joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100862e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.0100858e
cmp dword [ebp - 4], 0
jne 0x100868e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
lea eax, [eax + eax + 0xa]
cmp eax, dword [ebp + 0xc]
jae 0x100868d
push esi
call edi
push esi
lea edi, [esi + eax*2]
call fcn.01008489
test eax, eax
je 0x1008681
and word [edi], 0
push 0x1001954
jmp 0x1008686
push 0x1001948
push esi
jmp 0x103da23
pop edi
pop esi
leave
ret 8

Function at 0x10086ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp word [ebx], di
je 0x100870e
mov eax, dword [ebp + 0x10]
cmp word [eax], di
jne 0x10087fe
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
call fcn.01008531
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0100858e
cmp dword [ebp + 0xc], edi
je 0x10087fe
push str..pif
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10087fe
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x10087fe
push esi
push edi
lea ecx, [ebp - 4]
push ecx
mov esi, 0x2dc
push esi
lea ecx, [ebp - 0x4ec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], esi
pop esi
jne 0x10087f5
push 2
push edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x400
jae 0x10087f5
cmp word [ebx], di
jne 0x10087de
push 0x1e
lea eax, [ebp - 0x4e8]
push eax
push ebx
call fcn.01008693
push 0x104
push ebx
jmp 0x103bf17
mov eax, dword [ebp + 0x10]
cmp word [eax], di
jne 0x10087f5
push 0x40
jmp 0x103e35d
push dword [ebp + 0xc]
jmp 0x103ea2f
pop edi
pop ebx
leave
ret 0xc

Function at 0x1008804
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
and word [edi], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xe]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0100858e
cmp dword [ebp + 8], 0
jne 0x1008874
push esi
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1008873
cmp word [ebx], 0x22
jne 0x1008841
inc ebx
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [ebp + 0xe], 3
ja 0x1008862
cmp word [edi + 2], 0x3a
jne 0x1008862
sub esi, ebx
sar esi, 1
and word [edi + esi*2], 0
jmp 0x1008873
sub esi, ebx
sar esi, 1
cmp word [ebp + 0xe], 1
je 0x100885b
jmp 0x1040929
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x100887a
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.0100858e
cmp dword [ebp - 4], 0
jne 0x10088bc
cmp esi, dword [ebp + 8]
je 0x10088bc
cmp word [esi], 0x22
jne fcn.010088b7
mov eax, dword [ebp + 0xc]
add dword [ebp + 0xc], 2
jmp loc.0104006b
push esi

Function at 0x10088cb
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0x88
push dword [0x1015774]
call esi
push 0x20
lea eax, [ebp - 0x74]
push eax
push 0x89
jmp loc.0103bb5b

Function at 0x1008a3e
Capabilities:
Packed with generic packer
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
push ebx
push esi
push edi
xor esi, esi
push 0x1016040
mov word [ebp - 0x300], si
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0xc8
lea eax, [ebp - 0x490]
push eax
movzx eax, word [ebp + 0x18]
push eax
push dword [0x1015774]
call edi
lea eax, [ebp - 0x490]
push eax
jmp loc.0103ba70

Function at 0x1008b90
Capabilities:
Packed with generic packer
Set current directory

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x1016040
call esi
push dword [0x1014a6c]
push 1
push str.PROGMAN.HLP
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_WinHelpW]
test eax, eax
jne fcn.01008bcf
push 0x1030
push eax
push 0x8b
push 1
push dword [esp + 0x18]
jmp loc.0104075b
Function at 0x100914e
Capabilities:
Packed with generic packer
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
push 4
pop edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push 0x2001f
push esi
push esi
push esi
push 0x10019a8
push 0x80000001
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10092cd
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0x1001990
push dword [ebp - 8]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xc], esi
jne 0x10091b8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10092cd
movzx eax, word [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push esi
push esi
push 0x146
push eax
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
mov dword [ebp - 4], eax
jae 0x10091dc
mov dword [ebp - 4], ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push esi
lea eax, [ebp - 0x48]
push 0x1001980
push eax
call ebx
add esp, 0xc
push dword [ebp + 0xc]
xor esi, esi
inc esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push esi
xor esi, esi
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
movzx eax, word [ebp + 0x10]
push 0xffffffffffffffff
push 0x14c
push eax
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
jne 0x1009248
cmp eax, 0xffffffff
jne 0x1009248
dec dword [ebp - 4]
cmp dword [ebp - 4], esi
mov dword [ebp + 0xc], esi
jbe 0x10092c3
mov esi, 0x1014ac8
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x1009262
cmp dword [ebp + 0xc], eax
je 0x10092b8
movzx eax, word [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push 0x148
push eax
push dword [ebp + 8]
call edi
cmp word [0x1014ac8], 0
je 0x10092c3
push dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push 0x1001980
push eax
call ebx
add esp, 0xc
push esi
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc dword [ebp - 0x14]
jmp 0x103d504
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x10093c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
push 2
pop edi
lea eax, [ebp - 0x210]
push eax
push 0x103
mov dword [ebp - 4], edi
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x1016040
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov esi, 0x131
je 0x100943e
cmp word [ebx], 0
je 0x100943e
push ebx
call dword [sym.imp.SHELL32.dll_SheRemoveQuotesW]
push ebx
call fcn.010084e7
test eax, eax
je 0x1009424
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x100943e
push esi
push 0
push 0x8e
jmp 0x1040c8a
mov edi, dword [ebp + 0xc]
push edi
call fcn.010084e7
test eax, eax
jne 0x1009460
push esi
push edi
push 0x35
push 0x34
push dword [ebp + 8]
call fcn.01002402
cmp eax, 2
je 0x1009495
jmp 0x10094b0
push dword [ebp + 0x14]
push ebx
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp dword [ebp - 8], 0
je 0x10094b0
jmp 0x1040312
jmp 0x1040ac6
jmp 0x103b6fe

Function at 0x1009559
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [0x1014a6c]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x208]
push eax
push 0x64
push edi
mov dword [0x1014a6c], 0x1b5b
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp loc.0103f146

Function at 0x1009d01
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x10149f0]
sub esp, 0x210
test eax, eax
je 0x1009d1e
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
and dword [0x10149f0], 0
push ebx
push ebp
push esi
push edi
push 0x1016720
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea eax, [esp + 0x18]
push eax
call fcn.01008531
push 0x208
lea eax, [esp + 0x1c]
push eax
call fcn.0100862e
jmp loc.0103b0c6

Function at 0x100bd29
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp dword [0x1014a74], edi
jmp loc.0103fd60

Function at 0x100bf2f
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp ax, 0xffff
je 0x100bf98
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ecx]
test ebx, ebx
mov dword [ebp + 0x10], ebx
je 0x100bf97
and dword [ecx], 0
push esi
push edi
jmp loc.0103d323
pop ebx
pop ebp
ret 0xc

Function at 0x100bf9c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or eax, 0xffffffff
cmp dword [ebp + 0x10], eax
je 0x100c073
cmp dword [ebp + 0x10], 0
jne fcn.0100bfc3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp loc.0103f0ae
Function at 0x100c15c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
push ebx
call fcn.0100c077
test eax, eax
jne 0x100c186
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x100c1c1
push esi
movzx esi, word [eax + 8]
push edi
push ebx
mov edi, eax
add esi, eax
jmp loc.0103cf3f
pop ebx
pop ebp
ret 0xc

Function at 0x100c50c
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push esi
push edi
xor edi, edi
push edi
jmp loc.0103ec88

Function at 0x100c8c2
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.0100c50c
mov ecx, eax
test ecx, ecx
je fcn.0100c8e1
mov eax, dword [esp + 8]
mov eax, dword [eax + 4]
jmp loc.0103f3e0

Function at 0x100ca49
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
push edi
je 0x100ca5a
mov edi, dword [eax + 4]
jmp 0x100ca5f
jmp 0x103f55d
mov esi, dword [ebp + 8]
push dword [esi + 4]
call fcn.0100c50c
test eax, eax
jne 0x100ca73
xor ax, ax
jmp 0x100ca92
movzx ecx, word [ebp + 0x18]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push eax
call fcn.0100c0f5
push dword [esi + 4]
mov edi, eax
call fcn.0100bcff
mov ax, di
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x100ce8c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0100c3b3
xor ebx, ebx
cmp eax, ebx
jmp loc.0103c049
Function at 0x100d365
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x4f0
push esi
push edi
mov esi, 0x1001a80
lea edi, [ebp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001ac8
lea edi, [ebp + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7f02
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
mov dword [ebp + 0x68], eax
call dword [sym.imp.USER32.dll_ShowCursor]
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [0x1014a10]
call esi
cmp eax, edi
je 0x100d63e
push ebx
push 1
push eax
call esi
mov dword [ebp + 0x74], eax
mov eax, dword [0x10149d4]
cmp eax, edi
mov word [ebp - 0x478], di
mov dword [ebp + 0x70], edi
je 0x100d42e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0x64
pop ebx
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x6c]
push ecx
lea ecx, [ebp - 0x120]
push ecx
push edi
push eax
jmp 0x100d425
jmp 0x103e520
mov dword [ebp + 0x6c], ebx
call esi
test eax, eax
je 0x100d3fc
cmp dword [ebp + 0x74], edi
je 0x100d608
jmp 0x103f622
cmp dword [0x10149c8], edi
pop ebx
je 0x100d63e
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x478]
push eax
push 1
push edi
push str.UNICODE_Order
push dword [0x10149c8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
call dword [sym.imp.USER32.dll_ShowCursor]
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x100d6e6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
xor ebx, ebx
cmp dword [0x10149a8], ebx
je 0x100d703
cmp dword [0x1014a74], ebx
je 0x100d7b2
push esi
push edi
push 0x7f02
push ebx
mov dword [0x10149b4], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_ShowCursor]
push 1
mov dword [ebp - 4], eax
call edi
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [0x1014a0c]
call dword [sym.imp.USER32.dll_GetInternalWindowPos]
cmp eax, 7
jne 0x100d746
xor eax, eax
inc eax
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x64]
jmp 0x1040245
pop ebx
leave
ret
Function at 0x100d92d
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe5c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0x22
xor esi, esi
pop edi
cmp word [ebx], di
mov dword [ebp - 0x1c], 0x4a
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
jne 0x100d971
lea eax, [ebx + 2]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x14], edi
jne 0x100d978
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x434]
mov dword [ebp - 0x10], eax
xor eax, eax
mov ax, word [ebx]
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
lea edi, [ebp - 0x434]
jmp 0x100d9bd
cmp ax, word [ebp - 0x14]
je 0x100d9c2
mov ecx, dword [ebp - 0xc]
mov word [edi], ax
mov ax, word [ecx]
inc edi
inc edi
cmp ax, 0x3a
je 0x100d9b1
cmp ax, 0x5c
jne 0x100d9b4
mov dword [ebp - 0x10], edi
push ecx
call ebx
mov dword [ebp - 0xc], eax
mov ax, word [eax]
cmp ax, si
jne 0x100d994
jmp 0x103b6d5
Function at 0x100e39e
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
mov eax, dword [0x10149e0]
mov dword [0x101494c], ebx
mov edi, dword [esi + 0x1c]
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x100e3cf
mov eax, dword [0x10149d8]
cmp dword [esi + 0x18], ebx
jne 0x100e4b5
push dword [esi + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x100e4b5
push edi
call fcn.01010c82
push ebx
push dword [ebp + 8]
mov dword [0x101494c], 1
push 0x221
push dword [0x1014a10]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
jmp 0x103f969
push ebx
push dword [esi + 0x10]
push 0xa5
push 0x4d
push dword [0x1014a0c]
call fcn.01002402
push edi
call fcn.01010c82
jmp 0x103bd7f

Function at 0x100e685
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call sub.USER32.dll_PackDDElParam
mov esi, eax
test esi, esi
je 0x100e6bf
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x100e6b6
xor eax, eax
inc eax
jmp 0x100e6c1
push esi
push dword [ebp + 0xc]
jmp 0x103dd35
xor eax, eax
pop esi
pop ebp
ret 0x14

Function at 0x100e6da
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x1014d48], 0
je 0x100e71a
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
je 0x100e71a
jmp loc.0104028e
ret 0xc

Function at 0x100e7ce
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0100e7b5
jmp loc.0103db6c

Function at 0x100e84f
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx eax, ax
lea esi, [edi + eax*2 - 2]
mov bx, word [esi]
jmp 0x100e877
mov esi, eax
lea eax, [esi - 2]
cmp word [eax], 0x20
je 0x100e875
and word [esi], 0
lea eax, [ebp - 0x254]
push eax
add edi, 2
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x100e8a8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x103f8e5
and word [esi + 2], 0
mov eax, dword [ebp - 4]
pop edi
mov word [esi], bx
pop esi
pop ebx
leave
ret 4

Function at 0x100eb94
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
jmp 0x100ebb0
cmp cx, 0x39
ja 0x100ebb9
movzx ecx, cx
inc edx
jmp 0x103b042
mov cx, word [edx]
cmp cx, 0x30
jae 0x100eb9c
ret 4
Function at 0x100ebbc
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xbc4
push ebx
push esi
push edi
push 0x31
pop ecx
push dword [esp + 0xbd4]
mov esi, 0x1001b00
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
xor ebx, ebx
mov dword [esp + 0x20], ebx
lea esi, [esp + 0x64]
call edi
cmp eax, ebx
jne 0x100ebf9
xor eax, eax
jmp loc.0103fb3d
cmp word [esp + 0x60], bx
mov dword [0x1014998], 1
je 0x100ec1a
cmp word [esi], 0x23
jne 0x100ec13
mov word [esi], bx
inc esi
inc esi
cmp word [esi], bx
jne 0x100ec0a
lea ecx, [esp + 0x60]
push ecx
push eax
call fcn.0100ea35
cmp eax, ebx
mov dword [esp + 0x28], eax
je 0x100f6a6
push ebp
push eax
call edi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffff
je 0x100f687
xor ecx, ecx
xor edx, edx
inc ecx
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 4
pop edi
add esi, edi
cmp eax, 7
ja 0x100f68f
jmp loc.0103b678
mov dword [esp + 0x20], 1
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor ebx, ebx
pop ebp
push dword [esp + 0xbd4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x1c]
mov dword [0x1014998], ebx

Function at 0x100fd91
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea eax, [ebp - 0x20c]
push eax
jmp loc.0103c1ff

Function at 0x101081b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
xor ebx, ebx
push esi
jmp loc.0103dbae

Function at 0x1010a65
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov ebx, eax
lea edi, [ebx + 8]
push edi
jmp loc.0103bbcd

Function at 0x1010ce9
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
sub esp, 0xf4
push ebx
xor ebx, ebx
cmp dword [0x1014d4c], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x64
jne 0x1010f70
cmp dword [0x101494c], ebx
jmp loc.0103caad
push dword [esp + 0xfc]
call fcn.01010c82
mov dword [0x1014d4c], ebx
pop ebx
add esp, 0xf4
ret 4

Function at 0x101104f
Capabilities:
Packed with generic packer

Disassembly:
push esi
xor esi, esi
cmp dword [0x10149a0], esi
jne fcn.01011070
push 0x10016bc
push 0x1fa
push dword [0x1015020]
jmp loc.0103ce77
Function at 0x1011165
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
push ebx
jne 0x1011198
call dword [sym.imp.USER32.dll_MessageBeep]
jmp loc.0103fa59
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndTask]
test eax, eax
jne fcn.01011218
push esi
push edi
push 0x200
lea eax, [ebp - 0x808]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InternalGetWindowText]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x201
push edi
lea eax, [ebp - 0x408]
push eax
push 0xb1
push ebx
call esi
sub edi, eax
push edi
lea eax, [ebp + eax*2 - 0x408]
push eax
push 0xb2
push ebx
call esi
push 0x11004
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
pop edi
pop esi
jne fcn.01011218
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndTask]

Function at 0x10119fa
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, dword [sym.imp.USER32.dll_DefDlgProcW]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1015774]
push 1
xor esi, esi
push eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x1e
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push esi
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x1001c08
jmp loc.0103bb22