joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e1e6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
jne 0x101e208
xor eax, eax
jmp 0x101e3a2
push ebx
lea eax, [esi + 8]
cmp word [eax], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, 0x400
jne 0x101e22e
push 0x28
push eax
push 0x1003
push ebx
call edi
and word [esi + 0x58], 0
lea eax, [esi + 0xac]
cmp word [eax], 0
jne 0x101e24a
push 0x28
push eax
push 0x1f
push ebx
call edi
and word [esi + 0xfc], 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x101e263
xor eax, eax
jmp 0x101e3a0
push ebx
mov ecx, esi
call fcn.0101d9e0
mov eax, dword [esi + 0x1b8]
cmp eax, ebx
je 0x101e282
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101df76
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, dword [ebp - 0xc]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x10]
sar edi, 1
cmp eax, dword [ebp - 0x18]
jle 0x101e2bb
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101e127
mov eax, dword [ebp - 0xc]
add eax, edi
add eax, ebx
cmp eax, dword [ebp + 0xc]
jge 0x101e314
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x101e314
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x101e2e7
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101e073
mov eax, dword [ebp - 0xc]
add edi, eax
lea eax, [edi + ebx]
cmp eax, dword [ebp + 0xc]
jge 0x101e314
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x101e314
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x101e314
mov dword [ebp - 0x18], ecx
xor edi, edi
cmp dword [esi + 0x1b8], edi
je 0x101e32a
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x103d7b0]
lea eax, [ebx + eax*4]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push edi
push edi
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push dword [esi + 4]
call ebx
push eax
push edi
push 0xfffffffffffffff0
push dword [esi + 4]
call ebx
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov ecx, dword [0x103d79c]
mov eax, dword [0x103d7a0]
mov edx, dword [ebp - 0x24]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
mov esi, ecx
sub esi, edx
cmp esi, eax
jge 0x101e38d
lea ecx, [eax + edx]
sub ecx, edx
movzx eax, cx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x101ef86
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov edi, ecx
cmp dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x101efea
cmp dword [ebp + 8], ebx
push esi
push 5
pop eax
lea esi, [edi + 8]
je 0x101efa8
mov dword [esi], eax
jmp 0x101efaa
inc dword [esi]
cmp dword [esi], eax
ja 0x101efe9
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push 0x1004150
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101efe9
push 4
push esi
push 4
push ebx
push 0x1004138
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov dword [edi + 0xc], ebx
pop edi
pop ebx
leave
ret 4

Function at 0x101f00c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push ebx
push 0x10041cc
push 0x1004150
push SysReAllocString
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x101f099
push edi
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_IStream_Read]
test eax, eax
jl 0x101f092
cmp dword [ebp - 0x18], 0x14
jne 0x101f092
mov edi, dword [ebp - 4]
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0101ef10
test eax, eax
je 0x101f092
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x101f092
cmp dword [ebp - 0xc], ebx
jbe 0x101f092
mov eax, dword [ebp - 8]
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push eax
push esi
call dword [ecx + 0x14]
test eax, eax
jne 0x101f092
push esi
call dword [fcn.010086e8]
mov dword [edi + 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ecx + 0x1c], ebx
pop esi
setne al
pop ebx
leave
ret 4
Function at 0x101f0aa
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
mov ebx, SysReAllocString
je 0x101f14e
push 1
push 0x10041cc
push 0x1004150
push ebx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
test eax, eax
mov dword [ebp - 4], eax
je 0x101f14e
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
pop edi
push dword [esi + 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10001
call dword [0x10086f0]
test eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jbe 0x101f13e
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_IStream_Write]
test eax, eax
jl 0x101f13e
push dword [ebp - 4]
push dword [esi + 0x1c]
call dword [0x10086ec]
test eax, eax
je 0x101f13e
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 8], 0
pop edi
jne 0x101f180
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x1004150
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f180
push 0x10041cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret

Function at 0x101f1f6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [ecx + 0x18], eax
je 0x101f254
mov dword [ecx + 0x18], eax
xor ecx, ecx
test eax, eax
lea eax, [ebp + 8]
push eax
push 0xf003f
setne cl
push 0
push 0x1002ac0
push SysReAllocString
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f24f
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x10041ec
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x101f256
xor eax, eax
leave
ret 4
Function at 0x101fada
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, 0x1004150
push 0x100420c
push edi
mov esi, SysReAllocString
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov ebx, eax
test ebx, ebx
je 0x101fb75
push ebx
call dword [sym.imp.SHLWAPI.dll_IStream_Reset]
test eax, eax
jl 0x101fb75
cmp dword [ebp + 8], 0
push dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
push dword [ebp + 0xc]
push ebx
jne 0x101fb2b
call fcn.0101f3d8
jmp 0x101fb3b
call fcn.0101f8b8
test eax, eax
jge 0x101fb3b
mov dword [ebp - 8], 1
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
cmp dword [ebp - 8], 0
je 0x101fb75
lea eax, [ebp + 8]
push eax
push 0x20006
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101fb75
push 0x100420c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x101ff2d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 0x10043a8
push 0x100
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
and word [ebp - 0x208], 0
add esp, 0x10
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x408]
push eax
push SysReAllocString
mov dword [ebp + 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x101ff9e
cmp word [ebp - 0x208], ax
je 0x101ff9e
push 0x20013
push eax
lea eax, [ebp - 0x208]
push eax
call sub.WINMM.dll_PlaySoundW
leave
ret 4

Function at 0x1021950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and eax, 0xf
push eax
mov esi, ecx
push 0x421
push dword [esi + 0x20]
call ebx
test byte [ebp + 0xc], 0x10
jne 0x10219a2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [ebp + 0x14]
cmp eax, 0x1388
jb 0x10219a2
call edi
push 0x100445c
mov dword [ebp - 4], eax
call fcn.0101ff2d
mov ecx, esi
call fcn.0101fe66
mov ecx, 0x103e468
call fcn.010196df
push 0xb
pop ecx
xor eax, eax
mov dword [0x103e488], 1
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x2bc]
add eax, 0x88
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x439
push dword [esi + 0x20]
mov dword [ebp - 0x34], 0x30
call ebx
xor edi, edi
inc edi
push 0
mov ecx, esi
mov dword [esi + 0x2c4], edi
call fcn.0101fe2d
lea eax, [ebp - 0x34]
push eax
push edi
push 0x411
push dword [esi + 0x20]
call ebx
lea eax, [esi + 0x2b8]
push eax
push dword [ebp + 0x10]
mov ecx, esi
push 0x43e
push 2
call fcn.0102172c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1022ee9
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x28c], ebx
call fcn.010208d2
push dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.0102090a
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x1022f32
push ebx
push dword [esi + 0x2dc]
push 0x419
push dword [esi + 0x14]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1022f6a
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x445
push dword [esi + 0x14]
mov dword [ebp - 0x10], ecx
call edi
cmp dword [ebp - 8], ebx
mov dword [ebp - 4], eax
je 0x1022f6a
push eax
push dword [esi + 0x14]
call fcn.0102878e
mov dword [esi + 0x2dc], eax
lea ecx, [esi + 0x23c]
push dword [ecx + 4]
push 1
push dword [ebp - 4]
call fcn.0101eabe
mov edi, eax
cmp edi, ebx
je 0x1023030
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x102301e
cmp dword [ebp - 8], ebx
je 0x1023011
push dword [edi]
call fcn.0102847b
mov eax, dword [esi + 0x2bc]
cmp eax, ebx
je 0x1022ff2
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x1022ff2
mov ecx, dword [eax + 4]
cmp ecx, dword [edi + 4]
jne 0x1022ff2
cmp dword [ebp + 8], 0x204
je 0x1022fd5
cmp dword [ebp + 8], 0x206
je 0x1022fd5
mov dword [esi + 0x314], ebx
jmp 0x1022fdf
mov dword [esi + 0x314], 1
push 0x405
push ebx
push ebx
push dword [eax + 4]
mov ecx, esi
push dword [eax]
call fcn.0102206f
push 3
push edi
push dword [ebp - 4]
mov ecx, esi
call fcn.01021ea3
push ebx
mov ecx, esi
mov dword [esi + 0x2c8], 1
call fcn.0101fe2d
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.0102011c
jmp 0x102302b
push 1
push ebx
push dword [ebp - 4]
mov ecx, esi
call fcn.01022b65
xor eax, eax
inc eax
jmp 0x1023032
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1023e47
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x5de
push esi
mov esi, ecx
jne 0x1023e6a
cmp dword [ebp + 0xc], 6
je 0x1023f36
call fcn.01023039
jmp 0x1023f36
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x1023f34
push dword [esi + 0x14]
lea ecx, [esi + 0x23c]
push edi
push dword [ebp + 8]
call fcn.0101eabe
mov ebx, eax
cmp ebx, edi
je 0x1023f34
cmp dword [esi + 0x26c], edi
je 0x1023eb5
push edi
push dword [ebp + 8]
push 0x419
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, esi
call fcn.010200c2
push dword [ebx]
call fcn.0102847b
cmp dword [ebx + 0x10], 3
jb 0x1023ef2
xor eax, eax
cmp dword [esi + 0x26c], edi
mov ecx, esi
setne al
add eax, 0x400
push eax
push ebx
call fcn.0102011c
cmp dword [esi + 0x26c], edi
je 0x1023f34
cmp dword [esi + 0x270], edi
je 0x1023f34
push 0x401
jmp 0x1023f2c
cmp dword [esi + 0x26c], edi
je 0x1023f34
push 0x201
push ebx
mov ecx, esi
call fcn.0102011c
mov edi, 0x202
push edi
push ebx
mov ecx, esi
call fcn.0102011c
cmp dword [esi + 0x270], 0
je 0x1023f34
push 0x203
push ebx
mov ecx, esi
call fcn.0102011c
push edi
mov ecx, esi
push ebx
call fcn.0102011c
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x1024c83
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024d79
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
call ebx
test eax, eax
jne 0x1024d4a
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.0102b598
test eax, eax
jl 0x1024d33
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_StrDupW]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x1024d33
lea eax, [ebp - 0x41c]
push eax
push 0
push 0x143
push dword [ebp + 8]
call esi
test eax, eax
push dword [ebp - 0xc]
jl 0x1024d2d
push eax
push 0x151
push dword [ebp + 8]
call esi
jmp 0x1024d33
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp - 8]
push edi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call ebx
test eax, eax
je 0x1024cd7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push SysReAllocString
push dword [ebp + 8]
call fcn.01024bf5
test eax, eax
pop edi
pop ebx
jne 0x1024d79
push dword [ebp + 0xc]
push reloc.SHELL32.dll_SHChangeNotifyRegister
push dword [ebp + 8]
call fcn.01024bf5
pop esi
leave
ret 8

Function at 0x1024e27
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push dword [esp + 0x10]
push 0x10049d0
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
inc eax
ret 8
Function at 0x1024e68
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
lea eax, [ebp - 8]
push eax
push 0xb
xor esi, esi
push esi
push 0x1004af0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024f36
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1024ef7
jmp 0x1024ef2
dec dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1024ef7
cmp dword [ebp - 0x10], 8
jbe 0x1024ef2
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 4], esi
jge 0x1024eb0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 2
push 8
lea eax, [ebp - 0x18]
push eax
push 3
push 0x1004ac4
push 0x1004a48
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0xffffffffffffffff
push 1
push 3
push 0x28
push 0x10054dc
call fcn.0100b765
pop esi
leave
ret

Function at 0x102504d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x463
cmp dword [esi + 8], eax
mov ebx, ecx
je 0x1025078
push 0x10048d0
push 0xc
push 0
push dword [esi + 0xc]
call dword [sym.imp.SHELL32.dll_Ordinal_127]
jmp 0x10250d7
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x70
mov edi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x102509d
push 0
push 9
push 0x110a
jmp 0x10250bf
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
pop edi
je 0x10250d7
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
push 0xc
push eax
push ecx
call dword [edx + 0x18]
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8
Function at 0x10253cf
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], 0x1004d9c
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
lea eax, [ebp - 0x244]
je 0x102541a
push 0x1004d94
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x23e]
jmp 0x102542c
push 0x1004d80
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x232]
push edi
push 0xb
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x244]
mov dword [ebp - 0x28], eax
mov eax, dword [0x103d768]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
leave
ret 4

Function at 0x1025465
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 8]
push eax
push 8
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x10254e6
push edi
push dword [ebp - 8]
call fcn.010283b3
mov esi, dword [sym.imp.SHELL32.dll_SHFree]
mov edi, eax
test edi, edi
je 0x10254dc
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push 0x60
push dword [ebp + 8]
push edi
call dword [eax + 0x10]
test eax, eax
jl 0x10254d6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x10254cd
cmp dword [ebp - 0xc], 1
jne 0x10254cd
push dword [ebp - 0x10]
call esi
inc ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
push dword [ebp - 8]
call esi
test ebx, ebx
pop edi
jne 0x102551c
xor esi, esi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push dword [esi + 0x103d058]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025514
push dword [ebp - 0x10]
xor ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 4
cmp esi, 0x14
jb 0x10254e8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
pop ebx
leave
ret 8

Function at 0x1025536
Capabilities:
Delete registry key

Disassembly:
push esi
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHAddToRecentDocs]
xor edi, edi
lea esi, [edi + 0x103d058]
push dword [esi]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0xc], 0
je 0x102556a
push dword [esi]
push 0
push 0x1a
call dword [sym.imp.SHLWAPI.dll_SHSendMessageBroadcastW]
add edi, 4
cmp edi, 0x14
jb 0x1025544
pop edi
pop esi
ret 4
Function at 0x1025698
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push 2
push 0x1004db8
push 0x1002754
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x1025735
lea eax, [ebp - 4]
push eax
push 0x100637c
push 1
push esi
push 0x100641c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x102572f
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x1025726
push dword [ebp - 0xc]
call fcn.010255cb
push esi
xor eax, eax
push esi
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push dword [ebp - 0x10]
mov eax, dword [ebx]
push dword [ebp - 0x14]
push ebx
call dword [eax + 0x14]
push dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x28]
push dword [ebp - 0xc]
call dword [0x100868c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21c]
push eax
mov ebx, 0x104
mov dword [ebp - 4], esi
push esi
jmp 0x1025783
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call fcn.01025618
inc dword [ebp - 4]
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x1025755
pop edi
pop esi
pop ebx
leave
ret 8