joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010190
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
or dword [rsp + 0x78], 0xffffffff
lea rax, [r11 + 0x18]
xor ebx, ebx
mov qword [r11 - 0x28], rax
lea rax, [r11 + 0x20]
mov rsi, rdx
mov qword [r11 - 0x30], rax
lea rax, [r11 + 0x10]
mov qword [rdx], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
xor edx, edx
mov qword [r11 - 0x38], rax
mov rbp, rcx
mov dword [rsp + 0x70], 0x80000000
mov dword [rsp + 0x68], ebx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
cmp eax, ebx
je 0x1000102a6
cmp dword [rsp + 0x78], ebx
jne 0x1000102a6
cmp dword [rsp + 0x70], 1
jne 0x1000102a6
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
cmp rax, rbx
je 0x10001029f
lea rax, [rsp + 0x70]
lea r8d, [rbx + 1]
mov r9, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
cmp eax, ebx
je 0x10001028f
mov r8d, dword [rsp + 0x68]
lea ecx, [rbx + 2]
mov rdx, rdi
cmp r8d, ecx
jb 0x100010288
cmp word [rdx], bx
je 0x100010279
movzx r9d, word [rdx]
mov eax, r8d
sub eax, ecx
cmp r9d, eax
ja 0x100010279
movzx eax, word [rdx]
add ecx, r9d
add rdx, rax
cmp ecx, r8d
jbe 0x100010258
cmp ecx, r8d
ja 0x100010288
cmp bx, word [rdx]
jne 0x100010288
mov qword [rsi], rdi
jmp 0x1000102ab
mov ebx, 0x80070057
jmp 0x1000102ab
mov rcx, rdi
mov ebx, 0x8000ffff
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1000102ab
mov ebx, 0x8007000e
jmp 0x1000102ab
mov ebx, 0x8000ffff
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1000103a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov eax, dword [r9]
mov rcx, qword [rcx]
mov rbx, r8
add eax, eax
mov rdi, r9
xor esi, esi
mov dword [rsp + 0x30], eax
lea rax, [r11 - 0x18]
mov dword [r9], esi
mov qword [r11 - 0x20], rax
lea r9, [r11 + 0x20]
lea rdx, [0x100007ce8]
xor r8d, r8d
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100010432
cmp dword [rsp + 0x68], 1
je 0x100010408
cmp dword [rsp + 0x68], 2
je 0x100010408
mov eax, 0xd
jmp 0x100010432
mov ecx, dword [rsp + 0x30]
cmp rbx, rsi
je 0x10001042c
cmp ecx, esi
je 0x100010429
test cl, 1
jne 0x100010401
mov rax, rcx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x10001042c
jmp 0x100010401
mov word [rbx], si
shr ecx, 1
xor eax, eax
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x100010448
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, rcx
mov rcx, qword [rcx]
lea rax, [r11 - 0x14]
mov rbx, r8
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
lea rdx, [0x100007ce8]
xor r8d, r8d
mov qword [r11 - 0x28], rbp
mov dword [rsp + 0x34], ebp
mov edi, ebp
mov dword [rsp + 0x68], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [rbp + 1]
cmp eax, ebp
jne 0x10001054e
cmp dword [rsp + 0x30], ecx
je 0x1000104b1
cmp dword [rsp + 0x30], 2
je 0x1000104b1
lea eax, [rbp + 0xd]
jmp 0x10001054e
mov edi, dword [rsp + 0x34]
mov eax, ebp
shr edi, 1
mov dword [rsp + 0x68], edi
cmp eax, ebp
jne 0x10001054e
mov rax, qword [rbx]
lea edx, [rdi - 1]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x1000104df
mov rcx, rbx
call fcn.100010734
mov r8, qword [rbx]
lea r9, [rsp + 0x68]
lea rdx, [0x100007ce8]
mov rcx, rsi
call fcn.1000103a8
mov r11d, eax
cmp eax, ebp
jne 0x10001052e
mov ecx, dword [rsp + 0x68]
cmp ecx, ebp
jbe 0x10001052e
dec ecx
cmp ecx, ebp
jl 0x100010522
mov rdx, qword [rbx]
cmp ecx, dword [rdx - 0xc]
jg 0x100010522
mov dword [rdx - 0x10], ecx
mov rax, qword [rbx]
movsxd rcx, ecx
mov word [rax + rcx*2], bp
jmp 0x10001054b
mov ecx, 0x80070057
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3
mov rax, qword [rbx]
cmp dword [rax - 0xc], ebp
jge 0x100010542
mov ecx, 0x80070057
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3
mov dword [rax - 0x10], ebp
mov rax, qword [rbx]
mov word [rax], bp
mov eax, r11d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x100010cc0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov r12, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x10003e474]
test eax, eax
je 0x100010d07
lea rcx, [0x100007e28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x10003e474]
test eax, eax
jne 0x100010d14
call fcn.100011120
test eax, eax
je 0x100010d30
lea rdx, [rsp + 0x30]
mov rcx, qword [0x10003c4a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x100010d38
xor eax, eax
jmp 0x100010d90
and qword [rsp + 0x20], 0
lea r9, [0x100010ba8]
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x100010d72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100010d74
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x100010d8d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
ret
Function at 0x100010e4c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x100010fc6
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x100010fc6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x100010fc6
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100010ef8
cmp rdi, r11
jae 0x100010fc6
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100010ee2
cmp rdi, r11
jae 0x100010fc6
cmp word [rdi], r13w
je 0x100010fc6
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x100010f2a
mov edx, ebx
mov rcx, rsi
call fcn.100010734
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x100010f4b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x100010f9d
cmp eax, 0xc
je 0x100010f91
cmp eax, 0x16
je 0x100010f85
cmp eax, 0x22
je 0x100010f85
cmp eax, 0x50
je 0x100010f9d
mov ecx, 0x80004005
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3
mov ecx, 0x80070057
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3
mov ecx, 0x8007000e
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3
cmp ebx, r13d
jl 0x100010fba
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x100010fba
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100010fc8
mov ecx, 0x80070057
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100010ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x10003ca80]
xor edx, edx
xor ebx, ebx
call fcn.10002c344
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x1000110d6
test rbx, rbx
jne 0x1000110e2
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x1000110c5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100011072
xor ebx, ebx
jmp 0x1000110c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10001106e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1000110af
cmp rdi, r11
jae 0x10001106e
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001109d
cmp rdi, r11
jae 0x10001106e
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1000110e4
lea rcx, [0x10003ca80]
mov edx, ebp
call fcn.10002c344
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10001102f
xor esi, esi
test rsi, rsi
jne 0x1000110ed
xor eax, eax
jmp 0x1000110fb
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.100010e4c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100014764
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r12, rdx
mov r13d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x10003e474]
test eax, eax
je 0x1000147b2
lea rcx, [0x100007e28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x10003e474]
test eax, eax
jne 0x1000147bf
call fcn.100011120
test eax, eax
je 0x1000147db
lea rdx, [rsp + 0x60]
mov rcx, qword [0x10003c4a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1000147e6
xor eax, eax
jmp 0x10001488d
and qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x10001486f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100014871
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x10001488a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret

Function at 0x1000148b0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r12, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x10003e474]
test eax, eax
je 0x1000148f6
lea rcx, [0x100007e28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x10003e474]
test eax, eax
jne 0x100014903
call fcn.100011120
test eax, eax
je 0x10001491f
lea rdx, [rsp + 0x58]
mov rcx, qword [0x10003c4a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x100014927
xor eax, eax
jmp 0x10001496e
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov esi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x100014951
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100014953
xor edi, edi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x10001496c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r12
ret
Function at 0x10001498c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
mov word [rax - 0x18], bx
mov qword [rax + 0x10], rbx
mov edi, ebx
mov eax, dword [0x10003e474]
cmp eax, ebx
je 0x1000149cd
lea rcx, [0x100007e28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x10003e474]
cmp eax, ebx
jne 0x1000149da
call fcn.100011120
cmp eax, ebx
je 0x1000149f6
lea rdx, [rsp + 0x48]
mov rcx, qword [0x10003c4a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
cmp eax, ebx
cmovne edi, ecx
cmp edi, ebx
jne 0x1000149ff
mov ax, bx
jmp 0x100014a48
mov rcx, rsi
call qword [sym.imp.USER32.dll_RegisterClassExW]
movzx edi, ax
mov word [rsp + 0x20], ax
mov esi, ebx
cmp di, bx
sete sil
cmp esi, ebx
je 0x100014a28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x100014a2b
mov r12d, ebx
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp esi, ebx
je 0x100014a45
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ax, di
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x100015588
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x10003d29c], 0
mov rbp, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
jne 0x100015636
cmp dword [0x10003d400], 0
jne 0x100015636
cmp edx, 0x10
je 0x10001574c
cmp edx, 0x8000
je 0x100015726
cmp dword [0x10003d404], 0
jne 0x100015636
mov eax, 0x104
cmp edx, eax
ja 0x10001565c
je 0x1000156ab
cmp edx, 0x18
je 0x100015629
cmp edx, 0x1c
je 0x100015621
cmp edx, 0x20
je 0x100015612
cmp edx, 0x48
je 0x100015609
cmp edx, 0x100
jmp 0x1000156a9
cmp r8, 3
jmp 0x1000156a9
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x100015647
test r8, r8
jmp 0x1000156a9
test r8d, r8d
je 0x100015636
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov r9, rbp
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, edx
sub ecx, 0x200
je 0x1000156c3
mov eax, 1
sub ecx, eax
je 0x1000156ab
sub ecx, 3
je 0x1000156ab
sub ecx, 3
je 0x1000156ab
cmp ecx, 0x11
jne 0x100015636
test r8, r8
je 0x100015647
cmp r8, 5
jbe 0x1000156ab
cmp r8, 8
jbe 0x1000156a6
cmp r8, 0xa
je 0x100015636
cmp r8, 0x12
je 0x1000156a6
cmp r8, 0x8013
jne 0x1000156ab
jmp 0x100015636
test al, r9b
jne 0x100015636
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100015636
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11d, dword [rsp + 0x20]
sub r11d, dword [0x10003e510]
je 0x1000156e4
test r11d, r11d
jns 0x1000156e4
neg r11d
mov eax, dword [rsp + 0x24]
sub eax, dword [0x10003e514]
je 0x1000156f6
test eax, eax
jns 0x1000156f6
neg eax
add eax, r11d
cmp eax, 4
jbe 0x100015636
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov r11, qword [rsp + 0x20]
mov qword [0x10003e510], r11
jmp 0x100015636
cmp dword [0x10003d41c], 0
je 0x100015636
mov rax, qword [0x10003d410]
test rax, rax
je 0x10001561a
call rax
cdqe
jmp 0x100015647
cmp dword [0x10003d41c], 0
je 0x100015636
call fcn.100015dac
test eax, eax
jne 0x100015636
lea rcx, [0x10003e510]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x100015647
Function at 0x1000159c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp dword [0x10003d41c], 0
je 0x100015ab2
cmp qword [0x10003d408], 0
je 0x1000159e0
call fcn.100015f84
lea rax, [rsp + 0x58]
lea rdx, [0x1000075d0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100015ab2
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea rdx, str.ScreenSaveUsePassword
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100015aa7
cmp dword [rsp + 0x48], eax
je 0x100015aa7
lea rcx, str.PASSWORD.CPL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10003d408], rax
test rax, rax
je 0x100015aa7
lea rdx, str.VerifyScreenSavePwd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x10003d410], rax
test rax, rax
je 0x100015aa2
cmp dword [0x10003d41c], 0
je 0x100015aa7
xor r9d, r9d
lea r8, [rsp + 0x50]
lea edx, [r9 + 1]
lea ecx, [rdx + 0x60]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x100015aa7
call fcn.100015f84
mov rcx, qword [rsp + 0x58]
call qword [entry0]
add rsp, 0x38
ret

Function at 0x100015eb8
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebx, ebx
cmp word [rax], 0x22
mov rdi, rax
jne 0x100015f05
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
cmp word [rax], bx
je 0x100015eed
cmp word [rax], 0x22
jne 0x100015ed6
cmp word [rax], 0x22
jne 0x100015f0b
add rdi, 2
jmp 0x100015f0b
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
cmp word [rax], 0x20
ja 0x100015ef9
movzx eax, word [rdi]
jmp 0x100015f25
cmp ax, 0x20
ja 0x100015f2a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov ax, word [rax]
cmp ax, bx
jne 0x100015f10
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x5c], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x5c], 1
movzx eax, word [rsp + 0x60]
mov ebx, 0xa
cmovne ebx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, ebx
mov r8, rdi
mov rcx, rax
xor edx, edx
call fcn.1000152a4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100015fe4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x10003d440]
test rcx, rcx
jne 0x10001600a
call fcn.100016098
test eax, eax
je 0x100016031
mov rcx, qword [0x10003d440]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x100016085
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x100016035
xor eax, eax
jmp 0x100016085
mov eax, dword [rax]
mov rcx, qword [0x10003d440]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x100016062
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x100016085
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x10003d440]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x100016069
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100016938
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push r12
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x20], rdi
mov esi, r9d
mov ebx, r8d
mov r12, rdx
mov dword [rsp + 0x80], ebx
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x28]
mov qword [r11 - 0x48], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000169fc
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000169d0
cmp dword [rsp + 0x34], 4
jne 0x1000169ed
test eax, eax
jne 0x1000169ed
mov eax, dword [rsp + 0x38]
cmp eax, esi
jl 0x1000169ed
cmp eax, dword [rsp + 0x90]
cmovle ebx, eax
mov dword [rsp + 0x80], ebx
test rdi, rdi
je 0x1000169fc
mov rcx, rdi
call qword [entry0]
nop
jmp 0x100016a05
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x10001ae98
Capabilities:
Create thread

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov r12, r8
mov r13d, edx
mov rbx, rcx
test r8, r8
jne 0x10001aecd
mov eax, 0x80004003
jmp 0x10001af6a
lock add dword [rcx + 8], 1
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rcx
lea r8, [0x10001b60c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x10001af32
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
add eax, 0xffffffff
jne 0x10001af22
test rbx, rbx
je 0x10001af22
mov rax, qword [rbx]
lea edx, [rsi + 1]
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
jmp 0x10001af6a
mov edi, 0x800705b4
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10001af5f
mov al, byte [rbx + 0x14]
mov byte [r12], al
mov edi, dword [rbx + 0x10]
jmp 0x10001af5f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret

Function at 0x100025af0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx + 8]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, 0x12
and al, 1
neg al
sbb rbx, rbx
and rbx, 0xfffffffffffffff0
add rbx, 0x20
bts rbx, 0xd
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
cmp cx, ax
jg 0x100025b30
bts rbx, 7
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x100025c40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, 1
lea edi, [rax + 1]
mov rax, qword [rbx]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x100025c7f
mov edx, edi
mov rcx, rbx
call fcn.100010734
mov rdx, qword [rbx]
mov rcx, qword [rsi]
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
mov r11d, eax
mov ecx, eax
cmp eax, 0xffffffff
jne 0x100025cb5
mov rdi, qword [rbx]
cmp rdi, rdx
jne 0x100025ca6
mov ecx, edx
jmp 0x100025cb9
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, edx
jl 0x100025ce1
mov rax, qword [rbx]
cmp ecx, dword [rax - 0xc]
jg 0x100025ce1
mov rsi, qword [rsp + 0x38]
mov dword [rax - 0x10], ecx
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
movsxd rcx, ecx
mov word [rax + rcx*2], dx
mov eax, r11d
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call qword [sym.imp.PhotoBase.dll_void___cdecl_ATL::BaseAtlThrow_long_int_]
int3