joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d2dc
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], eax
xor esi, esi
push esi
neg eax
mov dword [ebp - 0xc], 0xc
push 0x80
mov edi, ecx
mov dword [ebp - 4], esi
push 4
sbb eax, eax
lea ecx, [ebp - 0xc]
and eax, ecx
push eax
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov dword [edi + 0x28], eax
cmp eax, 0xffffffff
jne 0x1003d332
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
jmp 0x1003d35b
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetEndOfFile]
test eax, eax
je 0x1003d323
mov dword [edi + 0x238], esi
mov esi, 0x10001cc0
mov dword [edi + 0x2c], 1
add edi, 0x23c
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1003d475
Capabilities:
Get file size

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
push 0
push dword [edi + 0x28]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileSize]
mov edx, dword [edi + 0x238]
mov esi, eax
shl edx, 9
mov eax, 0x1000
sub esi, edx
sub esi, 0x200
cmp esi, eax
ja 0x1003d4a4
mov esi, eax
mov eax, dword [edi + 0x250]
mov dword [eax + 0x48], esi
lea eax, [esi + 0x1ff]
and dword [edi + 0x250], 0
shr eax, 9
add dword [edi + 0x238], eax
pop edi
pop esi
ret
Function at 0x1003e080
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
push edi
call fcn.1003b921
test eax, eax
js 0x1003e0d2
test edi, edi
jne 0x1003e0a1
lea edi, [ebp - 4]
push esi
mov esi, dword [ebp + 8]
push 0
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x18]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
mov ecx, dword [edi]
add dword [esi + 0x10], ecx
pop esi
test eax, eax
jne 0x1003e0d0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
jmp 0x1003e0d2
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003e550
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
call fcn.1003bef0
mov esi, eax
test esi, esi
js 0x1003e5bb
test edi, edi
jne 0x1003e571
lea edi, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x7fffff00
cmp dword [ebx + 0x10], eax
jae 0x1003e5b5
sub eax, dword [ebx + 0x10]
cmp dword [ebp + 0x10], eax
jae 0x1003e5b5
push 0
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x18]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
mov ecx, dword [edi]
add dword [ebx + 0x10], ecx
test eax, eax
jne 0x1003e5b1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
mov esi, eax
mov eax, esi
jmp 0x1003e5ba
mov eax, 0x80030111
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004273b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10052004]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, edx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], eax
mov dword [eax], edi
mov ecx, 0x800
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [eax], edi
jmp 0x10042778
mov ebx, dword [esp + 0x14]
mov esi, dword [fcn.10004ca0]
push ecx
push edi
push dword [0x10052460]
mov ecx, esi
call dword [0x100532e8]
call esi
mov esi, eax
test esi, esi
je 0x1004283c
mov eax, dword [esp + 0x10]
push 0x16
add eax, 0xfffffffe
push eax
push esi
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test ebx, ebx
jns 0x100427dd
push esi
mov esi, dword [0x10052018]
mov ecx, esi
push edi
push dword [0x10052460]
call dword [0x100532e8]
call esi
mov ecx, dword [esp + 0x10]
mov esi, edi
add ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x100427e1
mov ecx, dword [esp + 0x10]
cmp ebx, 0x80000005
je 0x10042774
cmp ebx, 0xc0000023
je 0x10042774
test ebx, ebx
js 0x10042831
cmp dword [esp + 0x20], edi
jne 0x10042820
push esi
mov esi, dword [0x10052018]
mov ecx, esi
push edi
push dword [0x10052460]
call dword [0x100532e8]
call esi
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x10042841
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x10042841
mov ecx, ebx
call fcn.100213df
mov edi, eax
jmp 0x10042841
mov edi, 0x80030008
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100281a0
mov esp, ebp
pop ebp
ret 8
Function at 0x401f30
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x38
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sym._ConStreamGetOSHandle
mov dword [esp], eax
mov ebx, eax
call sym._IsConsoleHandle
test eax, eax
je 0x401fb0
lea eax, [ebp - 0x1e]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._GetConsoleScreenBufferInfo_8
xor eax, eax
sub esp, 8
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1a]
mov dword [esp + 4], 0x20
mov dword [esp + 0xc], eax
movsx eax, word [ebp - 0x1e]
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._FillConsoleOutputCharacterW_20
mov eax, dword [ebp - 0x1a]
sub esp, 0x14
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._SetConsoleCursorPosition_8
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], ebx
call sym._IsTTYHandle
test eax, eax
je 0x401fa4
mov dword [esp], esi
mov dword [esp + 4], str.e_2Ke_1G
call sym._ConPuts
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4021f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
movzx eax, word [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov eax, esi
shr ax, 4
mov dword [esp], edi
add eax, 1
movzx eax, ax
mov dword [esp + 8], eax
call sym._FindResourceExW_16
sub esp, 0x10
test eax, eax
je 0x402298
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._LoadResource_8
sub esp, 8
test eax, eax
je 0x402298
mov dword [esp], eax
call sym._LockResource_4
sub esp, 4
and esi, 0xf
je 0x40226e
xor edx, edx
lea esi, [esi]
lea esi, [esi]
movzx ecx, word [eax]
add edx, 1
lea eax, [eax + ecx*2 + 2]
cmp esi, edx
jne 0x402260
test ebx, ebx
je 0x4022d1
movzx esi, word [eax]
cmp ebx, esi
jle 0x4022a4
test esi, esi
jne 0x4022ab
cmp ebx, 1
jg 0x402290
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
xor edx, edx
mov word [eax], dx
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
lea esi, [ebx - 1]
test esi, esi
je 0x40227d
lea edx, [esi + esi]
mov dword [esp + 8], edx
lea edx, [eax + 2]
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memmove
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov word [eax + esi*2], cx
mov eax, esi
jmp 0x402284
mov ebx, dword [ebp + 0x14]
lea edx, [eax + 2]
mov dword [ebx], edx
movzx eax, word [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14

Function at 0x403a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x405a12
pop dword [ebp - 0x20]
mov eax, 0xe5b51e03
sub eax, 0xe574c3f1
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xab578df0
sub dword [ebp - 0x30], 0x5d0548a5
mov dword [ebp - 0x2c], 0x1a45a783
sub dword [ebp - 0x2c], 0xe8125b3e
mov dword [ebp - 0x28], 0x4103d93b
sub dword [ebp - 0x28], 0xf4b7950d
mov dword [ebp - 0x24], 0x2282fb07
sub dword [ebp - 0x24], 0x2282fb07
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe4c9e98f
sub eax, 0xe489688b
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa850caeb
sub dword [ebp - 0x30], 0x33de6195
mov dword [ebp - 0x2c], 0xb94122c6
add dword [ebp - 0x2c], 0x882b3eaf
mov dword [ebp - 0x28], 0x7c9320b7
add dword [ebp - 0x28], 0xe6dc4bb5
mov dword [ebp - 0x24], 0x2676ea47
add dword [ebp - 0x24], 0xd98915b9
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x25f29281
sub eax, 0x25b21181
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x383e0
push 0
call eax
mov ecx, 0x63518b81
add ecx, 0x9caec18b
xor esi, esi
add esi, eax
mov edi, 0x93e8d420
add edi, 0x6c5e0fe0
add edi, dword [ebp - 0x20]
mov edx, 0xe3f05831
sub edx, 0xa7ed5e3
add dword [ebp - 8], esi
mov ebx, dword [edi]
xor dword [ebp - 0x14], ecx
xor ebx, edx
add dword [ebp - 0x18], eax
mov dword [esi], ebx
add esi, 0xa0fb2024
add esi, 0x5f04dfe0
add edi, 0x272e1cb5
add edi, 0xd8d1e34f
loop 0x405b36
add eax, 0x8f06425
add eax, 0xf710c2de
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8fd530e8
add ecx, 0x706acf18
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x6d2fec90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6d30e108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x6d2fecd2
dec eax
jne 0x6d2fece2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x6d30e7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x6d30e3d8], eax
jmp 0x6d2fece2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x6d30e7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.6d307d33
add esp, 0x194
ret 0xc

Function at 0x6d2ff260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x6d2ff26f
pop dword [ebp - 0x20]
mov eax, 0x6d2ff26f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xf5780f3c
sub dword [ebp - 0x30], 0xa725c9f1
mov dword [ebp - 0x2c], 0xd14d1b73
sub dword [ebp - 0x2c], 0x9f19cf2e
mov dword [ebp - 0x28], 0xcd966393
sub dword [ebp - 0x28], 0x814a1f65
mov dword [ebp - 0x24], 0x4551bcaf
sub dword [ebp - 0x24], 0x4551bcaf
lea eax, [ebp - 0x30]
push eax
mov eax, 0xd2bdf9c
sub eax, 0x9ffb4f50
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xb081b709
sub dword [ebp - 0x30], 0x3c0f4db3
mov dword [ebp - 0x2c], 0xf1e38cad
sub dword [ebp - 0x2c], 0xb0772b38
mov dword [ebp - 0x28], 0xc243bac2
add dword [ebp - 0x28], 0xa12bb1aa
mov dword [ebp - 0x24], 0x46cb9ff7
add dword [ebp - 0x24], 0xb9346009
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x2fda4aae
add eax, 0x3d5645aa
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x368f1
push 0
call eax
mov ecx, 0x4850
xor edi, edi
add edi, eax
mov esi, 0x6d311a00
add esi, dword [ebp - 0x20]
mov ebx, 0xa4cd891c
xor dword [ebp - 0x10], 0x91cc1443
mov edx, dword [esi]
sub dword [ebp - 0x18], esi
xor edx, ebx
sub dword [ebp - 0xc], ebx
mov dword [edi], edx
xor dword [ebp - 0x18], 0x147764df
add edi, 0x40e28da
add edi, 0xfbf1d72a
add esi, 0x76ceba66
add esi, 0x8931459e
loop 0x6d2ff37c
add eax, 0xcd90ff4e
add eax, 0x327014c5
xor ebx, ebx
add ebx, eax
add eax, 0xfe5e986d
sub eax, 0xfe5e9868
mov ecx, 0x3ee630df
add ecx, 0x2e48cf21
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x6d307400
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x6d30e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x6d307450
push 0x502
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.6d2f5ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d2f5ca0
ret

Function at 0x6d307460
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6d30e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x6d3074a3
push 0x50f
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.6d2f5ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d2f5ca0
ret

Function at 0x6d307d33
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d30e108]
jne 0x6d307d3d
repz ret
jmp fcn.6d3081c2

Function at 0x401206
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.Mig1
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030c0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401325
push 1
push dword [0x4030c0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Gendalf
push str.Mig1
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030c8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4030c8]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401325
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401308
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000655b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x6c]
mov ecx, esi
call fcn.100045cb
test eax, eax
jne 0x1000657b
mov eax, 0x80070005
jmp 0x100065ec
push esi
mov ecx, esi
call fcn.100045cb
test eax, eax
js 0x100065ea
cmp dword [edi + 0x44], 0
je 0x100065ea
and dword [ebp + 8], 0
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call esi
lea eax, [ebp - 8]
push eax
call esi
push 0x14
pop ecx
call fcn.100099b8
test eax, eax
je 0x100065c7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and dword [eax + 8], 0
mov dword [eax], vtable.CNameShowContactCardJob.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x100065c9
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.100045cb
mov esi, dword [ebp + 8]
test esi, esi
je 0x100065ea
mov ecx, dword [edi + 0x44]
push esi
call fcn.100045cb
test eax, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x1000a002
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x1000bfd5
call fcn.1000be6e
mov ebx, ecx
lea eax, [ebp - 0x14]
xor ecx, ecx
push eax
push 0x20019
push ecx
push 0x1000e1a8
mov dword [ebp - 4], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push SysReAllocString
mov dword [ebp - 0x14], ecx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000a0aa
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
and dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x14]
call edi
push 4
pop ebx
test eax, eax
jne 0x1000a09c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000a09c
cmp dword [ebp - 0x18], ebx
jne 0x1000a09c
mov edi, dword [ebp - 0x1c]
cmp edi, 3
ja 0x1000a09c
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], eax
je 0x1000a0ac
push dword [ebp - 0x10]
call esi
jmp 0x1000a0ac
mov byte [ebp - 4], bl
cmp dword [ebp - 0x10], 0
je 0x1000a0aa
push dword [ebp - 0x10]
call esi
xor edi, edi
mov dword [ebp - 4], 5
cmp dword [ebp - 0x14], 0
je 0x1000a0be
push dword [ebp - 0x14]
call esi
mov eax, edi
call fcn.1000be4c
ret
Function at 0x1000a3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x1000c041
call fcn.1000be6e
cmp byte [0x10011fb4], 0
je 0x1000a3cf
mov eax, dword [0x10011fb8]
jmp 0x1000a4a5
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
mov dword [ebp - 4], esi
push SysReAllocString
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000a41f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x10011fb8
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000a41f
cmp dword [ebp - 0x14], 4
je 0x1000a478
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x1000a430
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000a480
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x10011fb8
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000a480
cmp dword [ebp - 0x14], 4
jne 0x1000a480
mov esi, dword [0x10011fb8]
jmp 0x1000a486
mov dword [0x10011fb8], esi
mov byte [0x10011fb4], 1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x10], 0
je 0x1000a4a3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.1000be4c
ret

Function at 0x4283e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42849c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428497
mov ecx, dword [ebp - 8]
push ecx
call fcn.00428990
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428456
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428456
xor eax, eax
jmp 0x42849c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283ef
mov esp, ebp
pop ebp
ret
Function at 0x403012
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030aa
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40308a
xor eax, eax
push ebp
push 0x403083
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030c6
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40308a
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey_1
ret
mov ax, word [0x409010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409010], ax
mov esp, ebp
pop ebp
ret

Function at 0x40377a
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x4037db
cmp word [0x40a208], 0xd7b2
jne 0x4037a3
cmp dword [0x40a210], 0
jbe 0x4037a3
mov eax, 0x40a204
call dword [fcn.0040a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409058
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403802
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x40901c], 0
jne 0x4037f7
push 0
push 0x409050
push 0x409058
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret

Function at 0x4040ae
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404114
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403a56
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f06
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4040fe
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40411b
lea eax, [ebp - 0x10]
call fcn.004038f6
ret