joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b79f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00414fb8
mov dword [ebp - 0x14], eax
cmp dword [0x432d98], esi
jne 0x41b892
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41b81f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41b972
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41b972
push 0x425c98
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41b972
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x432d98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x432d9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x432da0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x432da8], eax
test eax, eax
je 0x41b88f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x432da4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41b8b7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41b8aa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41b8cc
push 4
pop eax
jmp 0x41b974
cmp dword [ebp - 0x14], esi
je 0x41b8cc
push dword [0x432d98]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41b8b1
mov eax, dword [0x432da4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41b92a
cmp dword [0x432da8], edi
je 0x41b92a
push eax
call ebx
push dword [0x432da8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41b92a
test eax, eax
je 0x41b92a
call ecx
test eax, eax
je 0x41b91f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41b91f
test byte [ebp - 8], 1
jne 0x41b92a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41b95a
mov eax, dword [0x432d9c]
cmp eax, edi
je 0x41b957
push eax
call ebx
test eax, eax
je 0x41b957
call eax
mov esi, eax
test esi, esi
je 0x41b957
mov eax, dword [0x432da0]
cmp eax, edi
je 0x41b957
push eax
call ebx
test eax, eax
je 0x41b957
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x432d98]
call ebx
test eax, eax
je 0x41b972
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41b974
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x716a4bf7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x38b10cef
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1003256
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c4
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0xa2
call esi
mov edi, 0x8000
xor ebx, ebx
mov ecx, edi
inc ebx
test cx, ax
je 0x1003287
mov dword [ebp - 4], ebx
push 0xa3
call esi
push 2
test di, ax
pop edi
je 0x1003299
or dword [ebp - 4], edi
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x10032ae
or dword [ebp - 4], 4
push 0xa5
call esi
mov ecx, 0x8000
test cx, ax
je 0x10032c3
or dword [ebp - 4], 8
push 0xa0
call esi
mov ecx, 0x8000
test cx, ax
je 0x10032d8
or dword [ebp - 4], 0x10
push 0xa1
call esi
mov ecx, 0x8000
test cx, ax
je 0x10032ed
or dword [ebp - 4], 0x20
and dword [ebp - 0x1c4], 0
push 0x1bc
lea eax, [ebp - 0x1c0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
test byte [ebp - 4], bl
je 0x100332b
mov eax, 0xa2
mov word [ebp - 0x1c0], ax
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1bc], edi
mov eax, ebx
test byte [ebp - 4], 2
push 3
pop esi
je 0x100334f
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
mov edx, 0xa3
mov dword [ecx], ebx
mov word [ecx + 4], dx
mov dword [ecx + 8], esi
inc eax
test byte [ebp - 4], 4
je 0x1003370
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
mov edx, 0xa4
mov dword [ecx], ebx
mov word [ecx + 4], dx
mov dword [ecx + 8], edi
inc eax
test byte [ebp - 4], 8
je 0x1003391
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
mov edx, 0xa5
mov dword [ecx], ebx
mov word [ecx + 4], dx
mov dword [ecx + 8], esi
inc eax
test byte [ebp - 4], 0x10
je 0x10033b2
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
mov edx, 0xa0
mov dword [ecx], ebx
mov word [ecx + 4], dx
mov dword [ecx + 8], edi
inc eax
test byte [ebp - 4], 0x20
je 0x10033d3
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
mov edx, 0xa1
mov dword [ecx], ebx
mov word [ecx + 4], dx
mov dword [ecx + 8], edi
inc eax
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
and dword [ecx + 8], 0
mov dword [ecx], ebx
push 0x5b
pop edx
mov word [ecx + 4], dx
inc eax
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
and dword [ecx + 8], 0
mov dword [ecx], ebx
push 0x55
pop edx
mov word [ecx + 4], dx
inc eax
mov ecx, eax
imul ecx, ecx, 0x1c
lea ecx, [ebp + ecx - 0x1c4]
mov word [ecx + 4], dx
mov dword [ecx], ebx
mov dword [ecx + 8], edi
inc eax
mov ecx, eax
imul ecx, ecx, 0x1c
push 0x5b
lea ecx, [ebp + ecx - 0x1c4]
pop edx
mov dword [ecx], ebx
mov word [ecx + 4], dx
mov dword [ecx + 8], edi
push 0x1c
lea ecx, [ebp - 0x1c4]
push ecx
inc eax
push eax
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10036f1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
cmp dword [ebp - 8], esi
je 0x1003721
cmp eax, esi
jne 0x1003785
lea eax, [ebp - 0xc]
push eax
call fcn.01003450
test eax, eax
jl 0x1003785
cmp dword [ebp - 0xc], 1
jne 0x1003785
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push 1
push esi
push esi
push 0x1001768
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003785
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x10018f0
push dword [ebp - 4]
mov dword [ebp - 0x10], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x100378a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003256
xor eax, eax
inc eax
jmp 0x1003787

Function at 0x100379f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 5
call fcn.01003450
test eax, eax
jl 0x1003815
cmp dword [ebp - 8], 1
jne 0x1003815
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push 1
push esi
push esi
push 0x1001768
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003815
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push esi
push 0x10018f0
push dword [ebp - 4]
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x100381a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003256
xor eax, eax
inc eax
jmp 0x1003817
Function at 0x1005ade
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x518]
xor ebx, ebx
cmp dword [edi], ebx
je 0x1005c9f
mov dword [ebp - 4], ebx
cmp dword [esi + 0x4cc], ebx
jne 0x1005b10
cmp dword [esi + 0x52c], ebx
je 0x1005c26
fld1
fcomp dword [esi + 0x490]
fnstsw ax
test ah, 1
je 0x1005c26
lea ecx, [esi + 0x4e4]
call fcn.010139c4
test eax, eax
jne 0x1005c26
mov eax, dword [esi + 0x498]
xor ecx, ecx
cmp eax, dword [esi + 0x10]
setle cl
mov eax, ecx
cmp eax, ebx
je 0x1005b58
xor ecx, ecx
cmp dword [esi + 0x530], ebx
sete cl
mov dword [ebp - 4], ecx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
neg eax
push 5
sbb eax, eax
pop ebx
and eax, 0xfffffffb
add eax, ebx
push eax
push dword [esi + 0x518]
call edi
mov eax, dword [esi + 0x4a0]
xor ecx, ecx
cmp eax, dword [esi + 0x18]
setge cl
mov eax, ecx
test eax, eax
je 0x1005b9c
cmp dword [ebp - 4], 0
jne 0x1005b9c
xor ecx, ecx
cmp dword [esi + 0x530], 1
sete cl
mov dword [ebp - 4], ecx
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, ebx
push eax
push dword [esi + 0x51c]
call edi
mov eax, dword [esi + 0x494]
xor ecx, ecx
cmp eax, dword [esi + 0xc]
setle cl
mov eax, ecx
test eax, eax
je 0x1005bd7
cmp dword [ebp - 4], 0
jne 0x1005bd7
xor ecx, ecx
cmp dword [esi + 0x530], 2
sete cl
mov dword [ebp - 4], ecx
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, ebx
push eax
push dword [esi + 0x520]
call edi
mov eax, dword [esi + 0x49c]
xor ecx, ecx
cmp eax, dword [esi + 0x14]
setge cl
mov eax, ecx
test eax, eax
je 0x1005c12
cmp dword [ebp - 4], 0
jne 0x1005c12
xor ecx, ecx
cmp dword [esi + 0x530], 3
sete cl
mov dword [ebp - 4], ecx
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, ebx
push eax
push dword [esi + 0x524]
call edi
jmp 0x1005c40
push 4
pop ebx
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
add edi, 4
dec ebx
jne 0x1005c29
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x1005c9f
mov eax, dword [section..data]
mov edi, dword [sym.imp.USER32.dll_GetParent]
cmp eax, section..data
je 0x1005c84
test byte [eax + 0x1c], 0x10
je 0x1005c84
push dword [esi + 0x518]
call edi
push eax
push dword [esi + 0x530]
mov eax, dword [section..data]
push 0x1001ab8
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004de7
push 0x89a
push dword [esi + 0x518]
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
and dword [esi + 0x538], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1009fc8
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x1002094
call fcn.0100bff3
mov ecx, esi
call dword [sym.imp.DUI70.dll_public:_struct_HWND______thiscall_DirectUI::NativeHWNDHost::GetHWND_void_]
mov ebx, eax
test ebx, ebx
je 0x100a03a
xor edi, edi
push dword [edi + 0x1018038]
push ebx
call dword [sym.imp.USER32.dll_UnregisterHotKey]
test eax, eax
jne 0x100a02f
mov eax, dword [section..data]
cmp eax, section..data
je 0x100a02f
test byte [eax + 0x1c], 4
je 0x100a02f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1001fa8
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010030c6
add edi, 0xc
cmp edi, 0xcc
jb 0x1009fee
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x100a061
mov eax, dword [esi + 0x30]
test eax, eax
je 0x100a054
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
and dword [esi + 0x30], 0
push dword [esi + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteDC]
and dword [esi + 0x2c], 0
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
lea edi, [esi + 0x3c]
mov dword [ebp - 4], 0xd
mov eax, dword [edi]
test eax, eax
je 0x100a07d
push eax
call ebx
and dword [edi], 0
add edi, 4
dec dword [ebp - 4]
jne 0x100a071
lea edi, [esi + 0x70]
mov dword [ebp - 4], 0xd
mov eax, dword [edi]
test eax, eax
je 0x100a09b
push eax
call ebx
and dword [edi], 0
add edi, 4
dec dword [ebp - 4]
jne 0x100a08f
mov ecx, esi
call dword [sym.imp.DUI70.dll_public_virtual:_void___thiscall_DirectUI::NativeHWNDHost::destructor_void_]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100a0b5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101852c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
mov ebx, ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
mov esi, 0x100209c
lea edi, [ebp - 0x18]
push 3
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x1002c00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a154
push 4
pop edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100a126
cmp dword [ebp - 0x1c], esi
setne al
cmp eax, esi
jne 0x100a14b
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebx + 0xf8], 0x1388
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010149a5
leave
ret
Function at 0x100aaef
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100ab5f
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x100ab5e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, dword [esi + 0xe8]
jne 0x100ab3c
call edi
sub eax, dword [esi + 0xec]
cmp eax, 0x3e8
jbe 0x100ab5d
push 0x13
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [esi + 0xe8], ebx
call edi
mov dword [esi + 0xec], eax
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x100ca0e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101852c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 2
lea eax, [ebp - 0x10]
push eax
push 0x20000075
mov edi, 0x400
push edi
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 0x76
push edi
call esi
movzx eax, word [ebp - 0x10]
dec eax
je 0x100ca93
dec eax
je 0x100ca8c
dec eax
je 0x100ca62
mov eax, 0x10021ec
jmp 0x100ca98
mov eax, 0x10021e0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 0x10]
push ebx
call fcn.0100c9af
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010149a5
leave
ret 0xc
mov eax, 0x10021d4
jmp 0x100ca67
mov eax, 0x10021c8
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 8]
jmp 0x100ca6e

Function at 0x100cbaa
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x101852c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, edi
je 0x100cc90
mov eax, dword [eax + 8]
cmp eax, 0xfffffffe
je 0x100cbde
cmp eax, 0xfffffffc
jne 0x100cc90
movzx eax, word [ebp + 8]
sub eax, 0x13a
je 0x100cc3f
sub eax, 0x12
jne 0x100cc90
lea eax, [ebp - 0x418]
push eax
push 0x10021a8
push 0x17
push edi
push 0x1002e64
mov dword [ebp - 0x418], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100cc2d
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push edi
push 0x1002250
push 0x1002214
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x418]
cmp eax, edi
je 0x100cc90
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100cc90
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x100cc8f
push 0x1002190
lea eax, [ebp - 0x20c]
push eax
push 0x1002208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0100c9af
add esp, 0x14
test eax, eax
jl 0x100cc8f
push 1
push edi
push edi
lea eax, [ebp - 0x414]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.010149a5
leave
ret 8
Function at 0x10106a1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, ecx
mov ecx, dword [esi + 0xa4]
call fcn.01010ae0
test al, al
jne 0x10106c2
xor eax, eax
jmp 0x1010887
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
inc edi
push edi
push 0
push 0x100288c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10106e8
xor eax, eax
jmp 0x1010886
push ebx
mov ebx, 0x1018214
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebx]
mov dword [ebp - 4], 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101072a
mov ecx, dword [esi + 0xa4]
push edi
push dword [ebp - 0xc]
push dword [ebx + 4]
call fcn.01010be4
test eax, eax
jne 0x101086c
add ebx, 8
cmp ebx, 0x1018244
jb 0x10106ee
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x3c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x100287c
push dword [ebp - 8]
mov dword [ebp - 4], 0x30
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101087a
mov eax, dword [ebp - 0x38]
cmp eax, edi
je 0x1010827
cmp eax, 3
je 0x1010827
cmp eax, ebx
je 0x1010827
cmp eax, 2
je 0x1010827
push edi
push ebx
mov ecx, dword [esi + 0xa4]
push 6
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
mov ecx, dword [esi + 0xa4]
push edi
push dword [ebp - 0x1c]
push 8
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
mov ecx, dword [esi + 0xa4]
push edi
push dword [ebp - 0x18]
push 9
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 0xa4]
push edi
push eax
push 0xa
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov ecx, dword [esi + 0xa4]
push edi
push eax
push 0xb
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
cmp dword [ebp - 0x2c], ebx
je 0x1010847
push edi
push dword [ebp - 0x2c]
mov ecx, dword [esi + 0xa4]
push 0xc
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
cmp dword [ebp - 0x28], ebx
je 0x1010852
push edi
push dword [ebp - 0x28]
jmp 0x101085b
mov ecx, dword [esi + 0xa4]
push edi
push dword [eax*4 + 0x1018204]
push 7
call fcn.01010be4
cmp eax, ebx
jne 0x101086c
push edi
push edi
jmp 0x1010785
cmp dword [ebp - 0x24], ebx
je 0x101081c
push edi
push dword [ebp - 0x24]
jmp 0x101080b
cmp dword [ebp - 0x20], ebx
je 0x101087a
push edi
push dword [ebp - 0x20]
mov ecx, dword [esi + 0xa4]
push 0xd
call fcn.01010be4
cmp eax, ebx
je 0x101087a
jle 0x1010885
and eax, 0xffff
or eax, 0x80070000
jmp 0x1010885
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x1010a05
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi], ebx
jne 0x1010a31
push edi
push 1
push ebx
push 0x1002c00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1010a31
mov dword [edi], ebx
mov esi, 0x1018250
mov eax, dword [edi]
cmp eax, ebx
je 0x1010a7b
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
push dword [esi - 8]
mov dword [ebp - 8], 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010a7b
cmp dword [esi - 4], ebx
je 0x1010a75
mov eax, dword [esi]
cmp dword [ebp - 4], eax
jge 0x1010a6a
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
cmp dword [ebp - 4], eax
jle 0x1010a75
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], eax
add esi, 0x1c
cmp esi, 0x101850c
jl 0x1010a36
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10139cd
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [section..data]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, section..data
je 0x1013a10
test byte [eax + 0x1c], 0x10
je 0x1013a10
call edi
sub eax, dword [esi + 0x2c]
push eax
mov eax, dword [section..data]
push ebx
push 0x1002d5c
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004de7
cmp dword [esi + 0x18], 2
jne 0x1013a22
call edi
sub eax, dword [esi + 0x2c]
cmp eax, 0xc8
jbe 0x1013a25
mov dword [esi + 0x18], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10144a4
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x10144cf
test byte [eax + 0x1c], 0x10
je 0x10144cf
push 0x1002d70
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010030a0
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 0xbb9
push dword [esi]
call edi
push 0xbba
push dword [esi]
call edi
xor ebx, ebx
mov dword [esi + 0x58], ebx
lea edi, [esi + 4]
push ebx
mov ecx, esi
call fcn.01013ee3
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
inc ebx
add edi, 4
cmp ebx, 4
jl 0x10144ef
pop edi
pop esi
pop ebx
ret