]
call edi
mov dword [esi + 0x30], eax
cmp eax, ebx
je 0x10e54eb
push 0x101821c
push dword [esi + 0xc]
call edi
mov dword [esi + 0x34], eax
cmp eax, ebx
je 0x10e54eb
push 0x10181fc
push dword [esi + 0xc]
call edi
mov dword [esi + 0x38], eax
cmp eax, ebx
je 0x10e54eb
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10f1c8f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 3
push ebx
push 0x101b520
push 0x80000002
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov byte [edi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x10f1cd5
jle 0x10f1d2e
and eax, 0xffff
or eax, 0x80070000
jmp 0x10f1d2e
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x101b588
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
cmp esi, ebx
jne 0x10f1d0e
mov byte [edi], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10f1d2d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x10f1d1b
xor esi, esi
cmp esi, ebx
jle 0x10f1d2b
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x10f1d39
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 3
push 0
push 0x101b520
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10f1d72
jle 0x10f1db0
and eax, 0xffff
or eax, 0x80070000
leave
ret
push esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x101b588
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x10f1dad
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
leave
ret

Function at 0x10f1db7
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 3
push 0
push 0x101b520
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10f1deb
jle 0x10f1e18
and eax, 0xffff
or eax, 0x80070000
leave
ret
push esi
push 0x101b588
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x10f1e15
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
leave
ret
Function at 0x10f3493
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, 0x1236750
cmp ax, word [0x1236750]
jne 0x10f3513
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0x1006f6c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10f34e6
push 0x101b63c
push 0x104
push esi
call fcn.0107bfbd
jmp 0x10f3513
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x101b60c
mov edi, 0x104
push edi
push esi
call fcn.0108e53d
add esp, 0x10
test eax, eax
jge 0x10f3512
push 0x101b63c
push edi
push esi
call fcn.0107bfbd
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010aa5e1
leave
ret

Function at 0x10f4b8f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xa8
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
mov edx, dword [esi + 0x6c]
imul edx, edx, 0x3e8
lea ecx, [esi + 0x6a4]
mov dword [ebp - 8], eax
sub eax, dword [ecx]
cmp eax, edx
jb 0x10f4c0b
mov eax, dword [ebp - 8]
mov dword [ecx], eax
call edi
mov edi, dword [sym.imp.msvcrt.dll_rand]
mov dword [esi + 0x6a8], eax
call edi
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fdiv qword [0x101b938]
fstp qword [esi + 0x6b8]
call edi
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fdiv qword [0x101b938]
fstp qword [esi + 0x6c8]
push dword [esi + 0x6a8]
call dword [sym.imp.msvcrt.dll_srand]
fld qword [esi + 0x6b8]
lea eax, [esi + 0x6b0]
fadd qword [eax]
pop ecx
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [eax]
lea eax, [esi + 0x6c0]
fld qword [esi + 0x6c8]
fadd qword [eax]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fstp qword [eax]
fld qword [ebp - 0x18]
call sub.msvcrt.dll__CIcos
fstp dword [ebp - 8]
fld qword [ebp - 0x10]
lea edi, [esi + 0x614]
call sub.msvcrt.dll__CIcos
fstp dword [ebp - 4]
fld dword [ebp - 4]
fmul dword [ebp - 8]
fmul qword [0x101b930]
fstp dword [edi]
fld qword [ebp - 0x10]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 4]
fld dword [ebp - 4]
fmul dword [ebp - 8]
fmul qword [0x101b930]
fstp dword [esi + 0x618]
fld qword [ebp - 0x18]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 4]
fld dword [ebp - 4]
mov eax, dword [esi + 0x14]
fmul qword [0x101b930]
sub esp, 0x10
fstp dword [esi + 0x61c]
fld dword [0x101b928]
fstp dword [esp + 0xc]
fld1
fst dword [esp + 8]
fild dword [esi + 0x14]
test eax, eax
jge 0x10f4cc8
fadd dword [0x10026f8]
mov eax, dword [esi + 0x18]
fild dword [esi + 0x18]
test eax, eax
jge 0x10f4cd8
fadd dword [0x10026f8]
fdivp st(1)
lea eax, [ebp - 0x60]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fstp dword [esp]
push eax
call fcn.011256d4
push 0x1228c38
push 0x12369e0
push edi
lea eax, [ebp - 0xa0]
push eax
call fcn.01127f88
push dword [ebx + 8]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.010f4946
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x10f4e8b
Capabilities:
Compress data via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 8]
push 0x12330b6
push edi
call fcn.010aa735
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x10f4eb3
mov esi, 0x8007000e
jmp 0x10f4f00
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push dword [esi + 0xc]
push edi
push ebx
push 2
call dword [sym.imp.ntdll.dll_RtlDecompressBuffer]
test eax, eax
je 0x10f4ee4
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x10f4ee0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10f4ef9
push edi
push ebx
push dword [esi + 0xc]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 4], eax
xor esi, esi
push ebx
call fcn.010a9620
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x10f4fbf
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], eax
test eax, eax
jne 0x10f4fe1
xor eax, eax
jmp 0x10f5013
cmp dword [ebp - 4], 0
jne 0x10f4fdd
cmp eax, dword [esi + 8]
jae 0x10f4fdd
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push dword [esi + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10f4fdd
mov ecx, esi
call fcn.010f4e8b
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
pop esi
leave
ret

Function at 0x10f506b
Capabilities:
Compress data via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 4]
mov edi, 0x12330b6
push edi
push ebx
call fcn.010aa735
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x10f509e
mov esi, 0x8007000e
jmp 0x10f5143
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.ntdll.dll_RtlGetCompressionWorkSpaceSize]
test eax, eax
je 0x10f50cb
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x10f50c7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10f512b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
jb 0x10f50d9
lea eax, [ebp - 0x10]
mov eax, dword [eax]
push edi
push eax
call fcn.010aa735
pop ecx
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x10f50f2
mov esi, 0x8007000e
jmp 0x10f512b
push eax
lea eax, [ebp - 0x14]
push eax
push 0x400
push ebx
push dword [ebp - 4]
push dword [esi + 4]
push dword [esi + 0xc]
push 2
call dword [sym.imp.ntdll.dll_RtlCompressBuffer]
test eax, eax
jne 0x10f50b2
push dword [ebp - 0x14]
push dword [ebp - 4]
push dword [esi + 0xc]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [esi + 4], eax
xor esi, esi
push dword [ebp - 4]
call fcn.010a9620
cmp dword [ebp - 8], 0
pop ecx
je 0x10f5143
push dword [ebp - 8]
call fcn.010a9620
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10f514f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], 0xffffffff
je 0x10f51b1
cmp byte [esi], bl
je 0x10f51a4
call fcn.010f506b
cmp eax, ebx
jl 0x10f51ca
push ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push dword [esi + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10f518e
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 4]
je 0x10f51a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10f51ca
and eax, 0xffff
or eax, 0x80070000
jmp 0x10f51ca
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x10f51c2
push eax
call fcn.010a9620
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x10fcd97
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x11bbfea
call fcn.010aa62e
xor esi, esi
push 0x400
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.01081fbb
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebp + 8]
push 1
call fcn.010f5a9e
cmp eax, esi
jge 0x10fcddc
mov esi, eax
lea ecx, [ebp - 0x14]
call fcn.0107d6e4
mov eax, esi
jmp 0x10fce1a
mov eax, dword [ebp - 0x14]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10fcdd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10fcdce
and eax, 0xffff
or eax, 0x80070000
jmp 0x10fcdce
call fcn.010aa6e2
ret 8
Function at 0x110436e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push esi
mov esi, ecx
movzx eax, word [esi + 0xc]
push edi
push 0xa
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x11043a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x11043e9
and eax, 0xffff
or eax, 0x80070000
jmp 0x11043e9
push ebx
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x11043d0
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x14], eax
test eax, eax
je 0x11043d0
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x11043e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x11043e8
and eax, 0xffff
or eax, 0x80070000
jmp 0x11043e8
xor eax, eax
pop ebx
pop edi
pop esi
ret
Function at 0x11190e4
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1237f50], edi
jne 0x1119200
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x111914b
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1237f50], edi
pop esi
je 0x11191d3
dec eax
jne 0x1119200
cmp dword [ebp - 0x11c], 5
jne 0x11191c0
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x11191b4
dec eax
je 0x11191a1
dec eax
je 0x1119187
mov dword [0x1237f50], 0x14
jmp 0x1119200
cmp word [ebp - 0xc], 1
jb 0x1119198
mov dword [0x1237f50], 0x10
or dword [0x1237f50], 4
jmp 0x1119200
cmp word [ebp - 0xc], 2
jb 0x1119198
mov dword [0x1237f50], 8
jmp 0x1119198
mov dword [0x1237f50], 4
jmp 0x1119200
cmp dword [ebp - 0x11c], 4
ja 0x1119212
mov dword [0x1237f50], 2
cmp dword [ebp - 0x11c], 4
jne 0x1119200
cmp dword [ebp - 0x118], edi
je 0x11191f6
cmp dword [ebp - 0x118], 0xa
je 0x11191f6
cmp dword [ebp - 0x118], 0x5a
jne 0x1119200
mov dword [0x1237f50], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1237f50]
xor ecx, ebp
pop edi
call fcn.010aa5e1
leave
ret
mov dword [0x1237f50], 0x20
jmp 0x1119200

Function at 0x1119223
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1119277
push 3
lea eax, [ebp - 0x44]
push 0x104ca48
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.010aa5e1
leave
ret

Function at 0x111928c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x1237f54]
jne 0x1119327
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x104c978
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1119326
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x104ca30
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1119326
push 3
push dword [esi*8 + 0x104c7c8]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x1119318
inc esi
cmp esi, 0x1c
jb 0x11192f7
jmp 0x1119326
mov ax, word [esi*8 + 0x104c7cc]
mov word [0x1237f54], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x1237f54]
xor ecx, ebp
call fcn.010aa5e1
leave
ret