joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101800a4
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
call fcn.1017fc7b
mov ecx, edi
mov esi, eax
call fcn.10082fea
cmp byte [edi + 0x1f], 0
sete dl
mov byte [edi + 0x1f], dl
test esi, esi
je 0x101800cf
mov ecx, edi
pop edi
pop esi
jmp fcn.1006c743
pop edi
pop esi
ret

Function at 0x101801e5
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x30
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
inc ebx
call fcn.1000f686
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.1000f686
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push ebx
push 0
mov ecx, esi
call fcn.1015692e
push ebx
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.1015692e
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0x20e
push 0x200
push 0
lea eax, [esp + 0x20]
push eax
call ebp
test eax, eax
jne 0x1018027e
push 1
push 0x215
push 0x215
push eax
lea eax, [esp + 0x20]
push eax
call ebp
test eax, eax
jne 0x1018027e
push 1
push 0x1f
push 0x1f
push eax
lea eax, [esp + 0x20]
push eax
call ebp
test eax, eax
jne 0x1018027e
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x10180233
call dword [sym.imp.USER32.dll_GetCapture]
cmp dword [esp + 0x14], 0x1f
mov edi, eax
je 0x101802fc
mov ecx, esi
call fcn.1000f686
cmp eax, edi
jne 0x101802fc
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x101802da
cmp edi, ebx
je 0x10180233
push edi
push 0
mov ecx, esi
mov ebx, edi
call fcn.1015692e
jmp 0x10180233
call dword [sym.imp.USER32.dll_ReleaseCapture]
test ebx, ebx
je 0x101802ef
push 0
push 0
mov ecx, esi
call fcn.1015692e
test edi, edi
je 0x1018031c
mov ecx, esi
call fcn.10082fea
jmp 0x1018031c
mov ecx, esi
call fcn.1000f686
cmp eax, edi
jne 0x1018030d
call dword [sym.imp.USER32.dll_ReleaseCapture]
test ebx, ebx
je 0x1018031c
push 0
push 0
mov ecx, esi
call fcn.1015692e
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x30
ret
Function at 0x10189a5f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov eax, ecx
mov ecx, dword [eax + 0x5c]
xor ebx, ebx
and dword [esp + 0x10], ebx
and dword [esp + 0xc], ebx
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 4
xor esi, esi
call fcn.100bb98b
mov ebp, eax
test ebp, ebp
je 0x10189b71
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
push ebp
call edi
mov esi, eax
mov eax, dword [esp + 0x18]
push dword [eax + 0x2c]
call edi
add esi, 2
add eax, esi
push eax
call dword [sym.imp.msvcr100.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10189b71
mov edi, dword [esp + 0x18]
push dword [edi + 0x2c]
push ebp
push 0x1014cbb8
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push esi
push dword [edi + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
call fcn.100bb880
mov ebx, eax
test ebx, ebx
js 0x10189b71
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push str.LoadBehavior
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
call fcn.100bb880
mov ebx, eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x28]
je 0x10189b71
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push esi
push dword [edi + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
js 0x10189b67
push 4
pop ecx
push ecx
lea eax, [esp + 0x2c]
push eax
push ecx
push 0
push str.LoadBehavior
push dword [esp + 0x28]
mov dword [esp + 0x34], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call fcn.100bb880
mov ebx, eax
cmp ebx, 0x46
jne 0x10189b71
mov ebx, 0x800aeaa8
cmp dword [esp + 0x10], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10189b84
push dword [esp + 0x10]
call edi
cmp dword [esp + 0x14], 0
je 0x10189b91
push dword [esp + 0x14]
call edi
mov edi, dword [sym.imp.msvcr100.dll_free]
test ebp, ebp
je 0x10189b9f
push ebp
call edi
pop ecx
test esi, esi
je 0x10189ba7
push esi
call edi
pop ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret 4
Function at 0x10189bb3
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
and dword [esp + 8], ebx
and dword [esp + 0xc], ebx
push edi
mov edi, ecx
xor esi, esi
mov dword [esp + 0x14], edi
cmp dword [esp + 0x1c], ebx
jne 0x10189bd9
mov dword [esp + 0x1c], 0x1000adc8
mov ecx, dword [edi + 0x5c]
push ebp
call fcn.100bb98b
mov ebp, eax
test ebp, ebp
je 0x10189ca3
push dword [edi + 0x2c]
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
call edi
push ebp
mov esi, eax
call edi
add esi, 2
add eax, esi
push eax
call dword [sym.imp.msvcr100.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10189ca3
mov edi, dword [esp + 0x18]
push dword [edi + 0x2c]
push ebp
push 0x1014cbb8
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push esi
push dword [edi + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
call fcn.100bb880
mov ebx, eax
test ebx, ebx
js 0x10189ca3
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push esi
push dword [edi + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0x46
je 0x10189c9e
mov edx, dword [esp + 0x20]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10189c70
sub ecx, edi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push str.Description
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call fcn.100bb880
mov ebx, eax
cmp ebx, 0x46
jne 0x10189ca3
mov ebx, 0x800aeaa8
cmp dword [esp + 0x14], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10189cb6
push dword [esp + 0x14]
call edi
cmp dword [esp + 0x10], 0
je 0x10189cc3
push dword [esp + 0x10]
call edi
mov edi, dword [sym.imp.msvcr100.dll_free]
test ebp, ebp
je 0x10189cd1
push ebp
call edi
pop ecx
pop ebp
test esi, esi
je 0x10189cda
push esi
call edi
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret 4
Function at 0x1018ae3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
push dword [0x1023af60]
push 0x1c
call fcn.1001a1a6
pop ecx
xor ebp, ebp
pop ecx
mov edi, 0x1464
test eax, eax
je 0x1018ae77
push esi
push edi
mov ecx, eax
call fcn.1018a682
mov ecx, eax
jmp 0x1018ae79
mov ecx, ebp
mov eax, dword [0x10244774]
push edi
push esi
mov dword [eax + 0x18], ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [0x10244774]
mov ecx, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
lea eax, [esp + 0x68]
push eax
mov eax, dword [0x10244774]
mov eax, dword [eax + 0x18]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x70]
sub esi, dword [esp + 0x68]
push 0xf
pop eax
xor ebx, ebx
inc ebx
push 0x211
mov dword [esp + 0x40], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x48], 0x82
mov dword [esp + 0x50], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x54], ebx
call fcn.1000e3fc
sub esi, dword [esp + 0x44]
push 0x210
sub esi, 5
mov dword [esp + 0x4c], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], esi
call fcn.1000e3fc
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x10244774]
mov eax, dword [eax + 0x18]
push ebp
mov edi, 0x101b
push edi
push dword [eax + 0x14]
call esi
movzx eax, word [esp + 0x18]
push eax
mov eax, dword [0x10244774]
mov eax, dword [eax + 0x18]
push ebp
push 0x101e
push dword [eax + 0x14]
call esi
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [0x10244774]
mov ecx, dword [ecx + 0x18]
push ebx
push edi
push dword [ecx + 0x14]
call esi
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x6c
ret 4

Function at 0x1018d72a
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
push edi
mov edi, dword [esp + 0xc]
push 0xffffffffffffffeb
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push edi
mov esi, eax
call fcn.100308c0
cmp dword [esi + 4], 1
jne 0x1018d768
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
push 0x221
push dword [0x1023a16c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1018d76f
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
ret 4
Function at 0x1018eaf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ecx
push ebx
push esi
push 3
xor esi, esi
push esi
push dword [esp + 0x18]
mov dword [esp + 0x14], esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
je 0x1018ec35
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
mov dword [edi], esi
mov eax, esi
mov dword [ebp], esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], eax
test esi, esi
jle 0x1018eb61
add eax, dword [esp + 0x20]
push dword [esp + 0x1c]
movzx eax, ax
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x1018ec10
push eax
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
add dword [edi], eax
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, esi
jl 0x1018eb2f
cmp esi, 1
jle 0x1018eb6d
mov eax, esi
shl eax, 2
add dword [edi], eax
push dword [edi]
call dword [sym.imp.msvcr100.dll_malloc]
mov edi, eax
pop ecx
mov dword [ebp], edi
test edi, edi
je 0x1018ec10
cmp esi, 1
jle 0x1018eb8b
lea edi, [edi + esi*4]
xor eax, eax
mov dword [esp + 0x18], eax
test esi, esi
jle 0x1018ec08
add eax, dword [esp + 0x20]
push dword [esp + 0x1c]
movzx eax, ax
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x1018ec10
push eax
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x1018ec10
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov dword [esp + 0x28], eax
test eax, eax
je 0x1018ec10
push dword [esp + 0x2c]
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x34], eax
push edi
call sub.msvcr100.dll_memcpy
add esp, 0xc
cmp esi, 1
jle 0x1018ebf7
mov eax, dword [ebp]
mov ecx, dword [esp + 0x18]
mov dword [eax + ecx*4], edi
mov eax, dword [esp + 0x18]
add edi, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x18], eax
cmp eax, esi
jl 0x1018eb95
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x1018ec31
cmp dword [ebp], esi
je 0x1018ec31
push dword [ebp]
call dword [sym.imp.msvcr100.dll_free]
and dword [ebp], esi
pop ecx
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
pop ecx
ret 0x18
Function at 0x1018eec6
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x118], eax
and dword [esp], 0
push ebx
mov ebx, dword [esp + 0x128]
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x134]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.1015692e
cmp dword [esp + 0xc], 0
je 0x1018f0b3
push ebp
mov ebp, 0x10c
push ebp
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push 0x82e
call fcn.1015692e
test eax, eax
jle 0x1018ef58
push edi
lea eax, [esp + 0x20]
push eax
call fcn.1018e3b0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1015692e
test eax, eax
je 0x1018ef58
mov eax, dword [0x1023a228]
push dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x1018f0b2
push esi
call dword [sym.imp.ole32.dll_CoIsOle1Class]
test eax, eax
je 0x1018efeb
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
je 0x1018ef89
mov dword [esp + 0x14], ebx
mov ecx, dword [0x1023a228]
push dword [esp + 0x10]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x14]
test esi, esi
jne 0x1018f0a5
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push str.protocolStdFileEditing_server
push dword [esp + 0x20]
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1018f0a5
push edi
push esi
lea eax, [esp + 0x24]
push eax
call fcn.1018e6f8
test eax, eax
je 0x1018f0a5
jmp 0x1018f0b2
mov eax, dword [0x1023a228]
push dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push 0x1018f0d0
mov dword [esp + 0x1c], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push ebx
call ebp
test eax, eax
jne 0x1018f034
push edi
lea eax, [esp + 0x20]
push eax
call fcn.1018e3b0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1015692e
test eax, eax
jne 0x1018f0b2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push str.DefaultIcon
push ebx
mov dword [esp + 0x20], 0x10c
call ebp
test eax, eax
jne 0x1018f06c
push edi
lea eax, [esp + 0x20]
push eax
call fcn.1018e3b0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1018e6f8
test eax, eax
jne 0x1018f0b2
xor esi, esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0x1018f0e0]
mov dword [esp + 0x1c], 0x10c
push ebx
call ebp
test eax, eax
jne 0x1018f09d
push edi
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1018e6f8
test eax, eax
jne 0x1018f0b2
add esi, 4
cmp esi, 0x10
jb 0x1018f06e
push edi
push 0
push 0x1018f0f0
call fcn.1018e6f8
pop ebp
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x11c
ret 0xc
Function at 0x10190993
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
xor edi, edi
push edi
push edi
push 0x188
push dword [0x1023a404]
mov esi, edi
mov ebx, edi
call ebp
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x101909c5
mov edi, 0x1023af04
jmp 0x10190a24
push edi
push eax
push 0x18a
push dword [0x1023a404]
call ebp
lea ebx, [eax + 1]
push ebx
call dword [sym.imp.msvcr100.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x101909f1
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.1018fe5d
push esi
push dword [esp + 0x14]
mov edi, esi
push 0x189
push dword [0x1023a404]
call ebp
mov eax, dword [0x10239898]
cmp eax, 1
je 0x10190a24
cmp eax, 0xd
je 0x10190a24
cmp eax, 0x21
je 0x10190a24
cmp byte [esi], 0x20
jne 0x10190a24
inc edi
cmp byte [edi], 0x20
je 0x10190a1e
push edi
push dword [0x1023a3dc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
push 0
push 0xb1
push dword [0x1023a3dc]
call ebp
push 0
push 1
push 0xb9
push dword [0x1023a3dc]
call ebp
push ebx
push edi
push dword [0x1023a3dc]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test esi, esi
je 0x10190a6c
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10193473
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x54
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [esp + 0x68]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push 0x14
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0x14b
push edi
call ebx
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
call sub.msvcr100.dll_memset
mov al, byte [esp + 0x7c]
push esi
mov byte [esp + 0x37], al
lea eax, [esp + 0x3c]
push 0x20
push eax
call dword [sym.imp.msvcr100.dll_strcpy_s]
add esp, 0x18
xor esi, esi
push esi
push edi
push 0x10193424
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExA]
lea eax, [esp + 0x4c]
push eax
push 0xffffffffffffffff
push 0x158
push edi
call ebx
push esi
cmp eax, 0xffffffff
je 0x1019350a
push eax
jmp 0x1019350b
push esi
push 0x14e
push edi
call ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x54
ret 0xc
Function at 0x10194abf
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi], 0x1002f2c0
cmp dword [esi + 0x18], edi
je 0x10194ae0
cmp dword [esi + 0x1c], edi
je 0x10194ae0
push dword [esi + 0x18]
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp dword [esi + 0xc], edi
je 0x10194af0
push dword [esi + 0xc]
call fcn.1007de95
mov dword [esi + 0xc], edi
cmp dword [esi + 0x10], edi
je 0x10194b00
push dword [esi + 0x10]
call fcn.1007de95
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], edi
je 0x10194b11
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [esi + 0x14], edi
cmp dword [esi + 0x18], edi
je 0x10194b23
push dword [esi + 0x18]
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov dword [esi + 0x18], edi
cmp dword [esi + 0x20], edi
je 0x10194b34
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_GlobalFree]
mov dword [esi + 0x20], edi
pop edi
mov dword [esi + 0x28], 0x1001ab3c
pop esi
ret
Function at 0x10195738
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x180
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x17c], eax
mov eax, dword [esp + 0x184]
push ebx
push ebp
mov ebp, dword [esp + 0x194]
push edi
mov edi, dword [esp + 0x194]
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], ebx
call fcn.1000e7de
lea ecx, [esp + 0x10]
call fcn.1000e7de
lea eax, [esp + 0x20]
push eax
call fcn.100fc516
lea ecx, [esp + 0x10]
test eax, eax
jne 0x101957a7
call fcn.1001b92f
lea ecx, [esp + 0x20]
call fcn.1001b92f
xor eax, eax
jmp 0x1019594f
push ebp
push edi
call fcn.10157fe5
test eax, eax
je 0x1019593b
push esi
push ebx
push 0x1014c854
lea ecx, [esp + 0x1c]
call fcn.10158468
push 0x58
pop esi
push esi
lea eax, [esp + 0x34]
push ebx
push eax
mov dword [0x10240bf8], 1
call sub.msvcr100.dll_memset
add esp, 0xc
mov ecx, ebp
mov dword [esp + 0x30], esi
call fcn.1015692e
lea ecx, [esp + 0x14]
mov dword [esp + 0x5c], eax
call fcn.1001b16d
push eax
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea eax, [esp + 0x88]
push 0x72
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0x104
call fcn.1000e3fc
push 0x74
mov dword [esp + 0x64], eax
call fcn.1000e3fc
mov ecx, dword [0x1023a24c]
mov dword [esp + 0x3c], eax
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0xfc5
mov dword [esp + 0x78], eax
mov eax, dword [0x1023a220]
mov dword [esp + 0x38], eax
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0x80000
or eax, 0x200866
mov dword [esp + 0x48], 2
mov dword [esp + 0x6c], 0x1014c854
mov dword [esp + 0x74], 0x10195bd5
mov dword [esp + 0x70], ebx
mov dword [esp + 0x64], eax
test ecx, ecx
je 0x1019588e
or eax, 0x10
mov dword [esp + 0x64], eax
call fcn.100dbf34
test eax, eax
je 0x1019589e
mov esi, ebx
jmp 0x1019592f
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x10240c78]
call fcn.100dba52
mov esi, eax
call dword [0x10240c74]
test esi, esi
jne 0x101958dc
cmp eax, 0x3002
jne 0x1019592f
cmp dword [esp + 0x10], ebx
jne 0x1019592f
mov eax, dword [esp + 0x4c]
mov byte [eax], bl
mov dword [esp + 0x10], 1
jmp 0x1019589e
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 0xfc
jle 0x101958f8
mov byte [esp + 0x184], bl
lea eax, [esp + 0x88]
push eax
mov ecx, edi
call fcn.100dcd86
test eax, eax
je 0x1019592f
push dword [esp + 0x4c]
mov ecx, dword [esp + 0x24]
call fcn.10162a52
cmp dword [0x10240bf8], ebx
je 0x1019592f
mov ecx, edi
call fcn.1015692e
push eax
mov ecx, ebp
call fcn.1001b0b5
lea ecx, [esp + 0x24]
call fcn.100da84b
mov ebx, esi
pop esi
lea ecx, [esp + 0x10]
call fcn.1001b92f
lea ecx, [esp + 0x20]
call fcn.1001b92f
mov eax, ebx
mov ecx, dword [esp + 0x188]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x180
ret 0xc
Function at 0x1019b840
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x1d0]
sub esp, 0x250
mov eax, dword [0x1023904c]
xor eax, ebp
mov dword [ebp + 0x1cc], eax
push ebx
push edi
mov edi, dword [ebp + 0x1d8]
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
push 0x1ab
push 0x800ac43f
mov ebx, eax
call fcn.10156307
test eax, eax
je 0x1019b943
push esi
lea ecx, [ebp - 0x80]
call fcn.1000e7de
push 0x104
lea eax, [ebp + 0xc8]
push eax
call fcn.1015692e
mov esi, eax
lea ecx, [ebp - 0x80]
test esi, esi
js 0x1019b925
lea eax, [ebp + 0xc8]
push eax
call fcn.100dcd86
push 0x1001
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.100cbafb
mov esi, eax
test esi, esi
js 0x1019b922
push 0
push ebx
push edi
push dword [ebp - 0x74]
call fcn.1015692e
mov esi, eax
test esi, esi
js 0x1019b922
push dword [ebp - 0x74]
call fcn.100dc9ac
lea eax, [ebp + 0xc8]
push eax
mov edi, 0x1019b95c
push edi
lea eax, [ebp - 0x70]
push 0x1014c458
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 1
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_WinExec]
cmp eax, 0x1f
ja 0x1019b932
push edi
mov esi, 0x800a0035
push esi
call fcn.100d93ec
lea ecx, [ebp - 0x80]
call fcn.1001b92f
push esi
call fcn.100dae9d
jmp 0x1019b942
push dword [ebp - 0x74]
call fcn.10157a49
lea ecx, [ebp - 0x80]
call fcn.1001b92f
pop esi
mov ecx, dword [ebp + 0x1cc]
pop edi
xor ecx, ebp
pop ebx
call fcn.10001e57
add ebp, 0x1d0
leave
ret 4

Function at 0x1019e001
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x134
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
mov ebp, dword [esp + 0x144]
push esi
mov esi, dword [esp + 0x144]
push 0x28
lea eax, [esp + 0x14]
push eax
lea eax, [ecx + 0x10]
push eax
xor ebx, ebx
call fcn.1015692e
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push 0x1014cbd0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x3c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1019e0d6
lea eax, [esp + 0x148]
push eax
push esi
push 0x1019e0f4
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x1019e0c9
lea eax, [esp + 0x148]
push eax
push esi
push str.InprocServer32
push dword [esp + 0x18]
mov dword [esp + 0x158], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x1019e0cc
push 0x5c
push esi
call fcn.100cb41b
test eax, eax
je 0x1019e0c9
mov esi, eax
push 0x5c
inc eax
push eax
call fcn.100cb41b
test eax, eax
jne 0x1019e0b4
test esi, esi
je 0x1019e0c9
mov byte [esi], bl
xor ebx, ebx
inc ebx
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x13c]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x134
ret 8