joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1013259
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
test dword [ecx + 0x1023348], edx
je 0x1013267
or eax, dword [ecx + 0x1023344]
add ecx, 8
cmp ecx, 0x18
jb 0x1013256
pop ebp
ret 4

Function at 0x101337c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], eax
je 0x1013431
push esi
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x1013430
cmp word [esi], ax
je 0x1013430
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [eax + eax + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x101342e
mov dword [ebp + 8], edi
jmp 0x10133d0
cmp ax, 0x20
jne 0x101334d
inc esi
inc esi
cmp word [esi], 0x20
je 0x1013345
xor eax, eax
cmp ax, word [esi]
je 0x10133dc
cmp dword [ebp - 4], 1
jne 0x1013367
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1013367
mov dword [eax], esi
inc dword [ebp - 4]
xor eax, eax
cmp word [esi], 0x22
sete al
mov dword [ebp - 8], eax
test eax, eax
je 0x10133bc
jmp 0x10133ba
cmp dword [ebp - 8], 0
jne 0x1013388
cmp ax, 0x20
je 0x10133c4
cmp ax, 0x22
jne 0x10133b0
push dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_CharPrevW]
test eax, eax
je 0x10133aa
cmp word [eax], 0x5c
jne 0x10133aa
mov cx, word [esi]
mov word [eax], cx
jmp 0x10133ba
and dword [ebp - 8], 0
jmp 0x10133ba
mov ecx, dword [ebp + 8]
add dword [ebp + 8], 2
mov word [ecx], ax
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x101337c
mov ecx, dword [ebp + 8]
xor eax, eax
add dword [ebp + 8], 2
mov word [ecx], ax
movzx eax, word [esi]
test ax, ax
jne 0x101333f
cmp word [edi], 0
je 0x101341e
mov eax, dword [ebp - 4]
test eax, eax
je 0x101341e
shl eax, 2
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x101341e
xor esi, esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push edi
mov dword [eax + esi*4], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
lea edi, [edi + eax*2 + 2]
cmp esi, dword [ebp - 4]
jb 0x1013403
jmp 0x101342e
and dword [ebp - 4], 0
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
pop esi
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x10136d4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push dword [ebp + 0xc]
xor edi, edi
and dword [ebp - 0x208], edi
and dword [ebp - 0x20c], edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1013763
lea eax, [ebp - 0x208]
push eax
push 1
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call fcn.0100feb7
test eax, eax
jl 0x1013763
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x208]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.01014598
test eax, eax
jl 0x1013763
push esi
push dword [ebp - 0x20c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1013762
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
push edi
call fcn.0100a9b9
test eax, eax
jge 0x1013762
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0100b8c5
leave
ret 8

Function at 0x1013d1a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x1013d7d
push esi
push esi
push 0x12
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
je 0x1013d41
push 0x3e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1013d72
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x1013d5d
and eax, edi
or eax, esi
test eax, eax
jge 0x1013d6d
call ebx
test eax, eax
jle 0x1013d69
and eax, edi
or eax, esi
mov esi, eax
jmp 0x1013d72
mov esi, 0x80004005
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1013dae
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x1013d99
and eax, edi
or eax, esi
test eax, eax
jge 0x1013da9
call ebx
test eax, eax
jle 0x1013da5
and eax, edi
or eax, esi
mov esi, eax
jmp 0x1013dae
mov esi, 0x80004005
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x101449f
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0100b746
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x1014539
xor ecx, ecx
cmp cx, word [eax]
je 0x1014539
push esi
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100a9b9
mov esi, eax
test esi, esi
jl 0x1014534
push edi
push 0x10018f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1014512
push 0x10038c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1014512
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 8
call eax
cmp eax, 1
jne 0x1014512
xor esi, esi
jmp 0x1014528
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1014526
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test edi, edi
je 0x1014533
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
jmp 0x101453e
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100b8c5
leave
ret 4

Function at 0x10149d8
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 4], 0x8007000e
test eax, eax
je 0x1014a2d
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10149c7
mov ebx, dword [ebp + 0x14]
sub eax, edx
sar eax, 1
test ebx, ebx
je 0x1014a2d
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp ecx, edi
jb 0x1014a2d
cmp edi, eax
ja 0x1014a2d
cmp ecx, eax
ja 0x1014a2d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub ecx, edi
push esi
inc ecx
mov esi, ecx
lea ecx, [esi + esi]
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebx], eax
test eax, eax
je 0x1014a27
lea ecx, [esi - 1]
push ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx + edi*2]
push ecx
push esi
push eax
call fcn.0101486a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
jmp 0x1014a32
mov eax, 0x80070057
pop edi
pop ebx
leave
ret 0x10
Function at 0x1015941
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
cmp ebx, edi
jne 0x101593e
mov eax, 0x80070057
jmp 0x1015a99
mov eax, dword [ebx]
push 0xc
pop ecx
mov dword [ebp + 8], ecx
cmp eax, edi
je 0x101596b
mov dword [ebp - 8], ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1015950
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0xc], eax
add eax, 0xc
mov dword [ebp + 8], eax
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x1015993
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x101597b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
add dword [ebp + 8], eax
mov dword [ebp - 0x10], eax
push esi
push dword [ebp + 8]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x10159e7
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x10159c4
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x10159da
call edi
test eax, eax
jle 0x10159d6
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10159df
mov edi, 0x80004005
test edi, edi
jl 0x1015a82
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
test eax, eax
je 0x1015a0e
push dword [ebx]
add eax, esi
push dword [ebp - 0xc]
push eax
call fcn.0101575d
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jl 0x1015a82
test ecx, ecx
je 0x1015a26
push dword [ebx + 4]
add ecx, esi
push dword [ebp - 0x10]
push ecx
call fcn.0101575d
mov edi, eax
test edi, edi
jl 0x1015a82
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x14]
push 0
push 0x4a
push dword [eax + 8]
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1015a4f
xor edi, edi
jmp 0x1015a82
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jle 0x1015a67
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x1015a7d
call edi
test eax, eax
jle 0x1015a79
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1015a82
mov edi, 0x80004005
test esi, esi
je 0x1015a96
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x1015d4d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], 0x80004005
cmp ecx, ebx
jne 0x1015d4b
mov eax, 0x80070057
jmp 0x1015e89
push edi
cmp dword [esi], ebx
jne 0x1015d6d
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
mov ecx, esi
call fcn.01015912
mov dword [ebp - 4], eax
jmp 0x1015e85
push ecx
call fcn.0101491a
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x1015e85
push 0x10
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, ebx
je 0x1015e62
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1015e57
lea eax, [ebp - 0x30]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
push 1
mov dword [ebp - 8], eax
call edi
mov edi, eax
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
cmp eax, ebx
je 0x1015e4e
push eax
push dword [esi + 0x34]
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
push dword [esi + 0x34]
mov dword [esi + 0x30], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
push 0xcc0020
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ebx
push ebx
push dword [ebp + 8]
push edi
push dword [ebp - 8]
push ebx
push ebx
push dword [esi + 0x34]
call dword [sym.imp.GDI32.dll_StretchBlt]
test eax, eax
jne 0x1015e4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1015e46
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1015e4e
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1015e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1015e76
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
push 1
push ebx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101648c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edi, dword [ebp + 8]
mov word [esi + 0x24], ax
cmp edi, ebx
je 0x10164e7
mov eax, dword [edi + 4]
mov dword [esi + 0x20], eax
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x101648d
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.01014315
test eax, eax
jl 0x101648d
mov ax, word [ebp + 8]
mov word [esi + 0x24], ax
cmp dword [edi + 0xc], ebx
je 0x10164ba
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x10164af
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10164af
mov dword [esi + 0x28], ebx
push dword [edi + 0xc]
call fcn.0101491a
mov dword [esi + 0x28], eax
cmp dword [edi + 0x10], ebx
je 0x10164e7
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x10164dc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10164dc
mov dword [esi + 0x14], ebx
push dword [edi + 0x10]
call fcn.0101491a
mov dword [esi + 0x14], eax
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x101654c
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x1016398
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x101654c
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi + 4]
call edi
cmp dword [esi], ebx
jne 0x1016541
push 0x3e8
push dword [ebp + 8]
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1016563
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1016560
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10184ff
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x250]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x254], ebx
call fcn.0100b746
add esp, 0xc
cmp esi, ebx
jne 0x101850d
mov eax, 0x80070057
jmp 0x10185e2
push edi
lea eax, [ebp - 0x254]
push eax
push 0x1004a0c
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
mov dword [ebp - 0x260], eax
call fcn.010125d0
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x25c], eax
mov edi, 0xffff
mov esi, 0x80070000
jne 0x101857b
call ebx
test eax, eax
jle 0x1018554
and eax, edi
or eax, esi
test eax, eax
jge 0x1018568
call ebx
test eax, eax
jle 0x1018560
and eax, edi
or eax, esi
mov dword [ebp - 0x258], eax
jmp 0x1018572
mov dword [ebp - 0x258], 0x80004005
cmp dword [ebp - 0x258], 0
jl 0x10185c6
lea eax, [ebp - 0x228]
push eax
call fcn.0101491a
mov ecx, dword [ebp - 0x264]
mov dword [ecx], eax
test eax, eax
je 0x101859c
and dword [ebp - 0x258], 0
jmp 0x10185c6
call ebx
test eax, eax
jle 0x10185a8
and eax, edi
or eax, esi
test eax, eax
jge 0x10185bc
call ebx
test eax, eax
jle 0x10185b4
and eax, edi
or eax, esi
mov dword [ebp - 0x258], eax
jmp 0x10185c6
mov dword [ebp - 0x258], 0x80004005
cmp dword [ebp - 0x25c], 0
pop edi
je 0x10185dc
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b8c5
leave
ret

Function at 0x10190ef
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
cmp esi, edi
jne 0x1019104
mov eax, 0x80070057
jmp 0x1019161
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [esi], edi
call fcn.01018be7
mov ebx, eax
cmp ebx, edi
jl 0x1019156
mov eax, dword [ebp - 8]
call fcn.01018e7c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.01018f36
mov ebx, eax
cmp ebx, edi
jl 0x1019140
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x1019156
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
call fcn.01018b30
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x101922e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x1019192
mov eax, 0x80070057
jmp 0x1019243
push edi
lea eax, [ebp - 0xc]
push eax
mov dword [esi], ebx
call fcn.0101c242
cmp eax, ebx
mov dword [ebp + 0x10], eax
jl 0x1019200
cmp dword [ebp - 0xc], ebx
jl 0x10191bf
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.010190e5
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jl 0x1019200
cmp dword [ebp - 8], ebx
je 0x10191f3
xor eax, eax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
lea edi, [ebp + 0xc]
stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp + 8]
push eax
mov dword [ebp + 0xc], 1
call fcn.0101cb9b
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jl 0x1019200
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.0101ce1e
cmp dword [ebp + 0x10], ebx
jl 0x1019210
mov dword [ebp + 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 4], ebx
je 0x1019231
push dword [ebp - 4]
push ebx
call edi
push eax
call esi
test eax, eax
je 0x1019231
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x101923f
push dword [ebp - 8]
push ebx
call edi
push eax
call esi
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1019297
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
mov eax, dword [esp + 0x18]
or eax, eax
jne 0x1019282
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword [esp + 0xc]
div ecx
mov edx, ebx
jmp 0x10192c3
mov ecx, eax
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 0x1019290
div ebx
mov esi, eax
mul dword [esp + 0x18]
mov ecx, eax
mov eax, dword [esp + 0x14]
mul esi
add edx, ecx
jb 0x10192be
cmp edx, dword [esp + 0x10]
ja 0x10192be
jb 0x10192bf
cmp eax, dword [esp + 0xc]
jbe 0x10192bf
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
ret 0x10
Function at 0x10195a3
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x1019642
cmp dword [ebp + 0x10], edi
jle 0x10195b7
cmp dword [ebp + 0xc], edi
je 0x1019642
cmp dword [ebp + 0x10], edi
jl 0x1019642
test dword [ebp + 0x14], 0xfffffffd
jne 0x1019642
push 0x10193c4
push 8
push 0x163
push 0x1007010
push dword [ebp + 8]
call fcn.0101e426
add esp, 0x14
cmp eax, edi
je 0x1019642
mov ecx, dword [eax + 4]
imul ecx, ecx, 0xc
mov edx, 0x1005f60
add ecx, edx
test byte [ebp + 0x14], 2
jne 0x1019603
push ecx
call fcn.010193df
test eax, eax
jne 0x1019642
mov eax, dword [ecx + 8]
imul eax, eax, 0xc
add eax, edx
mov eax, dword [eax + 4]
mov ecx, eax
lea edx, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
cmp si, di
jne 0x1019613
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp dword [ebp + 0xc], edi
je 0x101963e
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0101946b
test eax, eax
jge 0x101963e
push 0x7a
jmp 0x1019644
mov eax, esi
jmp 0x101964c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x101a58a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
test ebx, ebx
je 0x101a598
cmp ebx, 0x7fffffff
jbe 0x101a59d
mov eax, 0x80070057
mov esi, dword [ebp + 8]
test eax, eax
jl 0x101a5b5
lea edi, [ebp + 0xc]
mov edx, ebx
mov eax, esi
call fcn.0101a8ac
mov edx, dword [ebp + 0xc]
jmp 0x101a5b7
xor edx, edx
test eax, eax
jl 0x101a608
mov ecx, ebx
sub ecx, edx
lea eax, [esi + edx*2]
mov dword [ebp + 0xc], 0
je 0x101a5f7
mov esi, ecx
sub esi, ebx
lea edi, [esi + edx + 0x7fffffff]
mov esi, dword [ebp + 0x10]
sub esi, eax
test edi, edi
je 0x101a5f3
movzx edx, word [esi + eax]
test dx, dx
je 0x101a5f3
mov word [eax], dx
inc eax
inc eax
dec ecx
dec edi
test ecx, ecx
jne 0x101a5db
test ecx, ecx
jne 0x101a600
dec eax
dec eax
mov dword [ebp + 0xc], 0x8007007a
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x101a6ce
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x218], esi
call fcn.0100b746
add esp, 0xc
push 7
xor eax, eax
and dword [esi], eax
pop ecx
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
or dword [ebp - 0x238], 0xffffffff
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101a6e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x101a6d9
mov dword [ebp - 0x210], eax
jmp 0x101a7a8
and eax, 0xffff
or eax, 0x80070000
jmp 0x101a6ce
push 0x100802c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101a57f
mov dword [ebp - 0x210], eax
test eax, eax
jl 0x101a7a8
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x101a743
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100801c
push ebx
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x101a75f
push 0x1008008
push ebx
call esi
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x101a781
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101a757
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x101a79c
push 0x1007ff8
push ebx
call esi
mov dword [ebp - 0x230], eax
test eax, eax
je 0x101a743
push 0x1007fe8
push ebx
call esi
mov dword [ebp - 0x224], eax
jmp 0x101a73f
mov eax, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
push 8
mov dword [eax], ebx
pop ecx
lea esi, [ebp - 0x238]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x101a7a7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.0100b8c5
leave
ret 8
Function at 0x101a90f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, eax
xor eax, eax
test edx, edx
je 0x101a8f6
cmp edx, dword [ebp + 0xc]
jbe 0x101a8fb
mov eax, 0x80070057
test eax, eax
jl 0x101a909
mov eax, dword [ebp + 8]
call fcn.0101a8ac
jmp 0x101a90c
and dword [edi], 0
pop edi
pop ebp
ret 8