joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106609a
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1072ca8]
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ecx
cmp eax, 0xffffffff
je 0x10660de
cmp eax, ebx
je 0x106625c
cmp ecx, ebx
je 0x106625c
mov dx, word [0x1074c50]
mov word [ecx], dx
jmp 0x106625c
push esi
push edi
mov dword [0x1072ca8], ebx
call fcn.01066049
xor esi, esi
inc esi
mov word [0x1074c50], ax
cmp ax, bx
je 0x1066125
push 0x10
lea ecx, [ebp - 0x30]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10661f0
test dword [ebp - 0x22], 0x800
je 0x10661f0
jmp 0x10661ea
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10661f0
xor eax, eax
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push 0x100e02c
push 0x80000001
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10661f0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x34]
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x10]
lea edx, [ebp - 0x10]
xor eax, eax
jmp 0x10661d2
shl eax, 4
cmp cl, 0x30
jl 0x10661ab
cmp cl, 0x39
jg 0x10661ab
movsx ecx, cl
lea eax, [eax + ecx - 0x30]
jmp 0x10661cf
cmp cl, 0x41
jl 0x10661be
cmp cl, 0x46
jg 0x10661be
movsx ecx, cl
lea eax, [eax + ecx - 0x37]
jmp 0x10661cf
cmp cl, 0x61
jl 0x10661cf
cmp cl, 0x66
jg 0x10661cf
movsx ecx, cl
lea eax, [eax + ecx - 0x57]
inc edx
mov cl, byte [edx]
cmp cl, bl
jne 0x1066195
and eax, 0x3ff
cmp eax, esi
je 0x10661e4
cmp eax, 0xd
jne 0x10661f0
mov word [0x1074c50], ax
mov dword [0x1072ca8], esi
mov eax, dword [0x1072ca8]
cmp eax, ebx
jne 0x1066249
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x100e01c
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1066240
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x400000
je 0x1066239
mov dword [0x1072ca8], esi
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x1072ca8]
cmp eax, ebx
je 0x106625a
mov ecx, dword [ebp - 0x38]
cmp ecx, ebx
je 0x106625a
mov dx, word [0x1074c50]
mov word [ecx], dx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 4
Function at 0x1066270
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20006
push ebx
push 0
push 0x100e1e0
mov edi, 0x80000002
push edi
call esi
test eax, eax
jne 0x10662b7
push 0x1004b3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x100e170
push edi
call esi
test eax, eax
jne 0x10662e1
push 0x1004b3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x100e0f8
push edi
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x106630e
push 0x1004b3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x10663b7
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1072c98]
cmp eax, 0x1072c98
je 0x10663e8
test byte [eax + 0x3c], 2
je 0x10663e8
cmp byte [eax + 0x39], 7
jb 0x10663e8
push 0x100e0e4
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0105e5ad
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 8]
push eax
push 0x102ed4c
push 1
push 0
push 0x1010438
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
mov eax, dword [ebp - 8]
test esi, esi
jl 0x1066486
and dword [ebp - 4], 0
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x1010448
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jl 0x1066476
mov eax, dword [ebp - 4]
cmp esi, 1
jne 0x106644f
test eax, eax
je 0x106643b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x1066448
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x1066492
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jl 0x1066476
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01066315
mov esi, eax
test esi, esi
jl 0x1066471
cmp esi, 1
jne 0x1066476
mov esi, 0x80004002
mov eax, dword [ebp - 4]
test eax, eax
je 0x1066483
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x1066490
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
leave
ret 4
Function at 0x106671c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 8], 3
mov ecx, dword [ebp - 4]
jne 0x1066756
cmp ecx, edi
jne 0x1066756
push 2
pop eax
cmp eax, edi
jne 0x106678e
shr ecx, 1
push ecx
call fcn.0106d507
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, edi
je 0x106678e
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x10], ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1066788
mov al, 1
jmp 0x1066790
push ebx
call fcn.0106d531
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10668bd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106690f
push edi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
jmp 0x1066911
xor al, al
pop esi
leave
ret 0xc

Function at 0x1066e96
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1010c88]
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1010c8c]
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_towupper]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
movzx esi, ax
pop ecx
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], si
call edi
cmp eax, 5
jne 0x1066f05
and dword [ebp - 0x10], 0
push 0x41
pop ebx
mov eax, ebx
cmp ax, si
jae 0x1066f09
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], bx
call edi
cmp eax, 5
jne 0x1066efd
inc dword [ebp - 0x10]
inc ebx
cmp bx, si
jb 0x1066eeb
jmp 0x1066f09
or dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 4

Function at 0x1066fdf
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x60], 0xffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x1067005
call edi
sub eax, dword [esi + 0x64]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1388
jbe 0x1067016
push dword [ebp + 8]
push esi
call fcn.0106b43a
mov dword [esi + 0x60], eax
call edi
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
pop edi
pop esi
pop ebp
ret 4
Function at 0x1068060
Capabilities:
Check os version
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x40]
call fcn.0106d68a
xor ebx, ebx
cmp esi, ebx
je 0x1068217
movzx eax, word [esi]
cmp ax, 0x41
jb 0x10680a4
cmp ax, 0x5a
ja 0x10680a4
movzx edi, ax
sub edi, 0x40
jmp 0x10680aa
movzx edi, ax
sub edi, 0x60
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jge 0x106813f
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push ebx
push 0x1010da0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x10681e2
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x34]
push ecx
push 0x1c
lea ecx, [ebp - 0x5c]
push ecx
push 0x1c
push ecx
inc esi
push esi
push eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x860
mov dword [ebp - 0x50], 0x440d
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x106812e
test byte [ebp - 0x44], 1
jne case.default.0x106812e
movzx eax, byte [ebp - 0x2b]
cmp eax, 9
ja case.default.0x106812e
jmp dword [eax*4 + 0x106823c]
mov esi, 0x320
jmp case.0x106812e.5
lea eax, [edi + 0x40]
push eax
lea eax, [ebp - 0x40]
push 0x1010d90
push eax
call fcn.0106e1de
add esp, 0xc
test eax, eax
jl 0x10681e0
push ebx
push ebx
push 3
push ebx
push 2
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x10681e6
push ebx
lea ecx, [ebp - 0x34]
push ecx
push 0x1e0
lea ecx, [ebp - 0x23c]
push ecx
push ebx
push ebx
push 0x70c00
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x106812e
cmp dword [ebp - 0x34], ebx
jbe case.default.0x106812e
mov eax, dword [ebp - 0x234]
xor esi, esi
inc esi
cmp eax, esi
je case.0x106812e.0
jle case.default.0x106812e
cmp eax, 5
jle case.0x106812e.2
cmp eax, 0xa
jle case.0x106812e.0
cmp eax, 0xb
je case.0x106812e.6
cmp eax, 0xc
je case.0x106812e.5
xor esi, esi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10681e2
push 2
pop esi
jmp case.0x106812e.5
mov esi, 0x15e
jmp case.0x106812e.5
mov esi, 0x20d
jmp case.0x106812e.5
xor esi, esi
cmp esi, ebx
jne 0x1068219
add edi, 0x40
push edi
lea eax, [ebp - 0x40]
push 0x1010d84
push eax
call fcn.0106e1de
add esp, 0xc
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 2
pop esi
cmp eax, esi
je 0x1068219
cmp eax, 3
je 0x1068234
jbe 0x1068217
cmp eax, 6
jbe 0x1068219
xor esi, esi
lea ecx, [ebp - 0x40]
call fcn.0106de0a
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 4
xor esi, esi
inc esi
jmp 0x1068219
Function at 0x10684d7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.0106d68a
push 0x1010a98
mov ecx, esi
call fcn.01067646
test al, al
je 0x10685a2
push dword [esi + 0x28]
call fcn.0106e6e0
test al, al
je 0x106851b
mov dword [ebp - 4], 4
jmp 0x10685b9
mov eax, dword [esi + 0x28]
xor bl, bl
xor ecx, ecx
test eax, eax
je 0x106852c
cmp word [eax], cx
setne cl
test cl, cl
je 0x1068552
movzx cx, byte [eax]
cmp cx, word [eax]
jne 0x1068552
mov bl, byte [eax]
movzx eax, bl
mov al, byte [eax + 0x1074cf0]
test al, al
jbe 0x1068552
movzx eax, al
mov dword [ebp - 4], eax
test eax, eax
jne 0x10685b9
mov eax, dword [esi + 0x28]
push 3
push eax
lea ecx, [ebp - 0x10]
call fcn.0106de5c
test eax, eax
jl 0x10685b9
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], eax
cmp eax, 2
jne 0x1068594
push dword [ebp - 0x10]
mov ecx, esi
call fcn.01068060
cmp eax, 0x15e
je 0x106858d
cmp eax, 0x20d
jne 0x1068594
mov dword [ebp - 4], 0x80
mov cl, byte [ebp - 4]
movzx eax, bl
mov byte [eax + 0x1074cf0], cl
jmp 0x10685b9
push 0x1010ad0
mov ecx, esi
call fcn.01067646
test al, al
je 0x10685b9
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.0106de0a
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x106b078
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 0x80070005
call fcn.01068423
push dword [ebp + 8]
lea ecx, [ebp - 0x6c]
push 2
call fcn.0106981e
xor ebx, ebx
mov edi, 0x1074e18
mov esi, 0x80072af9
test eax, eax
jl 0x106b0f6
lea ecx, [ebp - 0x6c]
call fcn.010684d7
cmp eax, 4
jne 0x106b0f6
push 0x3e8
lea eax, [ebp - 0x6c]
push eax
call fcn.0106a9c1
mov dword [ebp - 4], eax
cmp byte [0x1074e10], bl
je 0x106b0f6
cmp eax, ebx
jl 0x106b0e6
lea eax, [ebp - 0x6c]
push eax
mov ecx, edi
call fcn.0106af8b
jmp 0x106b0f6
cmp eax, esi
jne 0x106b0f6
push esi
lea eax, [ebp - 0x6c]
push eax
mov ecx, edi
call fcn.0106af15
cmp dword [ebp - 4], ebx
jge 0x106b1b0
cmp dword [ebp - 4], esi
je 0x106b1b0
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 8]
push 0x106a1c9
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x106b1b0
mov ecx, 0x1074c98
call fcn.01069d7f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x106b1a9
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x106b1a9
mov eax, dword [0x1072c98]
cmp eax, 0x1072c98
je 0x106b17c
test byte [eax + 0x3c], 1
je 0x106b17c
cmp byte [eax + 0x39], 3
jb 0x106b17c
push dword [ebp - 4]
push 0x1011500
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01069de9
cmp dword [ebp - 4], ebx
je 0x106b18a
mov dword [ebp - 4], 0x80070005
jmp 0x106b1a9
cmp byte [0x1074e10], bl
je 0x106b1a9
lea ecx, [ebp - 0x6c]
call fcn.01068407
test al, al
jne 0x106b1a9
lea eax, [ebp - 0x6c]
push eax
mov ecx, edi
call fcn.0106af8b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x6c]
call fcn.0106ae90
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x106b1c9
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
movzx eax, byte [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1074c98
xor ebx, ebx
mov dword [ebp - 4], eax
call fcn.01069d63
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.0106a061
push dword [ebp + 8]
lea edi, [esi + 0x2c]
push edi
mov ecx, esi
call fcn.0106ac49
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x106b23a
push eax
mov ecx, edi
call fcn.0106a0f8
lea edi, [eax + 0x208]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jae 0x106b26b
push dword [ebp + 0xc]
lea ecx, [esi + 0x2c]
call fcn.0106a0f8
mov ebx, dword [eax + 0x20c]
jmp 0x106b272
push dword [ebp + 8]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call fcn.0106ac49
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x106b272
push eax
mov ecx, edi
call fcn.0106a0f8
lea edi, [eax + 0x208]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jb 0x106b272
mov dword [ebp - 4], 1
mov ecx, esi
call fcn.0106a07e
cmp dword [ebp - 4], 0
je 0x106b3be
test ebx, ebx
jl 0x106b3be
lea ecx, [ebp - 0x10]
call fcn.0106d68a
lea ecx, [ebp - 0x88]
call fcn.01068423
lea ecx, [ebp - 0x20]
call fcn.0106d68a
push dword [ebp + 8]
lea ecx, [ebp - 0x88]
call fcn.01069d0c
push 0x1001e44
lea ecx, [ebp - 0x88]
call fcn.01069263
mov ebx, eax
test ebx, ebx
jl 0x106b3a3
lea eax, [ebp - 0x10]
push eax
push 0xa
lea ecx, [ebp - 0x88]
call fcn.010691b0
mov ebx, eax
test ebx, ebx
jl 0x106b3a3
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x88]
call fcn.01067605
mov ebx, eax
test ebx, ebx
jl 0x106b3a3
mov ecx, dword [ebp - 0x10]
xor eax, eax
test ecx, ecx
je 0x106b311
cmp word [ecx], ax
setne al
test al, al
je 0x106b343
lea ecx, [ebp - 0x10]
call fcn.0106d755
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x20]
dec eax
lea edi, [ecx + eax*2]
call fcn.0106e5f5
cmp word [edi], ax
jne 0x106b343
lea ecx, [ebp - 0x10]
call fcn.0106d755
mov edx, dword [ebp - 0x10]
dec eax
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x10]
call fcn.0106b078
mov ebx, eax
test ebx, ebx
jge 0x106b3a3
cmp dword [ebp + 0xc], 0xffffffff
je 0x106b3a3
mov ecx, esi
call fcn.0106a061
push dword [ebp + 8]
lea edi, [esi + 0x2c]
push edi
mov ecx, esi
call fcn.0106ac49
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x106b39c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0xc]
mov ecx, edi
mov ebx, eax
call fcn.0106a0f8
push dword [ebp + 0xc]
mov ecx, edi
mov dword [eax + 0x208], ebx
call fcn.0106a0f8
mov ebx, dword [eax + 0x20c]
mov ecx, esi
call fcn.0106a07e
lea ecx, [ebp - 0x20]
call fcn.0106de0a
lea ecx, [ebp - 0x88]
call fcn.0106ae90
lea ecx, [ebp - 0x10]
call fcn.0106de0a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x106bb48
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x106bc47
mov edi, dword [ebp + 8]
test edi, edi
je 0x106bc47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1075340]
mov ebx, 0x1075334
cmp eax, 0xea60
jae 0x106bb9c
push edi
push ebx
call fcn.0106d646
test al, al
je 0x106bb9c
mov eax, dword [0x1075330]
mov dword [esi], eax
jmp 0x106bc4e
push esi
push edi
push 0x10121d0
push 0x80000002
call fcn.0106b888
cmp eax, 3
je 0x106bbb7
cmp eax, 2
jne 0x106bbf0
push esi
push edi
push 0x1012160
push 0x80000001
call fcn.0106b888
cmp eax, 3
je 0x106bbd2
cmp eax, 2
jne 0x106bbf0
push edi
call fcn.010671ef
cmp eax, 0xffffffff
je 0x106bbe7
push eax
call fcn.0106bae0
mov dword [esi], eax
jmp 0x106bbee
mov dword [ebp - 4], 0xc00d0fda
xor eax, eax
test eax, eax
je 0x106bc03
jle 0x106bc00
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x106bc4e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jae 0x106bc4e
push 5
push ebx
lea ecx, [ebp - 0x10]
call fcn.0106d733
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x10]
call fcn.0106de5c
mov eax, dword [esi]
mov dword [0x1075330], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x1075340], eax
call fcn.0106de0a
jmp 0x106bc4e
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x106bcd7
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x106bdc4
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x106bdc4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xea60
cmp eax, dword [0x1075354]
jae 0x106bd2a
push ebx
push 0x1075348
call fcn.0106d646
test al, al
je 0x106bd2a
mov eax, dword [0x1075344]
mov dword [edi], eax
jmp 0x106bdcb
push edi
push ebx
push 0x10121d0
push 0x80000002
call fcn.0106b9b5
test eax, eax
je 0x106bd82
push edi
push ebx
push 0x1012160
push 0x80000001
call fcn.0106b9b5
mov esi, eax
test esi, esi
je 0x106bd82
push ebx
call fcn.010671ef
cmp eax, 0xffffffff
je 0x106bd6b
push eax
call fcn.0106bb14
mov dword [edi], eax
jmp 0x106bd82
test esi, esi
jle 0x106bd7b
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
test esi, esi
jl 0x106bdcb
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jae 0x106bdcb
push 5
push 0x1075348
lea ecx, [ebp - 0x10]
call fcn.0106d733
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x10]
call fcn.0106de5c
mov eax, dword [edi]
mov dword [0x1075344], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x1075354], eax
call fcn.0106de0a
jmp 0x106bdcb
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x106c02b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp byte [0x1075298], bl
jne 0x106c071
push esi
push ebx
push ebx
push ebx
push 0x106bede
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x106c068
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
cmp byte [0x1075298], bl
je 0x106c0b7
lea ecx, [ebp - 0xc]
call fcn.0106d68a
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0106de5c
test eax, eax
jl 0x106c0af
lea ecx, [ebp - 0xc]
call fcn.0106d785
push dword [ebp - 0xc]
mov ecx, 0x10752d8
call fcn.0106cccd
test al, al
je 0x106c0af
lea ecx, [ebp - 0xc]
call fcn.0106de0a
mov al, 1
jmp 0x106c0b9
lea ecx, [ebp - 0xc]
call fcn.0106de0a
xor al, al
pop ebx
leave
ret 4

Function at 0x106d320
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
xor ebx, ebx
mov dword [ebp - 8], ecx
cmp byte [ecx + 0x10], bl
jne 0x106d43c
push ebx
push 0x20019
push 0x1013d50
mov byte [ecx + 0x10], 1
push 0x80000002
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.0106b6de
test eax, eax
je 0x106d36d
lea ecx, [ebp - 0x34]
call fcn.0106b6c0
jmp 0x106d43c
push esi
push edi
xor edi, edi
mov esi, 0x104
jmp 0x106d40e
lea ecx, [ebp - 0x10]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
mov eax, edi
push eax
push dword [ebp - 0x34]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x106d42a
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x106d3ab
cmp word [ecx], bx
setne al
cmp al, bl
je 0x106d406
cmp dword [ebp - 4], ebx
je 0x106d406
lea ecx, [ebp - 0x28]
call fcn.0106d68a
mov eax, dword [ebp - 0x1c]
push 0x2e
pop ecx
cmp cx, word [eax]
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
jne 0x106d3cf
add eax, 2
push eax
call fcn.0106de5c
mov ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, ebx
je 0x106d3e4
cmp word [ecx], bx
setne al
cmp al, bl
je 0x106d3fe
push ecx
call fcn.01067164
cmp eax, 0xffffffff
jne 0x106d3fe
push dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
call fcn.0106cff3
lea ecx, [ebp - 0x28]
call fcn.0106de0a
lea ecx, [ebp - 0x1c]
call fcn.0106de0a
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.0106d68a
push esi
lea ecx, [ebp - 0x1c]
call fcn.0106de14
test eax, eax
jge 0x106d37b
lea ecx, [ebp - 0x1c]
call fcn.0106de0a
lea ecx, [ebp - 0x34]
call fcn.0106b6c0
pop edi
pop esi
pop ebx
leave
ret