joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1027dcf
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb00
mov eax, dword [0x1046080]
push ebx
push esi
push edi
push 0x1d
mov dword [ebp - 4], eax
mov edi, 0x1030
mov ebx, 0x21a
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x1027dff
add edi, 4
inc ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0xa4]
push eax
push 0x20c
push dword [0x104662c]
call esi
push 0x400
lea eax, [ebp - 0xaac]
push eax
push ebx
push dword [0x104662c]
call esi
push edi
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xaac]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x1027eb3
push 0x104
lea eax, [ebp - 0x2ac]
push eax
push 0x1027ec0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0xb00], esi
lea edi, [ebp - 0xafc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0xb00]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1027eb3
push dword [ebp - 0xab8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xabc]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001b2f
leave
ret

Function at 0x1027fc1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push esi
push 0x200
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
test byte [ebp - 0x28], 0x40
je 0x1028029
call fcn.01027f30
cmp eax, 2
jb 0x102802f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x1026358
push dword [0x1046c24]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x493e0
sbb esi, esi
neg esi
jne 0x102802f
push 1
jmp 0x102802a
push esi
call fcn.01027f68
mov eax, esi
pop esi
leave
ret

Function at 0x102809e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1046080]
push 7
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x10280e2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 2
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x34]
jmp 0x10280e5
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.01001b2f
leave
ret 4
Function at 0x10280f6
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x1046080]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push esi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x624], esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp eax, esi
mov dword [ebp - 0x628], eax
je 0x10282cb
push ebx
push eax
call fcn.01027b67
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x62c], eax
je 0x10282c2
lea ecx, [ebp - 0x644]
push ecx
push 4
push eax
push 0x1027bb8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 0x620], eax
je 0x10282ba
push edi
xor eax, eax
mov dword [ebp - 0x63c], esi
lea edi, [ebp - 0x638]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x688], esi
lea edi, [ebp - 0x684]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10282a3
push 0x1028348
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x10282a3
push dword [ebp - 0x640]
lea eax, [ebp - 0x61c]
push 0x400
push 0x10282e0
push 0x208
push eax
call fcn.0101afdd
add esp, 0x14
test eax, eax
jl 0x10282a3
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x688]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x688], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10282a3
push dword [ebp - 0x63c]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x102827d
push dword [ebp - 0x638]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x624], 1
call edi
push dword [ebp - 0x620]
call edi
cmp dword [ebp + 0xc], esi
je 0x102828b
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 0x620]
push esi
call fcn.0101bdaf
jmp 0x102828b
push 5
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x63c]
call ebx
push dword [ebp - 0x638]
call ebx
cmp dword [ebp - 0x624], esi
jne 0x10282b1
push 5
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x620]
call ebx
pop edi
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x628]
call ebx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
pop esi
call fcn.01001b2f
leave
ret 8
Function at 0x102840a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1028423
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x1028529
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0x1028560
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x1028527
cmp dword [ebp - 8], ebx
jne 0x1028527
cmp dword [ebp - 4], ebx
jne 0x1028527
cmp dword [ebp - 0xc], eax
je 0x1028527
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ebx, 0x1028548
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x1028527
cmp dword [ebp - 8], 3
jne 0x1028527
test dword [ebp - 4], 3
jne 0x1028527
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi + 8], eax
je 0x1028527
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102851a
cmp dword [ebp - 8], 3
jne 0x102851a
mov eax, dword [ebp - 4]
test al, 3
jne 0x102851a
shr eax, 2
mov edi, eax
cmp edi, 0xa
jle 0x102851a
cmp edi, 0xca
jge 0x102851a
xor ecx, ecx
inc ecx
cmp ecx, edi
mov dword [esi + 0x10], edi
jge 0x1028518
mov eax, dword [esi + 8]
add eax, 4
mov edx, dword [eax]
cmp edx, dword [eax - 4]
jbe 0x1028516
cmp edx, 0xffff
ja 0x1028516
inc ecx
add eax, 4
cmp ecx, dword [esi + 0x10]
jl 0x10284fe
cmp ecx, edi
je 0x1028527
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi + 8], 0
pop edi
pop ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x1028535
mov dword [esi + 0xc], eax
jmp 0x1028543
mov dword [esi + 0xc], 0x1028588
mov dword [esi + 0x10], 0x1a
pop esi
leave
ret

Function at 0x10285f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x1028630
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1028630
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [esi + 4]
push 4
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ecx, esi
pop esi
jmp fcn.0102840a
pop esi
ret
Function at 0x102952e
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x101a4e0
push 0x80000001
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [ebp + 8]
jne 0x10295a4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea eax, [eax + eax - 2]
mov dword [ebp + 8], eax
shr eax, 1
mov word [esi + eax*2], di
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 8]
push eax
push edi
push 0x10295c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029597
cmp dword [ebp - 8], 1
jne 0x1029597
cmp word [esi], di
je 0x1029597
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x10295bd
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ebx, eax
cmp ebx, edi
je 0x10295bd
push 1
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x102ce44
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0x101362c
push 0x100c568
push 0x80000001
mov dword [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
leave
ret
Function at 0x102ee19
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1046080]
push ebx
push edi
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.0102ed64
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x220], eax
setne al
cmp dword [ebp + 8], 0xffffffff
je 0x102eff3
cmp dword [ebp - 0x220], 0xffffffff
setne cl
cmp al, cl
je 0x102eff3
cmp al, bl
je 0x102f007
lea eax, [ebp - 0x210]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x102eff3
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x102f020
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
cmp eax, ebx
mov dword [ebp - 0x210], eax
je 0x102eff3
push esi
lea eax, [ebp - 0x218]
push eax
push 0x102f074
push 3
push ebx
mov esi, 0x1026a48
push esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x102efe6
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
lea edx, [ebp - 0x214]
push edx
push 0x100c11c
push eax
call dword [ecx]
test eax, eax
jl 0x102efda
push dword [ebp - 0x210]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x102efce
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x18]
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
push 1
push esi
push dword [ebp - 0x214]
mov esi, dword [sym.imp.SHLWAPI.dll_IUnknown_Exec]
mov word [ebp - 0x230], 3
mov dword [ebp - 0x228], 0x1a
call esi
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x2f
push 0x102f084
push dword [ebp - 0x214]
mov dword [ebp - 0x228], ebx
call esi
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
push edx
push 0x100bbac
push eax
call dword [ecx]
test eax, eax
jl 0x102efce
mov eax, dword [edi + 0x3c]
push dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x102efc2
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
push 2
movsx eax, ax
push 2
push eax
push ecx
call dword [edx + 0x18]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
pop edi
pop ebx
call fcn.01001b2f
leave
ret 4
mov ecx, edi
call fcn.0102ed64
cmp eax, 0xffffffff
je 0x102eff3
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
jmp 0x102f007
Function at 0x102f0c0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1046080]
push 0x208
mov dword [ebp - 4], eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
push dword [0x104662c]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102f154
and dword [ebp - 0x450], 0
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x44c]
rep stosd dword es:[edi], eax
push 0x3e
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
pop edi
je 0x102f121
and word [eax], 0
inc eax
inc eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x414]
push eax
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x440], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
call fcn.01001b2f
leave
ret 4

Function at 0x102f6d4
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x3b4]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 4], 0x10
je 0x102f702
push ebx
push ebx
push 0x438
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [esi + 0x3a8]
cmp dword [edi], ebx
je 0x102f723
mov ecx, esi
call fcn.0102ce44
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0102ce75
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x34]
mov dword [esi + 0xc], 1
call edi
push 2
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [esi + 0x34]
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 4]
call edi
push 2
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push edi
push dword [esi + 4]
call ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [ebp - 0x1c]
push edi
push edi
push 0x1f
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x102f7b2
mov dword [ebp - 4], edi
lea eax, [esi + 0x4b4]
cmp dword [eax], edi
lea ebx, [esi + 0x4ac]
je 0x102f7c4
mov ebx, eax
mov eax, dword [ebx]
cmp eax, edi
jne 0x102f7d7
mov ecx, esi
call fcn.0100e0e5
mov eax, dword [ebx]
cmp eax, edi
je 0x102f7ec
push dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jge 0x102f7f1
call fcn.0102d71f
cmp dword [ebp - 4], 0x10
jne 0x102f80b
push edi
push 0x10002
push 0x128
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1030035
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1046080]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 1
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10300ab
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push ebx
push 0x103013c
push 0x104
push eax
call fcn.0101afdd
add esp, 0x14
inc dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1030061
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0100626a
jmp 0x103011f
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
test edi, edi
je 0x103011e
push edi
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.010047c4
and word [edi], 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push ebx
push 0x103012c
push 0x104
push eax
call fcn.0101afdd
add esp, 0x18
inc dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10300cf
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0100626a
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01001b2f
leave
ret 8
Function at 0x1030992
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1046080]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
push 0x1030a98
push ebx
mov dword [ebp - 4], eax
mov edi, ecx
call esi
test eax, eax
jne 0x10309d7
cmp dword [0x104608c], eax
push 1
sete al
mov ecx, edi
push eax
call fcn.010039fa
jmp 0x1030a73
push 0x1030a8c
push ebx
call esi
test eax, eax
jne 0x1030a73
and dword [ebp - 0x248], eax
push 0xe
pop ecx
lea edi, [ebp - 0x244]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1030a73
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
test eax, eax
mov dword [ebp - 0x224], eax
je 0x1030a73
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x244], 4
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x23c], 0x101b860
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 0x224]
call dword [sym.imp.SHELL32.dll_ILFree]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001b2f
leave
ret 4

Function at 0x1030aab
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4cc
mov eax, dword [0x1046080]
push ebx
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
push 0x16
lea eax, [ebp - 0x478]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1030b9a
cmp dword [ebp + 8], ebx
push esi
lea eax, [ebp - 0x270]
mov esi, 0x136
je 0x1030af2
push 0x1030bcc
jmp 0x1030af7
push 0x1030bac
push esi
push eax
call fcn.010047c4
push edi
lea eax, [ebp - 0x478]
push eax
push esi
lea eax, [ebp - 0x270]
push eax
call fcn.01004511
push 0x1030ba8
push esi
lea eax, [ebp - 0x270]
push eax
call fcn.01004511
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c8]
rep stosd dword es:[edi], eax
inc eax
mov dword [ebp - 0x4a0], eax
mov word [ebp - 0x49c], ax
xor eax, eax
mov dword [ebp - 0x488], ebx
lea edi, [ebp - 0x484]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x4cc]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x270]
push eax
push ebx
mov dword [ebp - 0x4cc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x1030b99
push dword [ebp - 0x488]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x484]
call esi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01001b2f
leave
ret 4
Function at 0x1031219
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x43c], esi
jne 0x10312ca
push 2
push dword [ebp + 8]
call fcn.0101b7a1
test eax, eax
jne 0x10312ca
push 0xffffffffffffffff
push esi
push 3
push 0x28
push 0x1008060
call fcn.01028367
push esi
push esi
push esi
push 0x10312d0
push 0x100c568
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x103127c
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1031283
mov ecx, edi
call fcn.01030f69
mov ecx, edi
call fcn.0102f873
push dword [ebp + 8]
lea esi, [edi + 0x3fc]
mov dword [esi], 2
call dword [sym.imp.SHELL32.dll_Ordinal_60]
and dword [esi], 0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jge 0x10312ca
push 0x11
call esi
test ax, ax
jge 0x10312ca
push 0x12
call esi
test ax, ax
jge 0x10312ca
mov ecx, edi
call fcn.0102ea30
pop edi
pop esi
pop ebp
ret 4
Function at 0x103205e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov edi, ecx
cmp dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x10320c4
cmp dword [ebp + 8], ebx
push esi
push 5
pop eax
lea esi, [edi + 8]
je 0x1032082
mov dword [esi], eax
jmp 0x1032084
inc dword [esi]
cmp dword [esi], eax
ja 0x10320c3
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push 0x10177a0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10320c3
push 4
push esi
push 4
push ebx
push 0x1017788
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov dword [edi + 0xc], ebx
pop edi
pop ebx
leave
ret 4

Function at 0x10320d2
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
mov ebx, 0x80000001
je 0x1032178
push 1
push 0x101781c
push 0x10177a0
push ebx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
test eax, eax
mov dword [ebp - 4], eax
je 0x1032178
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
pop edi
push dword [esi + 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x14], 0x10001
call dword [0x1027544]
test eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jbe 0x1032168
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_IStream_Write]
test eax, eax
jl 0x1032168
push dword [ebp - 4]
push dword [esi + 0x1c]
call dword [0x10321b4]
test eax, eax
je 0x1032168
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 8], 0
pop edi
jne 0x10321aa
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x10177a0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10321aa
push 0x101781c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret

Function at 0x103221e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [ecx + 0x18], eax
je 0x103227e
mov dword [ecx + 0x18], eax
xor ecx, ecx
test eax, eax
lea eax, [ebp + 8]
push eax
push 0x20006
setne cl
push 0
push 0x101a4e0
push 0x80000001
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1032279
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x101783c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1032280
xor eax, eax
leave
ret 4