joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x10028458
xor eax, eax
jmp 0x100285b5
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.10026eef
mov eax, dword [esi]
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x10028475
push eax
call fcn.10032433
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
push ebx
or ebx, 0xffffffff
cmp dword [ebp - 8], edi
jne 0x10028492
cmp dword [0x10084718], edi
je 0x100284a1
mov dword [ebp - 0x18], 2
jmp 0x100284ae
cmp dword [ebp - 8], 1
jne 0x100284a1
call fcn.10026eef
test eax, eax
je 0x100284ab
test byte [esi + 0xc], 0x10
je 0x10028561
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], edi
call fcn.100270ef
jmp 0x10028518
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x100284c7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov ebx, eax
jae 0x100284f2
cmp dword [ebp - 0x10], 1
je 0x100284ef
cmp dword [ebp - 0x10], 2
jne 0x100284f2
push 2
pop ebx
push ebx
call fcn.10026f88
pop ecx
test eax, eax
je 0x10028548
push 0x796d746f
push edi
call fcn.10026e81
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027329
mov dword [ebp + 8], edi
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], edi
call fcn.10027387
mov ebx, eax
add esp, 0x14
cmp ebx, edi
je 0x100284bb
jmp 0x10028559
push dword [ebp + 8]
mov ecx, 0x10086088
call fcn.10027254
cmp ebx, edi
je 0x10028570
lea ecx, [ebp - 0x1c]
call fcn.10027113
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10028479
jmp 0x10028578
lea ecx, [ebp - 0x1c]
call fcn.10027113
cmp ebx, edi
jne 0x10028597
cmp dword [ebp - 0x10], 2
je 0x1002858b
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x10028597
push dword [ebp - 4]
call fcn.10025b19
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], edi
je 0x100285a4
push dword [ebp - 0x14]
call fcn.10025075
cmp ebx, edi
pop ebx
je 0x100285b2
push esi
call fcn.10025efb
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x100285bb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10028440
Function at 0x1002a49a
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x100501b0
call fcn.1004e634
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x1002a4d8
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x1002a4d8
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x1002a4d8
mov eax, dword [ecx + 0x50]
jmp 0x1002a4f9
mov ecx, 0x4550
cmp dx, cx
jne 0x1002a505
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x1002a505
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x1002a505
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x1002a509
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.1004e679
ret

Function at 0x1002acd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1002ad16
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.10036d34
mov edi, eax
cmp edi, 0xffffffff
je 0x1002ad15
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret
Function at 0x1002be72
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x1002be82
xor eax, eax
leave
ret
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
inc edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.1002be0b
add esp, 0x10
test eax, eax
je 0x1002bfcf
cmp dword [ebp - 4], esi
je 0x1002bfcf
push ebx
mov ebx, 0x100896f8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.1002cdc9
pop ecx
test eax, eax
jne 0x1002bedd
xor edi, edi
jmp 0x1002bfc7
cmp dword [0x10089e2c], esi
je 0x1002bef0
push esi
push 0x72766c72
call fcn.10026def
lea eax, [ebp - 0x14]
push eax
mov dword [0x10089e2c], 1
mov dword [ebp - 0x14], esi
call fcn.1002ac3c
pop ecx
cmp eax, dword [ebp - 8]
jne 0x1002bf14
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x1002bf4d
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.1002be57
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002be0b
add esp, 0x18
test eax, eax
je 0x1002bf40
cmp dword [ebp - 4], esi
jne 0x1002bf4d
push esi
push 0x72766c73
call fcn.10026def
xor edi, edi
cmp dword [ebp + 0x14], esi
jne 0x1002bf5f
cmp dword [ebp - 8], 0xea60
ja 0x1002bed6
cmp edi, esi
je 0x1002bf79
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1002bbc5
add esp, 0x10
mov edi, eax
mov dword [0x10089e2c], esi
push esi
cmp edi, esi
je 0x1002bfbd
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002bfa8
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x1002bfa8
xor edi, edi
inc edi
jmp 0x1002bfaa
xor edi, edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.1002acd0
add esp, 0xc
jmp 0x1002bfc7
push 0x74697970
call fcn.10026def
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x1002bfea
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.1002be57
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1002c2a3
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x1002c2c5
push edi
push 0x36717370
call fcn.10026def
jmp 0x1002c402
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x1002c2d8
push edi
push 0x36717371
jmp 0x1002c3d7
cmp dword [ebp + 8], 2
je 0x1002c2f5
cmp dword [ebp + 8], 8
je 0x1002c2f5
cmp dword [ebp + 8], 3
je 0x1002c2f5
push edi
push 0x36717372
jmp 0x1002c3d7
cmp dword [ebx], edi
je 0x1002c304
push edi
push 0x36717373
call fcn.10026def
cmp dword [esi], edi
je 0x1002c313
push edi
push 0x37667270
call fcn.10026def
push esi
push edi
push dword [ebp + 8]
mov dword [esi], edi
call sub.Secur32.dll_GetUserNameExW
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x1002c3de
cmp eax, 0xea
jne 0x1002c3de
mov eax, dword [esi]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.10024f10
mov dword [ebx], eax
test eax, eax
jne 0x1002c362
push eax
push 0x36717375
jmp 0x1002c3e5
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1002c382
push 0
push 0x36717376
jmp 0x1002c3e5
mov eax, dword [esi]
dec eax
cmp dword [ebp - 4], eax
je 0x1002c396
push 0
push 0x36717377
call fcn.10026def
cmp edi, 2
jne 0x1002c3b2
push dword [esi]
push dword [ebx]
call fcn.1002c22f
pop ecx
pop ecx
test eax, eax
jne 0x1002c401
push eax
push 0x36717378
jmp 0x1002c3e5
cmp edi, 8
jne 0x1002c3cb
push dword [ebx]
call fcn.1002afd8
pop ecx
test eax, eax
jne 0x1002c401
push eax
push 0x36717379
jmp 0x1002c3e5
cmp edi, 3
je 0x1002c401
push 0
push 0x3671737a
call fcn.10026def
jmp 0x1002c401
push 0
push 0x36717374
call fcn.10026def
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
je 0x1002c3fb
push eax
call fcn.1001fd9f
pop ecx
mov dword [ebx], edi
cmp dword [esi], edi
je 0x1002c401
mov dword [esi], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x1002c931
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1001e278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x240], eax
mov ebx, 0x104
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.1002bb06
pop ecx
pop ecx
test eax, eax
jne 0x1002c96e
or eax, 0xffffffff
jmp 0x1002cb49
cmp word [ebp - 0x22c], 0
push esi
lea esi, [ebp - 0x22c]
push edi
mov dword [ebp - 0x238], esi
je 0x1002c994
inc esi
inc esi
cmp word [esi], 0
jne 0x1002c986
mov dword [ebp - 0x238], esi
xor edi, edi
inc edi
push edi
call fcn.1002a74e
mov dword [esp], 0x10003510
call fcn.10025f8b
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x248], eax
cmp eax, 0x64
jbe 0x1002c9c0
mov dword [ebp - 0x230], edi
mov eax, esi
lea ecx, [ebp - 0x22c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x234], eax
mov esi, 0x80
mov edi, 0xc0000000
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push 0x100031c0
push 0xffffffffffffffff
push eax
call fcn.1002af91
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x1002caf4
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.1002c4ea
add esp, 0xc
mov ecx, eax
call fcn.10020a0a
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.100309e8
xor eax, eax
push eax
push eax
push esi
push 1
push eax
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.10036d34
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
jne 0x1002caf9
cmp dword [ebp - 0x230], 0x64
jb 0x1002ca65
and dword [ebp - 0x230], 0
inc dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x248]
jne 0x1002c9dc
push eax
push 0x100031c0
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.1002af91
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x1002caf4
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.1002c4ea
add esp, 0xc
mov ecx, eax
call fcn.10020a0a
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.100309e8
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
push ebx
push ebx
push esi
push 2
push ebx
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.10036d34
mov dword [ebp - 0x23c], eax
jmp 0x1002cafb
call fcn.1001fd80
xor ebx, ebx
cmp dword [ebp - 0x230], 0x64
pop edi
pop esi
jb 0x1002cb0c
mov dword [ebp - 0x230], ebx
mov eax, dword [ebp - 0x230]
inc eax
push eax
push 0x10003510
call fcn.10025b34
call fcn.1002a7a6
cmp dword [ebp - 0x240], ebx
je 0x1002cb43
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push dword [ebp - 0x240]
push eax
call fcn.100257bd
add esp, 0xc
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1004da5d
leave
ret
Function at 0x1002cb56
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1001e278]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push eax
inc edi
call fcn.1002bb06
pop ecx
pop ecx
test eax, eax
je 0x1002cc1b
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100031d0
call fcn.10031e6c
call fcn.1002aba7
test eax, eax
je 0x1002cc19
call fcn.1002aab2
test eax, eax
jne 0x1002cc19
call fcn.1002c1b6
test eax, eax
jne 0x1002cbd0
call fcn.1002bac3
test eax, eax
je 0x1002cc19
push dword [0x10089be0]
call fcn.1002d75f
pop ecx
test eax, eax
jne 0x1002cc19
call fcn.1002ba82
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.1002c931
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
call fcn.1002be72
mov edi, eax
add esp, 0x18
lea eax, [ebp - 0x414]
test edi, edi
jne 0x1002cc0a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002cc19
push esi
push 0x10089c0c
push eax
call fcn.100257bd
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004da5d
leave
ret

Function at 0x1002dc3f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [0x10089710]
mov edi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.1002d89f
add esp, 0x10
call fcn.1002dc25
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.1002d89f
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.1002d89f
call fcn.100263b6
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.1002d89f
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002d845
add esp, 0x30
pop edi
pop esi
pop ebp
ret
Function at 0x1002fcf8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.100256f7
test eax, eax
jne 0x1002fd15
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push edi
push eax
push 0x11
call fcn.1002a94c
push dword [ebp - 0x1c]
push 0x12
call fcn.1002a94c
push 0x1000dc44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp eax, edi
je 0x1002fe16
push esi
push 0x1000dc24
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x1002fe15
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002fe15
push dword [ebp - 4]
call fcn.10024f10
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x1002fe0d
lea ecx, [ebp - 4]
push ecx
push eax
call esi
test eax, eax
je 0x1002fe0d
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor esi, esi
mov dword [ebp - 8], edi
cmp eax, edi
jbe 0x1002fe0d
mov edx, dword [ebp - 0xc]
push ebx
mov ebx, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x1002fdc4
dec eax
dec eax
jne 0x1002fdd5
push dword [edx]
call fcn.1002f731
pop ecx
cmp edi, eax
ja 0x1002fdd5
mov edi, eax
jmp 0x1002fdd5
push dword [edx]
inc dword [ebp - 8]
call fcn.1002f731
pop ecx
cmp esi, eax
ja 0x1002fdd5
mov esi, eax
add edx, 0x18
dec ebx
jne 0x1002fda8
pop ebx
test esi, esi
je 0x1002fdeb
push esi
push 0x19e1
call fcn.1002a94c
test edi, edi
je 0x1002fdfa
push edi
push 0x19e2
call fcn.1002a94c
cmp dword [ebp - 8], 0
je 0x1002fe0d
push dword [ebp - 8]
push 0x19e0
call fcn.1002a94c
push dword [ebp - 0xc]
call fcn.10024f44
pop esi
pop edi
leave
ret

Function at 0x1002fe7c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x1002fe9e
xor esi, esi
jmp 0x1002ff23
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x1002fe97
push esi
call fcn.10024f10
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x1002fec5
push ebx
push 0x33753468
jmp 0x1002ff0e
push eax
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1002fedc
push ebx
push 0x33753469
jmp 0x1002ff0e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x100031a4
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1002ff08
cmp dword [ebp - 4], 0x34
jne 0x1002ff08
mov esi, dword [ebp - 8]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
jmp 0x1002ff15
push ebx
push 0x3375346a
call fcn.10026def
xor esi, esi
cmp dword [ebp + 0xc], ebx
je 0x1002ff23
push dword [ebp + 0xc]
call fcn.1001fd9f
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1003012a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x1001e278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x1000dcac
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x118
lea eax, [ebp - 0x138]
push ebx
push eax
mov dword [ebp - 0x140], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x13c], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
push 1
push ebx
push 0x1000dc80
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100301e3
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
push 0x1000dc70
push dword [ebp - 0x144]
mov dword [ebp - 0x14c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100301d5
push dword [ebp - 0x148]
push 0x22df
call fcn.1002a94c
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100301ee
push ebx
push 0x66397234
call fcn.10026def
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10030278
push dword [ebp - 0x130]
push 0x1a
call fcn.1002a94c
movzx eax, word [ebp - 0x28]
movzx ecx, word [ebp - 0x26]
shl eax, 0x10
or eax, ecx
push eax
push 0x43
call fcn.1002a94c
movzx eax, word [ebp - 0x24]
push eax
push 0x3a5
call fcn.1002a94c
push dword [ebp - 0x138]
push 0x22e1
call fcn.1002a94c
push dword [ebp - 0x134]
push 0x22e2
call fcn.1002a94c
movzx eax, word [ebp - 0x28]
push eax
push 0x22e4
call fcn.1002a94c
movzx eax, word [ebp - 0x26]
push eax
push 0x22e5
call fcn.1002a94c
call fcn.10036ace
test eax, eax
je 0x1003030b
lea eax, [ebp - 0x20]
push eax
call fcn.10020a40
mov esi, eax
cmp esi, ebx
jne 0x1003029c
push ebx
push 0x38317137
jmp 0x100302e9
push 0x1000dc60
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x100302b4
push ebx
push 0x38317138
jmp 0x100302e9
lea ecx, [ebp - 0x140]
push ecx
movzx ecx, word [ebp - 0x26]
push ecx
movzx ecx, word [ebp - 0x28]
push ecx
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call eax
test eax, eax
jne 0x100302f0
push 0xffffffffffffffff
push 0x1af7
call fcn.1002a94c
push ebx
push 0x38317139
call fcn.10026def
jmp 0x10030300
push dword [ebp - 0x140]
push 0x1af7
call fcn.1002a94c
cmp esi, ebx
je 0x1003030b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004da5d
leave
ret
Function at 0x10030573
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x100305e3
push esi
lea eax, [ebp - 4]
push eax
call fcn.1002524b
test eax, eax
je 0x100305e3
push dword [ebp - 4]
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100305db
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x100031a4
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100305db
cmp dword [ebp - 8], ebx
je 0x100305db
mov esi, dword [ebp - 0xc]
push edi
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov bl, 1
pop edi
push dword [ebp - 4]
call fcn.10025075
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x10035071
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x100350ac
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10035093
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x100350a4
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x100350ae
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10035089
xor eax, eax
pop edi
pop esi
ret
Function at 0x1003574c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10035708
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10035726
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10035784
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
add byte [eax - 0x77], al
jge 0x10035763
add byte [eax], al
add byte [eax - 0x77], al
jge 0x10035763
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1003576b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10035774
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1003577e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10035760
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100356ea
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100357d1
dec eax
je 0x100357c8
sub eax, 3
je 0x100357bf
mov dword [ebp - 4], 0x40
jmp 0x100357ee
mov dword [ebp - 4], 4
jmp 0x100357d4
mov dword [ebp - 4], 0x20
jmp 0x100357d4
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10035820
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100357a0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10035031
wait
call 0x86032d4b
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1003582c
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100358eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
call dword [ebx]
Function at 0x10038204
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100844b8], 0xffffffff
jne 0x10038280
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [0x100844b0]
mov dword [0x100844b8], 1
push Ordinal_4
call fcn.10036f67
test eax, eax
jne 0x10038280
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x100844b4]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10038277
cmp dword [ebp - 0xc], 4
jne 0x10038277
cmp dword [ebp - 0x10], eax
je 0x10038277
mov dword [0x100844b8], 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100844b8]
leave
ret
Function at 0x1003ff28
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x100501f0
call fcn.1004e634
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x1003ff66
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x1003ff66
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x1003ff66
mov eax, dword [ecx + 0x50]
jmp 0x1003ff87
mov ecx, 0x4550
cmp dx, cx
jne 0x1003ff93
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x1003ff93
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x1003ff93
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x1003ff97
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.1004e679
ret 4