joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020644
Capabilities:
Terminate thread

Disassembly:
push 0xc
push 0x1003008
call fcn.0103454c
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor edi, edi
cmp dword [esi], edi
je 0x10206e8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [esi + 8]
je 0x1020697
push edi
push edi
push 0x400
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x3e8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10206e0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x10206e0
mov ecx, dword [esi + 0xc]
cmp ecx, edi
je 0x10206e0
mov dword [ebp - 4], edi
call fcn.0100539b
or dword [ebp - 4], 0xffffffff
jmp 0x10206bc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10206d2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.ole32.dll_OleUninitialize]
push edi
call dword [sym.imp.msvcrt.dll__endthreadex]
pop ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi + 0x14]
cmp esi, edi
je 0x10206f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.01034587
ret

Function at 0x10213c8
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x14], eax
je 0x1021408
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 8]
push eax
push edi
push esi
push 0x10213b2
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
mov dword [esi], eax
jne 0x1021426
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1021418
call esi
jmp 0x1021456
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1021456
push 0x2710
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1021448
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x1021456
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x102181e
Capabilities:
Capture microphone audio

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
inc ebx
push edi
xor edi, edi
cmp dword [0x10376bc], edi
mov eax, 0x1f40
mov word [ebp - 0x1c], bx
mov word [ebp - 0x1a], bx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], 8
mov word [ebp - 0xc], di
jne 0x1021863
call fcn.01028e3c
cmp eax, edi
jl 0x102199c
push esi
mov esi, dword [ebp + 0x10]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x102187e
mov eax, 0x80070057
jmp 0x102199b
push dword [ebp + 0xc]
mov ecx, dword [0x1037418]
call fcn.0101da89
cmp eax, edi
mov dword [ebp + 0x10], eax
jne 0x102189d
mov eax, 0x80042002
jmp 0x102199b
mov dword [esi], 6
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x10218b4
mov dword [esi], ebx
jmp 0x1021999
mov eax, dword [0x1037d18]
cmp dword [eax + 0x14], edi
jne 0x1021912
mov eax, dword [0x10376e4]
cmp dword [eax + 0x88], edi
jne 0x10218d6
mov dword [esi], 5
jmp 0x1021999
mov ecx, dword [0x10376e0]
call fcn.0102955d
cmp eax, edi
je 0x1021993
mov ecx, dword [eax]
cmp ecx, dword [ebp + 8]
jne 0x1021993
mov ecx, dword [ebp + 0x10]
cmp dword [eax + 4], ecx
jne 0x1021993
push dword [ebp + 0xc]
mov ecx, dword [0x1037418]
call fcn.0101db79
test eax, eax
jne 0x102191a
mov dword [esi], 4
jmp 0x1021999
mov ecx, dword [0x10373f8]
call fcn.01013920
test eax, eax
je 0x1021938
mov ecx, dword [0x1037d18]
call fcn.01030aa9
test eax, eax
je 0x1021947
mov ecx, dword [0x10373f8]
call fcn.01013911
test eax, eax
jne 0x102198f
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x102197e
push dword [ebp - 4]
call dword [sym.imp.WINMM.dll_waveInClose]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
call dword [sym.imp.WINMM.dll_waveOutOpen]
test eax, eax
je 0x1021986
mov dword [esi], 3
jmp 0x1021999
push dword [ebp - 8]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov dword [esi], edi
jmp 0x1021999
mov dword [esi], 2
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x1023c02
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x28]
xor ecx, ecx
or ebx, 0xffffffff
cmp eax, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x1023c32
mov esi, dword [eax + 4]
cmp esi, ecx
mov dword [ebp - 0xc], eax
jne 0x1023c3d
mov eax, dword [edi + 0x2c]
mov esi, dword [eax]
jmp 0x1023c3d
mov eax, dword [edi + 0x2c]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push dword [ebp + 8]
call fcn.010236ab
xor edx, edx
cmp ax, dx
jne 0x1023c59
xor eax, eax
inc eax
jmp 0x1023cb6
mov ecx, dword [esi + 8]
cmp ax, word [ecx]
jne 0x1023c81
cmp ebx, edx
jge 0x1023c71
cmp dword [ecx + 4], edx
je 0x1023c71
movzx ebx, word [ecx + 2]
mov dword [edi + 0x28], esi
mov ecx, dword [esi + 8]
cmp dword [ecx + 4], edx
je 0x1023c7e
inc dword [ebp - 8]
jmp 0x1023c81
inc dword [ebp - 4]
cmp esi, dword [ebp - 0xc]
je 0x1023c94
mov esi, dword [esi + 4]
cmp esi, edx
jne 0x1023c59
mov ecx, dword [edi + 0x2c]
mov esi, dword [ecx]
jmp 0x1023c59
xor eax, eax
cmp ebx, edx
jge 0x1023ca2
cmp dword [ebp - 4], edx
setne al
jmp 0x1023cb6
cmp dword [ebp - 8], 1
movzx ecx, bx
setne al
inc eax
inc eax
movzx eax, ax
shl eax, 0x10
or eax, ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1027030
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov edi, dword [ebp + 8]
jne 0x1027058
test edi, edi
je 0x10270b3
mov ecx, esi
call fcn.01026d6a
test eax, eax
jl 0x10270b3
cmp edi, dword [esi + 0xc]
je 0x10270b3
test edi, edi
je 0x1027091
mov ecx, dword [0x1037d18]
push 1
push 0
call fcn.0103117d
push 0
push 0
mov ecx, esi
call fcn.01026f6a
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x102709c
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [esi + 0xc], eax
mov ecx, dword [0x1037420]
call fcn.01025e38
pop edi
pop esi
pop ebp
ret 4

Function at 0x102b819
Capabilities:
Log keystrokes
Query or enumerate registry value

Disassembly:
push 0x4e0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x102b831
mov ecx, eax
call fcn.0102b722
jmp 0x102b833
xor eax, eax
test eax, eax
mov dword [0x10376e4], eax
jne 0x102b842
mov eax, 0x8007000e
ret
mov ecx, eax
jmp fcn.0102b260
Function at 0x102ddf3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10372d8]
and dword [ebp - 0x64], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x68], eax
mov eax, dword [0x1037380]
cmp dword [eax + 0x1c], 1
je 0x102de3e
push 0x10
lea eax, [ebp - 0x8c]
push eax
movzx eax, word [ebp + 8]
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x102de42
xor eax, eax
jmp 0x102de7b
push ebx
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
push 0x17
pop ecx
mov ebx, eax
xor eax, eax
push eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push eax
push 0x102dd98
lea eax, [ebp - 0x60]
push eax
push ebx
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x64]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01034242
leave
ret 8

Function at 0x102df6d
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10372d8]
and dword [ebp - 0x4c], 0
mov dword [ebp - 4], eax
mov eax, dword [0x1037380]
mov dword [ebp - 0x50], 0x20
cmp dword [eax + 0x1c], 1
jne 0x102dfd6
lea eax, [ebp - 0x4c]
push eax
push 0x1003f90
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x102e058
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x102e058
cmp dword [ebp - 0x50], 0x12
jne 0x102e058
jmp 0x102e043
cmp dword [eax + 0x10], 5
jb 0x102dfff
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
mov dword [ebp - 0x48], eax
jne 0x102dff3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x48], eax
xor ecx, ecx
test ax, ax
sete cl
mov eax, ecx
jmp 0x102e054
lea eax, [ebp - 0x4c]
push eax
push 0x1003f54
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x102e058
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0x1003f44
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102e051
cmp dword [ebp - 0x54], 1
jne 0x102e051
cmp dword [ebp - 0x50], 0x12
jne 0x102e051
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x48]
call fcn.0102dc25
jmp 0x102e061
xor eax, eax
inc eax
test eax, eax
je 0x102e061
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
call fcn.01016661
test eax, eax
jne 0x102e074
mov dword [ebp - 0x48], 0x409
cmp dword [ebp - 0x4c], 0
je 0x102e083
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x48]
call fcn.01034242
leave
ret
Function at 0x102e0d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [0x10373fc]
push ebx
push esi
push dword [ebp + 0x10]
call fcn.01015b5d
mov ebx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x102e108
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x102e10c
xor eax, eax
jmp 0x102e149
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov dword [ebp + 0x10], eax
call edi
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push esi
push ebx
mov dword [ebp + 8], eax
call edi
mov esi, dword [ebp + 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x102f6b3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10372d8]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xf003f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.0102ee3b
cmp eax, esi
jne 0x102f754
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x102f70b
lea eax, [ebp - 0x204]
push eax
call fcn.0102f6b3
cmp eax, esi
jne 0x102f753
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x208]
je 0x102f6fb
call fcn.0102edc8
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.0102edc8
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01034242
leave
ret 4
Function at 0x102fe78
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0102e6de
push 2
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x102fecc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x102feb7
call esi
mov esi, eax
jmp 0x102ff92
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x102ff92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x102feed
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x102ff12
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x102ff00
call esi
jmp 0x102ff87
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x102ff89
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x102ff51
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.010345f0
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov byte [eax + ebx], 0
mov edi, esp
test edi, edi
jne 0x102ff59
xor eax, eax
jmp 0x102ff7b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.010345f0
mov eax, esp
push esi
push edi
push eax
call fcn.0102ea9f
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0102fd36
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10305f4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10372d8]
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
mov dword [ebp - 4], eax
jne 0x103069d
mov dword [edi + 8], 1
mov eax, dword [0x10376e4]
cmp dword [eax + 0x74], ebx
je 0x103069d
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 3
mov dword [ebp - 0x210], eax
jne 0x1030657
cmp word [ebp - 0x208], 0x5c
jne 0x1030657
mov word [ebp - 0x208], bx
mov ebx, 0x10042ec
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x210]
lea eax, [eax + ecx + 1]
cmp eax, esi
jae 0x103068f
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01007b43
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
mov edi, dword [edi]
test edi, edi
pop esi
je 0x103069d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01034242
leave
ret
Function at 0x1030a38
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
jne 0x1030aa0
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.SoftwareVoiceSpeechRecognitionEngine
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1030a8d
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
mov dword [esi + 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x1030aa0
mov dword [esi + 0x14], edi
pop edi
pop esi
leave
ret
Function at 0x103117d
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10372d8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], eax
je 0x10311a3
xor eax, eax
inc eax
jmp 0x1031357
cmp dword [esi + 0x14], ebx
je 0x10311b2
mov eax, 0x80040007
jmp 0x1031357
push edi
mov ecx, esi
call fcn.0103092d
mov edi, eax
cmp edi, ebx
jl 0x10312c0
mov ecx, dword [0x1037380]
push ebx
call fcn.01011cb1
cmp dword [0x1037d1c], ebx
jne 0x10311f2
call fcn.01032ad8
mov edi, eax
cmp edi, ebx
jl 0x10312c0
mov ecx, dword [0x1037d1c]
call fcn.01031645
cmp dword [ebp + 8], ebx
je 0x1031202
mov ecx, dword [0x1037d1c]
call fcn.010322ea
cmp dword [0x10376b0], ebx
jne 0x1031219
call fcn.01026869
mov edi, eax
cmp edi, ebx
jl 0x10312b5
cmp dword [0x10376b8], ebx
jne 0x1031259
call fcn.01028bb4
mov edi, eax
cmp edi, ebx
jl 0x10312c0
mov ecx, dword [0x10376b8]
call fcn.01028beb
mov edi, eax
cmp edi, ebx
jge 0x1031259
mov ecx, dword [0x1037d1c]
call fcn.0103265d
call fcn.01028cd3
mov dword [0x10376b8], ebx
jmp 0x10312c0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
mov edi, 0x100
push eax
mov dword [ebp - 0x208], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10312a6
cmp dword [ebp - 0x208], 0x7fffffff
ja 0x10312a6
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
mov eax, dword [0x10376e4]
push edi
add eax, 0xb0
push eax
call fcn.01006b9e
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov edi, eax
cmp edi, ebx
jge 0x10312ce
mov ecx, dword [0x1037d1c]
call fcn.0103265d
mov dword [esi + 0x14], 1
mov eax, edi
jmp 0x1031356
xor ebx, ebx
inc ebx
mov dword [esi + 8], ebx
mov eax, dword [0x10376e4]
mov eax, dword [eax + 0xac]
cmp eax, 0xffffffff
je 0x10312ee
mov esi, dword [esi + 4]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x20]
mov ecx, dword [0x1037420]
call fcn.0102679a
cmp dword [ebp + 0xc], 0
je 0x103130a
mov ecx, dword [0x1037418]
call fcn.0101e481
mov ecx, dword [0x1037d1c]
call fcn.0103265d
mov ecx, dword [0x10376e0]
call fcn.01029522
test eax, eax
je 0x1031354
push dword [eax + 4]
mov esi, dword [eax]
mov ecx, dword [0x1037418]
push esi
call fcn.0101d9dc
mov ecx, dword [0x1037420]
push 0
mov edi, eax
push edi
push esi
call fcn.0102657e
mov ecx, dword [0x1037420]
push ebx
push edi
push esi
call fcn.0102657e
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01034242
leave
ret 8
Function at 0x1032132
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [0x10376e0]
push edi
call fcn.01029522
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x10321c0
mov ecx, dword [0x1037418]
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 4]
call fcn.0101ed96
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
lea esi, [ecx + eax]
mov eax, dword [ebp + 8]
sar eax, 1
sar esi, 1
sub esi, eax
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
add edi, 8
call fcn.01029131
mov eax, dword [ebp + 0xc]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
cmp ecx, eax
jle 0x103219d
sub eax, dword [ebp + 0xc]
mov edi, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
lea edx, [esi + ecx]
cmp edx, eax
jle 0x10321ae
sub eax, ecx
mov esi, eax
cmp edi, dword [ebp - 0x10]
jge 0x10321b6
mov edi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x14]
jge 0x1032221
mov esi, dword [ebp - 0x14]
jmp 0x1032221
push esi
push 0x1004380
call dword [sym.imp.USER32.dll_FindWindowW]
push esi
push 0x1004364
push esi
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.01029131
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
sub esi, ecx
cmp esi, dword [ebp - 0x24]
jge 0x1032204
mov esi, dword [ebp - 0x14]
jmp 0x1032213
mov eax, dword [ebp - 0x1c]
lea edx, [esi + ecx]
cmp edx, eax
jl 0x1032213
sub eax, ecx
dec eax
mov esi, eax
mov edi, dword [ebp - 0x10]
sub edi, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x20]
jge 0x1032221
mov edi, dword [ebp - 8]
call fcn.0102e154
test eax, eax
jne 0x103222d
or eax, 0xffffffff
mov ebx, dword [ebp - 4]
push 0x50
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
push eax
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x10376e4]
cmp dword [eax + 0x70], 0
jne 0x103225a
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x103226d
mov ecx, ebx
mov dword [ebx + 0x8c], esi
mov dword [ebx + 0x90], edi
call fcn.01031d48
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8

Function at 0x103227c
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10322e0
mov eax, dword [0x10376e4]
cmp dword [eax + 0x8c], 0
je 0x10322e0
cmp dword [eax + 0x88], 0
je 0x10322e0
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
je 0x10322e0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.01031b59
test eax, eax
je 0x10322e0
mov eax, dword [ebp - 4]
add eax, 6
push eax
mov eax, dword [ebp - 8]
add eax, 0xa
push eax
mov ecx, esi
call fcn.01032132
pop esi
leave
ret 4
Function at 0x103303b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 8]
push edi
push 0x5c
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1033061
inc edi
inc edi
jmp 0x1033069
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [0x10376e4]
add eax, 0x2b0
push eax
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10330db
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x10036b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10330db
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x10035a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1037380]
push 0
push 0
push 0x7ffd
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
leave
ret