joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1037328
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x1055bde
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
mov eax, dword [ebp + 0xc]
push ebx
push edi
movsx edi, ax
shr eax, 0x10
movsx ebx, ax
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
pop edi
pop ebx
test eax, eax
je 0x1037342
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0106e8b1
mov dword [ebp - 4], 1
jmp 0x1037342

Function at 0x103740c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
and edi, 1
and dword [ebp - 0x418], 0
mov eax, 0x1037518
test edi, edi
jne 0x1037442
mov eax, 0x1037504
push ebx
push eax
push 0x10374b8
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.010343ca
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x1051d02
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000001
mov dword [ebp - 0x41c], 0x208
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
je 0x1051cbe
test esi, esi
jne 0x1051d02
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001feb
leave
ret 8
cmp dword [ebp - 0x41c], eax
je 0x103749c
cmp word [ebp - 0x20c], ax
je 0x103749c
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xffc00000
add eax, 0x400000
or eax, 0x292013
push eax
push 0
push ebx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x103749c
test byte [ebp + 0xc], 2
je 0x10374a4
jmp 0x105d075
cmp dword [ebp - 0x418], 0
jne 0x10374a4
xor eax, eax
test edi, edi
sete al
mov dword [ebp - 0x418], 1
mov edi, eax
jmp 0x1037434
Function at 0x1039f7d
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
test byte [0x10b1104], 1
push edi
mov edi, ecx
je 0x1050378
mov eax, dword [0x10b1100]
test eax, eax
jne 0x1056570
pop edi
ret
or dword [0x10b1104], 1
push 0
push 0
push 0
push 0x10503ac
push 0x100f280
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
mov dword [0x10b1100], eax
jmp 0x1039f92
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1039f9a
push 0
push 0x1002cd0
push 3
push 0x1068f74
call fcn.01009311
mov ecx, edi
pop edi
jmp fcn.0105153c

Function at 0x103b0e6
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc10]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x103b109
push ebx
push ebx
push 0x438
push eax
call edi
push ebx
push ebx
push 0x1f
push dword [esi + 4]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push ebx
push 1
push 0x43f
push dword [esi + 0xc10]
call edi
pop edi
lea ecx, [esi + 0xaf8]
pop esi
pop ebx
jmp fcn.0103998e

Function at 0x103e044
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
cmp ecx, dword [esi + 0x5c]
jb 0x103e0c9
push 0
push 0xff
mov ecx, esi
call fcn.01014f45
jmp 0x103e118
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
lea eax, [ebp - 0x28]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edi, [esi + 0x4c]
mov eax, dword [edi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi]
mov dword [ebp - 0xc], eax
cmp eax, ecx
jne 0x103e119
push ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x50]
jne 0x103e118
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
push 0
sbb dword [ebp - 0x14], eax
push 0x3e8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0100e7e5
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edx
push eax
call fcn.0103dfdb
mov ecx, eax
cmp ecx, dword [esi + 0x60]
jae 0x103e023
mov ebx, dword [esi + 0x5c]
cmp ecx, ebx
jae 0x103e13a
mov eax, ecx
imul eax, eax, 0xff
xor edx, edx
div ebx
mov byte [ebp - 8], al
cmp ecx, dword [esi + 0x60]
jae 0x103e134
mov ebx, dword [esi + 0x60]
mov eax, ebx
sub eax, ecx
imul eax, eax, 0xff
xor edx, edx
div ebx
mov byte [ebp - 4], al
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.01014f45
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi]
cmp dword [ebp - 0xc], eax
je 0x103e07d
pop ebx
mov eax, dword [edi]
cmp dword [ebp - 0xc], eax
jne 0x103e130
mov esi, dword [esi + 0x50]
cmp dword [ebp - 0x10], esi
jne 0x103e130
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
leave
ret
mov byte [ebp - 4], 0
jmp 0x103e0f8
mov byte [ebp - 8], 0
jmp 0x103e0df
Function at 0x103e705
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push 2
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_GetAncestor]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov ebx, eax
call edi
test ax, ax
jl 0x105fc98
xor eax, eax
neg eax
sbb eax, eax
and eax, 0x103e7b8
push eax
push 0x100
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_Ordinal_571]
mov ebx, eax
test ebx, ebx
jl 0x103e7ab
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
and dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x100e
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
lea eax, [ebp - 0x10]
push eax
push 0
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x1c]
push eax
push 0xcc
push dword [esi + 0x44]
call fcn.0103c26a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
cmp ebx, 0x800704c7
je 0x103e758
jmp 0x103e7a2
push 0x11
call edi
test ax, ax
jge 0x103e732
xor eax, eax
inc eax
jmp 0x103e734
Function at 0x103fbb7
Capabilities:
Create process on windows

Disassembly:
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push edi
mov ecx, esi
call fcn.01040043
push dword [0x10b10ec]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x103fbf3
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push edi
mov ecx, esi
call fcn.01071205
jmp 0x103fbf3
push 0
push 0x1f7
call fcn.0103700a
jmp 0x103fbf3
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x30002
push 0x127
lea edi, [esi + 0xc04]
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi]
mov ecx, esi
call fcn.01039f5f
jmp 0x103fbf3
push 0x103227c
push dword [esi + 4]
call fcn.010409b1
test eax, eax
jne 0x103fbf3
push 0x10689c4
push 0x10309f8
push dword [esi + 4]
call fcn.0106f866
jmp 0x103fbf3
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x103fbf3
mov ecx, esi
call fcn.0106feb0
jmp 0x103fbf3
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x103fbf3
push eax
push 0xa086
mov ecx, esi
jmp 0x103f9a8
push ebx
mov ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebx
je 0x103fa6e
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
cmp edi, 0x1fb
sete al
push 0
lea eax, [eax + eax - 1]
push eax
push 0x43d
push dword [esi + 0xc10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebx
jmp 0x103fbf3
push 5
xor edi, edi
push edi
push 0x103fba4
push 0x103fb8c
push edi
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x103fbf3
push 1
push 0
push 0x10b39ec
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x103fbf3
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push 1
mov ecx, esi
call fcn.010716e1
jmp 0x103fbf3
xor edi, edi
cmp dword [0x10b10f8], edi
jne 0x103fbf3
push 2
push dword [esi + 4]
push edi
push 1
call dword [sym.imp.dwmapi.dll_Ordinal_113]
jmp 0x103fbf3
call fcn.0106ff09
jmp 0x103fbf3
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, dword [esi + 0xe04]
je 0x103fbfa
lea eax, [edi - 0x1f4]
mov dword [esi + 0xe04], edi
cmp eax, 0x41
ja case.0x103fbe7.514
movzx eax, byte [eax + 0x103fb48]
jmp dword [eax*4 + 0x103fb0c]
call fcn.0103ff1d
or dword [esi + 0xe04], 0xffffffff
pop edi
pop esi
pop ebp
ret 8
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
xor eax, eax
cmp dword [0x10b10f8], edi
push 1
sete al
mov ecx, esi
push eax
call fcn.01009aab
push 1
call fcn.010407f3
jmp 0x103fbf3
push dword [ebp + 0xc]
push edi
call fcn.01071526
jmp 0x103fbf3
Function at 0x103fdb9
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp + 0x1c], 4
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x614], edi
mov word [ebp - 0x20c], ax
cmp dword [ebp + 0xc], ebx
jne 0x105636b
mov dword [ebp - 0x610], ebx
cmp esi, ebx
je 0x105639c
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x105639c
cmp word [ebp - 0x20c], bx
je 0x103fe4d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x103fe4d
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x1056387
cmp eax, 5
je 0x1056387
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x105639c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
cmp dword [ebp + 0x14], ebx
je 0x103fe8b
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x14]
push dword [0x10b10b4]
call esi
lea ebx, [ebp - 0x40c]
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x10563b2
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001feb
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x10b10b4]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x610], eax
jmp 0x103fdfb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x103fe4d
push ebx
push 0x10
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x103fe62
push edi
lea eax, [ebp - 0x60c]
push eax
push dword [ebp + 0x18]
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0x60c]
jmp 0x103fe96
Function at 0x1043efd
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
call esi
mov edi, dword [ebp + 8]
test ax, ax
jl 0x105cdb8
push 0x11
call esi
test ax, ax
jl 0x105cdc3
pop edi
pop esi
pop ebp
ret 4
or dword [edi], 0x10000000
jmp 0x1043f1a
or dword [edi], 0x40000000
jmp 0x1043f27

Function at 0x1047e9f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x338]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1047eef
cmp dword [ebp + 8], 0
jne 0x104803d
mov edx, dword [eax + 0x29c]
mov ecx, edx
and ecx, 0xf
test dl, 0x20
jne 0x10595ef
add eax, 0x18
push eax
push ecx
push 0x421
push dword [esi + 0x20]
call edi
mov eax, dword [esi + 0x338]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x1047f25
test byte [eax + 0x29c], 0x10
jne 0x1047f25
call ebx
sub eax, dword [ebp + 0xc]
cmp eax, 0x1388
jb 0x1047f25
call ebx
push 2
push 0x1048060
mov dword [ebp - 4], eax
call fcn.0103740c
mov ecx, esi
call fcn.01047899
mov ecx, 0x10b1460
call fcn.0100dbeb
push 0x2c
lea eax, [ebp - 0x30]
push 0
push eax
mov dword [ebp - 0x34], 0x30
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x338]
add esp, 0xc
test ecx, ecx
je 0x1047f79
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x439
push dword [esi + 0x20]
add ecx, 0x98
mov dword [ebp - 0x10], ecx
call edi
cmp dword [esi + 0x338], 0
mov dword [esi + 0x340], 1
je 0x1048033
and dword [esi + 0x390], 0
push 0x21b
push 0x1048050
call fcn.01034b2d
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0x2016
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1047fd4
mov eax, dword [ebp + 8]
imul eax, eax, 0x3e8
mov dword [ebp + 8], eax
cmp eax, 0x2328
jae 0x10595f7
mov eax, 0xbb8
add eax, 0x3e8
push eax
push 7
mov ecx, esi
call fcn.0104808b
test eax, eax
je 0x1048033
and dword [esi + 0x90], 0
call ebx
push 0x3e8
push 4
mov ebx, 0x403
push ebx
push dword [esi + 0x20]
mov dword [esi + 0x8c], eax
call edi
push 0x1388
push 5
push ebx
push dword [esi + 0x20]
call edi
push 0
push 0
add ebx, 0xe
push ebx
push dword [esi + 0x20]
call edi
lea eax, [ebp - 0x34]
push eax
push 1
push ebx
push dword [esi + 0x20]
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
add eax, 0x18
push eax
push dword [ebp + 8]
jmp 0x1047ee5
add ecx, 3
jmp 0x1047ee0
add eax, 0xffffe890
jmp 0x1047fd9
Function at 0x104873e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10b1110], 0
push esi
je 0x104f6cc
mov eax, dword [0x10b1110]
cmp eax, 1
je 0x105c967
push eax
call dword [0x10b1118]
test eax, eax
je 0x105c97e
pop esi
ret
call fcn.0104f6e3
test eax, eax
jne 0x104874c
jmp 0x105c995
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x105c995
pop esi
ret
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x105c999
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x10b1110]
call dword [0x10b1118]
mov edi, eax
test edi, edi
je 0x105c9be
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x105c9da
mov edi, esi
add esi, 0xff0
push edi
push dword [0x10b1110]
call dword [0x10b1114]
add edi, 0x10
cmp edi, esi
jb 0x105c9c6
mov eax, edi
pop edi
jmp 0x1048769
Function at 0x104de87
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, ecx
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x20]
and dword [edi + 0x60], 0
and dword [edi + 0x5c], 0
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x24]
and eax, 0xe0000000
mov dword [ebp + 8], eax
jne 0x104ded2
push 0xffffffffffffffec
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_GetWindowLongW]
shl eax, 7
not eax
and eax, 0x20000000
or eax, 0x40000000
mov dword [ebp + 8], eax
mov ecx, edi
call fcn.0103d227
lea ebx, [edi + 0x6c]
mov eax, dword [ebx]
test eax, eax
jne 0x105e7e3
push ebx
call fcn.01015b1d
mov eax, dword [edi + 0x58]
and dword [ebp - 4], 0
cmp eax, dword [edi + 0x1e0]
je 0x105e7f3
push dword [esi + 0xc]
mov ecx, edi
call fcn.0104db87
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.0104dc3e
xor ebx, ebx
cmp eax, ebx
jl 0x104df83
mov eax, dword [esi + 0x24]
or eax, dword [ebp + 8]
mov ecx, dword [edi + 0x6c]
push eax
add esi, 0x10
push esi
call fcn.0104df91
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ebx
jne 0x105e847
cmp dword [0x10b24cc], ebx
je 0x104df6e
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x104df7d
mov ecx, dword [0x10b24b8]
mov edx, dword [0x10b24bc]
mov eax, 0x10000
mov esi, 0x80000000
and ecx, eax
and edx, esi
or ecx, edx
jne 0x105e8b1
cmp dword [ebp + 8], 0
jl 0x104df83
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
test al, al
je 0x104df4c
jmp 0x104df6e
mov ecx, edi
call fcn.0104d4c6
jmp 0x104df74
mov eax, dword [eax + 4]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x24]
jmp 0x104dee6
lea ebx, [edi + 0x68]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
test eax, eax
je 0x105e816
push dword [esi + 0xc]
push dword [eax + 0xc]
call fcn.0107fa57
test eax, eax
je 0x105e816
xor eax, eax
jmp 0x105e83b
push ebx
call fcn.01015b1d
push dword [esi + 0xc]
mov ecx, edi
call fcn.0104db87
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.0104dc3e
test eax, eax
jl 0x104df83
mov ebx, dword [ebx]
mov dword [edi + 0x6c], ebx
inc dword [ebx]
jmp 0x104df16
cmp dword [0x10b24cc], ebx
je 0x104df6e
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x105e864
test al, al
jne 0x104df6e
mov ecx, dword [0x10b24b8]
mov edx, dword [0x10b24bc]
mov eax, 0x10000
mov esi, 0x80080000
and ecx, eax
and edx, esi
or ecx, edx
je 0x104df6e
mov ecx, dword [0x10b24c0]
mov ebx, dword [0x10b24c4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0x104df6e
cmp eax, ebx
jne 0x104df6e
push 0x10426a8
jmp 0x105e8da
mov ecx, dword [0x10b24c0]
mov ebx, dword [0x10b24c4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0x104df6e
cmp eax, ebx
jne 0x104df6e
push 0x105e8f0
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
jmp 0x104df6e
Function at 0x106d06c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x106d0ec
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010343ca
add esp, 0x10
test eax, eax
jl 0x106d0db
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0
push 0x10002
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
neg eax
sbb eax, eax
inc eax
jmp 0x106d0dd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01001feb
leave
ret 0xc
Function at 0x106d6b5
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
mov dword [ebp - 0x40], 0x3c
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1030a18
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 0x2000100
mov dword [ebp - 0x34], 0x10689c4
call sub.SHELL32.dll_SHGetKnownFolderIDList
test eax, eax
jl 0x106d709
mov eax, dword [ebp - 4]
or dword [ebp - 0x3c], 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_ILFree]
leave
ret
Function at 0x106eab1
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1f4
xor edi, edi
lea eax, [ebp - 0x1f8]
push edi
push eax
mov dword [ebp - 0x1fc], 0x1f8
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x1fc]
push eax
push 0x1f8
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x106eb4d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp cx, 4
jne 0x106eb34
shr ax, 0xa
cmp ax, 1
je 0x106eb28
cmp ax, 2
jne 0x106eb34
mov dword [ebp - 0x1d4], 0x190
jmp 0x106eb3e
mov dword [ebp - 0x1d4], 0x2bc
lea eax, [ebp - 0x1e4]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.01001feb
leave
ret

Function at 0x106f37e
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov cx, word [ebp + 8]
shr cx, 8
sub esp, 0xc
xor eax, eax
test cl, 4
je 0x106f396
inc eax
test cl, 2
je 0x106f39e
or eax, 2
test cl, 1
je 0x106f3a6
or eax, 4
movzx cx, byte [ebp + 8]
and dword [ebp - 4], 0
shl eax, 8
add ax, cx
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x106f325
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x106f866
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push dword [ebp + 0xc]
call sub.SHELL32.dll_SHGetKnownFolderIDList
test eax, eax
jl 0x106f8cc
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x10000c
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_ILFree]
leave
ret 0xc
Function at 0x106f8d5
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub eax, 0x55c
push ebx
push esi
push edi
mov esi, ecx
je 0x106f911
dec eax
jne 0x106f90a
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x106f90a
push ebx
push ebx
push dword [esi + 0x3c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_479]
push dword [0x10b10ec]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x106f8f3
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x10002
push 0x128
push dword [esi + 4]
call edi
push dword [esi + 4]
push 1
push 0x459
push dword [0x10b10ec]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x106f968
push ebx
push ebx
push 0x414
push dword [esi + 0xc04]
call edi
push eax
jmp 0x106f96e
push dword [esi + 0xb10]
mov ecx, esi
call fcn.01039f5f
jmp 0x106f90a

Function at 0x106feb0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x3c], 0x3c
call sub.msvcrt.dll_memset
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], 0x106fef4
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
leave
ret

Function at 0x106ff09
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x106fff0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x106ff45
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x106ff7a
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x106ffa8
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
je 0x106ff7a
push 1
push 0
push 0x106ff88
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001feb
leave
ret