joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e4a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b2810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, str.NETCAKeyXPluginCertAppCertManagerPlugin_
lea edi, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.1001c0b0
push str.CertManagerPlugin.ini
mov eax, edi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x3c], 1
call fcn.1001c820
mov bl, 2
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x48]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IsShowNotifyNoDeviceCertExpireWnd
call fcn.10003840
push ecx
mov byte [esp + 0x3c], 4
mov ecx, esp
mov dword [esp + 0x30], esp
push str.NotifyWndSetting
call fcn.10003840
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x3c], bl
call fcn.10005c80
mov eax, dword [esp + 0x3c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x3c], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.IsShowNotifyNoDeviceCertExpireWnd
call fcn.10003840
push ecx
mov byte [esp + 0x3c], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.NotifyWndSetting
call fcn.10003840
mov byte [esp + 0x3c], 7
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0x40], bl
call fcn.10005a40
mov bl, al
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001e5e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001e606
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001e62e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8
Function at 0x1001f0d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x100b27b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, str.NETCAKeyXPluginCertAppCertManagerPluginNoDeviceForbidNotifyCert_
lea edi, [esp + 0x10]
mov dword [esp + 0x10], ebx
call fcn.1001c0b0
push 0x100c4138
mov eax, edi
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x28], ebx
call fcn.1001c820
add esp, 0xc
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], ebx
jg 0x1001f13e
push 0x100c0a60
mov ecx, esi
call fcn.10003840
jmp 0x1001f16b
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, ebx
jne 0x1001f156
mov ecx, dword [esp + 0xc]
push ebx
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.10008580
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001f18f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001f1b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x1001f9b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b1163
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.1003cdd0
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.1003cdd0
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.1003cdd0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x100212a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100b1f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x100e3f88]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [0x100e3f88]
xor eax, esp
push eax
lea eax, [esp + 0x20c]
mov dword fs:[0], eax
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x12]
mov dword [esp + 0xc], 0
push ecx
mov word [esp + 0x14], ax
call fcn.10091ac0
add esp, 0xc
cmp word [esp + 8], 0
jne 0x10021326
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x10021326
push 0x100c0a60
mov ecx, esi
call fcn.10003840
jmp 0x1002138f
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
call fcn.10003840
push 7
push str.NETCA_
lea ecx, [esp + 0xc]
mov dword [esp + 0x21c], 0
call fcn.1000c290
mov eax, dword [esp + 4]
add eax, 0xfffffff0
push eax
call fcn.10008580
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x218], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002138f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.1008e4a2
add esp, 0x214
ret
Function at 0x10025bf0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x10025c08
mov esi, 8
push 2
call edi
test ax, ax
jge 0x10025c14
or esi, 1
push 1
call edi
test ax, ax
jge 0x10025c20
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x10025c2c
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x10025c38
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret

Function at 0x10027720
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x2a8], esi
jle 0x10027776
jmp 0x10027740
mov eax, dword [edi + 0x2a4]
mov byte [esp + 0x13], 0
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x13]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
call edx
cmp byte [esp + 0x13], 0
jne 0x100278ee
inc esi
cmp esi, dword [edi + 0x2a8]
jl 0x10027740
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x10027873
sub eax, 4
je 0x100277f5
sub eax, 2
jne 0x10027868
xor ecx, ecx
push ebx
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
call fcn.100907cf
mov ecx, dword [edi + 0x1f0]
add esp, 4
mov word [esp + 0x14], ax
mov edx, dword [ecx]
mov edx, dword [edx + 0x120]
push 0x80000012
lea eax, [esp + 0x18]
push eax
push 0x1002c530
call edx
mov esi, eax
test esi, esi
je 0x10027868
mov eax, dword [esi]
mov edx, dword [eax + 0x114]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 0x1f4], 0
je 0x10027868
mov ecx, dword [edi + 0x208]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0x204]
mov dword [esp + 0x18], 6
mov word [esp + 0x2c], bx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call fcn.10025bf0
mov word [esp + 0x2e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [edi + 0x1f4]
mov dword [esp + 0x20], eax
mov edx, dword [edi]
mov edx, dword [edx + 0x12c]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call edx
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, 9
jne 0x10027868
cmp dword [edi + 0x1f4], 0
je 0x100278d7
mov ecx, dword [edi + 0x1f4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xec]
call edx
test al, al
je 0x100278d7
mov ecx, dword [edi + 0x1f4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf8]
call edx
test al, al
je 0x100278d7
mov ecx, dword [edi + 0x1f4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push str.RichEditUI
call edx
push eax
call fcn.1008ef00
add esp, 8
test eax, eax
je 0x100278d7
mov eax, dword [edi + 0x1f4]
cmp byte [eax + 0x609], 0
jne 0x10027868
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge cl
movzx edx, cl
push edx
call fcn.1002ab60
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002a610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xb4]
cmp eax, ecx
je 0x1002a63c
cmp esi, dword [edi + 0x1f4]
je 0x1002a63c
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x1f4]
cmp esi, eax
je 0x1002a753
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x1002a6b9
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x1f4]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x12c]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [edi + 0x1f4]
push 0
push 0
push 0
push str.killfocus
call fcn.1002ae50
mov dword [edi + 0x1f4], 0
test esi, esi
je 0x1002a753
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
cmp eax, edi
jne 0x1002a753
mov edx, dword [esi]
mov eax, dword [edx + 0xec]
mov ecx, esi
call eax
test al, al
je 0x1002a753
mov edx, dword [esi]
mov eax, dword [edx + 0xf8]
mov ecx, esi
call eax
test al, al
je 0x1002a753
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edi + 0x1f4], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x1f4]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x12c]
lea eax, [esp + 8]
push eax
call edx
mov ecx, dword [edi + 0x1f4]
push 0
push 0
push 0
push str.setfocus
call fcn.1002ae50
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002e180
Capabilities:
Encrypt data using speck

Disassembly:
shl cl, 1
cmp ah, 0xf1
rol cl, cl
and dh, cl
mov cl, byte [eax + edi]
sub al, dl
sar dh, 2
sub dh, 9
cmp cl, cl
add cl, cl
jmp 0x1002f895
jae 0x10062036
dec eax
mov ebx, ecx
mov bh, 0xcf
setl ch
setbe cl
pop ebx
bswap cx
pop ecx
jmp 0x1006d737
not eax
setb dh
jmp 0x1003157e
jmp 0x1006b468
je 0x1005e96e
movzx ax, al
movsx ax, bl
movzx eax, cl
movsx eax, dl
dec eax
lea eax, [ebx + edx*4]
jmp 0x1006dff9
call fcn.1006bdc2
jmp 0x100656c9
dec eax
lea eax, [0x26bc747b]
dec eax
movsx eax, cl
setle al
dec eax
lea eax, [ebx + edx*4 + 0x400]
jmp 0x100310ee
call fcn.1006bdc2
jmp 0x1006b3a0
adc dl, dl
jmp 0x1002fd7b
jmp 0x1006c4a6
jb 0x1005ef25
clc
stc
xor dh, dl
test bp, 0x41b4
test dh, 1
setbe dh
mov dh, cl
mov dh, 0
jmp 0x10030d7d
adc dl, dl
jmp 0x1006d538
jmp 0x1002f3c2
jmp 0x1006defc
mov byte [ebp - 2], dl
jmp 0x1005ef3e
jmp 0x10032b07
Function at 0x1002e240
Capabilities:
Encrypt data using speck

Disassembly:
sbb cl, dh
inc dh
bt si, 0xd
dec eax
not eax
rol dh, 2
mov cl, byte [eax + edi]
bsf eax, eax
xadd al, dh
rol dh, 3
neg eax
add cl, cl
bswap eax
xchg dh, ah
dec eax
lea eax, [edx*2 - 0x2d171aaa]
xchg al, dh
setb dh
not ah
dec eax
bswap eax
jmp 0x1006544a
adc dl, dl
jmp 0x10030743
jmp 0x1006dfed
dec eax
bt eax, eax
test dh, 1
mov dh, 0x64
mov dh, 0
jmp 0x1005e226
je 0x1005e96e
mov al, 0xe3
dec eax
lea eax, [ebx + edx*4]
jmp 0x10062041
jmp 0x10031b11
call fcn.1006bdc2
jmp 0x1006b662
cmp al, dh
xor dh, dl
jmp 0x1006b135
movsx ax, cl
dec eax
lea eax, [ebx + edx*4 + 0x400]
jmp 0x1005e66f
jmp 0x100316e7
jmp 0x1002f905
jb 0x1005ef25
stc
jmp 0x1005f893

Function at 0x1002f4a0
Capabilities:
Authenticate hmac
Encrypt data using speck
Parse pe header

Disassembly:
std
movzx cx, cl
mov ecx, 0x3d36
dec eax
lea esi, [esi*4 - 0x75c30ce5]
mov si, ax
dec eax
lea esi, [edi*4 + 0x6b4c9de7]
mov eax, 0x400
not esi
not si
mov si, 0x5142
dec eax
lea edi, [ebp*2 - 0x5d03da39]
dec eax
mov edi, ebx
jmp 0x1005ea0b
sal di, 0xe
jmp 0x1006b16a
movsx esi, bl
movzx si, dl
rep stosd dword es:[edi], eax
jmp 0x1006df79
dec di
inc al
jmp 0x10030a9c
movzx edi, al
neg al
setp cl
ror di, cl
sal cl, 1
movzx cx, cl
xor eax, eax
dec eax
not ecx
mov edi, eax
setb al
mov ecx, 4
movsx si, bl
movsx ecx, cl
dec eax
mov esi, dword [ebp + 0x10]
movsx cx, cl
lodsb al, byte [esi]
xchg di, cx
mov edi, esp
movzx ecx, cl
inc ch
inc al
sar di, 6
neg al
movzx cx, cl
jmp 0x1006aa86

Function at 0x10030060
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov ebx, eax
shrd dx, si, cl
mov edx, 1
cmp edx, 0xe715560f
stc
stc
cmp ecx, 7
jmp 0x1006aa90
movzx eax, byte [ebp - 2]
shld edx, esi, 0x1d
dec eax
movzx edx, bl
not dh
shr eax, 5
bswap dx
clc
imul eax, eax, 0x300
xor dl, ch
bsf dx, si
dec eax
lea eax, [ebx + eax*4 + 0x94d8]
xor dl, bl
bt edi, eax
mov dx, si
push ecx
sar dh, cl
shrd dx, si, 4
sal dx, cl
push ebx
jmp 0x1002fb93
and cl, bl
sbb dh, ah
sar dh, cl
mov cl, byte [eax + edi]
jb 0x10062036
rcr dh, 1
mov eax, dword [ebp - 0x20]
xor cl, 0xe9
dec eax
not eax
jmp 0x1005e965

Function at 0x10032140
Capabilities:
Encrypt data using speck

Disassembly:
mov byte [ebp - 2], dl
jmp 0x1005ef3e
adc dl, dl
jmp 0x10062cfe
sub cl, al
add al, byte [eax]
dec eax
lea eax, [0x90d58991]
bswap eax
movzx eax, bl
dec eax
lea eax, [ebx + edx*4]
jmp 0x1006c6a7
jae 0x10062036
mov bh, 0xa1
xchg ch, bl
movsx bx, al
setns bl
pop ebx
bswap cx
pop ecx
jmp 0x1006287f
jmp 0x1002facb
jmp 0x1005e8f8
call fcn.1006bdc2
jmp 0x1006ce0f
jmp 0x1006b13a
jmp 0x10030d6f

Function at 0x10032200
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x10031b6f
jmp 0x1005f302
mov byte [ebp - 2], dl
jmp 0x1005ef3e
lea eax, [ebx + edx*4]
jmp 0x1006dcf9
jmp 0x100621e3
call fcn.1006bdc2
jmp 0x10031273
adc dl, dl
jmp 0x10032fa9
dec eax
lea ecx, [edx - 0x2316b7b7]
movzx bx, cl
setae bh
pop ebx
movzx cx, cl
mov cl, 0x25
pop ecx
jmp 0x1002fe04
jae 0x10062036
jmp 0x10062175
jmp 0x1005e3a6
Function at 0x1007be60
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100e3f88]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
lea eax, [ebx - 0x21]
cmp eax, 0xd
ja case.0x1007bea3.41
movzx eax, byte [eax + 0x1007bf28]
jmp dword [eax*4 + 0x1007bf20]
or edi, 0x100
cmp dword [esp + 0x220], 0
je 0x1007bec0
or edi, 0x1000000
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], cx
call fcn.10091ac0
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
shl edi, 0x10
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [esi + 4]
push 0xffffffffffffffff
lea edx, [esp + 0x10]
xor ecx, ecx
push edx
mov dword [esi], eax
mov word [eax], cx
call fcn.1002d9f0
mov ecx, dword [esp + 0x214]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1008e4a2
add esp, 0x20c
ret 8

Function at 0x1007beaa
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100e3f88]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
lea eax, [ebx - 0x21]
cmp eax, 0xd
ja case.0x1007bea3.41
movzx eax, byte [eax + 0x1007bf28]
jmp dword [eax*4 + 0x1007bf20]
or edi, 0x100
cmp dword [esp + 0x220], 0
je 0x1007bec0
or edi, 0x1000000
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], cx
call fcn.10091ac0
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
shl edi, 0x10
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [esi + 4]
push 0xffffffffffffffff
lea edx, [esp + 0x10]
xor ecx, ecx
push edx
mov dword [esi], eax
mov word [eax], cx
call fcn.1002d9f0
mov ecx, dword [esp + 0x214]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1008e4a2
add esp, 0x20c
ret 8

Function at 0x10086cea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10086d31
call fcn.100816eb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10086d31
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10086d4d
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10086862
mov esi, eax
test edi, edi
je 0x10086d4b
test ebx, ebx
je 0x10086d4b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1008e4a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100e3f88]
jne 0x1008e4ac
repz ret
jmp fcn.1009433f
Function at 0x100a1441
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100944b7
and dword [ebp - 4], 0
cmp dword [0x100eb7cc], 0
mov ebx, eax
jne 0x100a14f2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100a15a3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100a15a3
push eax
call fcn.10094445
mov dword [esp], 0x100bed00
push edi
mov dword [0x100eb7cc], eax
call esi
push eax
call fcn.10094445
mov dword [esp], 0x100becec
push edi
mov dword [0x100eb7d0], eax
call esi
push eax
call fcn.10094445
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100eb7d4], eax
call esi
push eax
call fcn.10094445
pop ecx
mov dword [0x100eb7dc], eax
test eax, eax
je 0x100a14f2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10094445
pop ecx
mov dword [0x100eb7d8], eax
mov eax, dword [0x100eb7d8]
cmp eax, ebx
je 0x100a154a
cmp dword [0x100eb7dc], ebx
je 0x100a154a
push eax
call fcn.100944c0
push dword [0x100eb7dc]
mov esi, eax
call fcn.100944c0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100a154a
test edi, edi
je 0x100a154a
call esi
test eax, eax
je 0x100a1541
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100a1541
test byte [ebp - 0xc], 1
jne 0x100a154a
or dword [ebp + 0x10], 0x200000
jmp 0x100a1583
mov eax, dword [0x100eb7d0]
cmp eax, ebx
je 0x100a1583
push eax
call fcn.100944c0
pop ecx
test eax, eax
je 0x100a1583
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100a1583
mov eax, dword [0x100eb7d4]
cmp eax, ebx
je 0x100a1583
push eax
call fcn.100944c0
pop ecx
test eax, eax
je 0x100a1583
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100eb7cc]
call fcn.100944c0
pop ecx
test eax, eax
je 0x100a15a3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100a15a5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6476103b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x59c]
sub esp, 0x61c
mov eax, dword [0x6478b104]
xor eax, ebp
cmp dword [ebp + 0x5a8], 1
push esi
mov dword [ebp + 0x598], eax
mov eax, dword [ebp + 0x5a4]
push edi
jne 0x647611b1
push eax
mov edi, 0x6478b238
push edi
call sub.MFC71U.DLL_AfxHtmlHelp
test eax, eax
je 0x647611de
push 0x40
call sub.MFC71U.DLL_CWordArray::CWordArray
xor esi, esi
cmp eax, esi
pop ecx
je 0x64761096
push esi
push edi
mov ecx, eax
call sub.MFC71U.DLL_CDWordArray::CDWordArray
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push 4
pop eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x74]
push eax
mov ebx, 0x20019
push ebx
push esi
push str.SOFTWAREMITSUBISHISWnDN_GPPW2App
push 0x80000001
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], 0x4e4
call edi
test eax, eax
je 0x647610e1
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push str.SOFTWAREMITSUBISHISWnDN_GPPW2StartupApp
push 0x80000002
call edi
test eax, eax
jne 0x64761112
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push str.CodePage
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x64761112
mov dword [ebp - 0x78], 0x4e4
push 0x7f
pop ecx
xor eax, eax
mov word [ebp + 0x190], si
lea edi, [ebp + 0x192]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp + 0x390], si
mov ecx, 0x81
lea edi, [ebp + 0x392]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp + 0x390]
push eax
push dword [0x6478b23c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7f
pop ecx
xor eax, eax
mov word [ebp - 0x70], si
lea edi, [ebp - 0x6e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x70]
push eax
push esi
lea eax, [ebp + 0x390]
push esi
push eax
call dword [sym.imp.MSVCR71.dll__wsplitpath]
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push 0x6477b4d0
lea eax, [ebp + 0x190]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x28
lea eax, [ebp + 0x190]
push eax
call sub.MFC71U.DLL_AfxLoadLangResourceDLL
mov dword [0x6478b24c], eax
pop ebx
jmp 0x647611db
xor esi, esi
cmp dword [ebp + 0x5a8], esi
jne 0x647611db
mov eax, dword [0x6478b24c]
cmp eax, esi
je 0x647611d0
push eax
call sub.MFC71U.DLL_AfxFormatStrings
mov dword [0x6478b24c], esi
push esi
push 0x6478b238
call sub.MFC71U.DLL_AfxStringFromCLSID
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x598]
pop edi
xor ecx, ebp
pop esi
call fcn.64773f51
add ebp, 0x59c
leave
ret 0xc
Function at 0x64774461
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x6478b104]
xor eax, ebp
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.64774431
mov eax, 0x64760000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR71.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x647744c5
cmp dword [ebp - 0x1c], 5
jb 0x647744dd
jmp 0x647744d9
cmp dword [ebp - 0x10], 1
jne 0x647744dd
cmp dword [ebp - 0x1c], 4
ja 0x647744d9
jne 0x647744dd
cmp dword [ebp - 0x18], 0
jbe 0x647744dd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x6478286c
call fcn.64773ed0
test eax, eax
jge 0x647744fe
mov byte [0x6478b800], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.64773f51
add ebp, 0x78
leave
ret