joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c6e4
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x3b8]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 4], 0x10
je 0x101c712
push ebx
push ebx
push 0x438
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [esi + 0x3ac]
cmp dword [edi], ebx
jne 0x1025661
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x38]
mov dword [esi + 0xc], 1
call edi
push 2
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [esi + 0x38]
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 4]
call edi
push 2
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push edi
push dword [esi + 4]
call ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [ebp - 0x1c]
push edi
push edi
push 0x1f
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x102567d
lea eax, [esi + 0x4b8]
cmp dword [eax], edi
lea ebx, [esi + 0x4b0]
je 0x101c7c2
mov ebx, eax
mov eax, dword [ebx]
cmp eax, edi
je 0x1025685
push dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x1025696
cmp dword [ebp - 4], 0x10
jne 0x101c7ff
push edi
push 0x10002
push 0x128
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.0100ed3a
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.010301aa
jmp 0x101c720
mov dword [ebp - 4], edi
jmp 0x101c7b0
mov ecx, esi
call fcn.0100fe2b
mov eax, dword [ebx]
cmp eax, edi
jne 0x101c7cc
call fcn.0100ab49
jmp 0x101c7e5
Function at 0x101df4f
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x101e026
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x10165a0
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.010165c9
mov eax, dword [ebp - 0xc]
add edi, eax
lea eax, [edi + ebx]
cmp eax, dword [ebp + 0xc]
jge 0x101e026
jmp 0x1026a54
push 0x28
push eax
push 0x1003
push ebx
call edi
and word [esi + 0x104], 0
jmp 0x101df8d
push 0x28
push eax
push 0x1f
push ebx
call edi
and word [esi + 0x60], 0
jmp 0x101df9a
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x1026a46
push ebx
lea eax, [esi + 0xb4]
cmp word [eax], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, 0x400
je 0x1017c19
lea eax, [esi + 0x10]
cmp word [eax], 0
je 0x1017c31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1026a4d
push ebx
mov ecx, esi
call fcn.01020207
mov eax, dword [esi + 0x1b0]
cmp eax, ebx
je 0x101dfcf
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101e19c
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, dword [ebp - 0xc]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x10]
sar edi, 1
cmp eax, dword [ebp - 0x18]
jle 0x101e008
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101e0be
mov eax, dword [ebp - 0xc]
add eax, edi
add eax, ebx
cmp eax, dword [ebp + 0xc]
jl 0x101658a
xor edi, edi
cmp dword [esi + 0x1b0], edi
je 0x101e03c
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x104673c]
lea eax, [ebx + eax*4]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push edi
push edi
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push dword [esi + 4]
call ebx
push eax
push edi
push 0xfffffffffffffff0
push dword [esi + 4]
call ebx
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov ecx, dword [0x1046738]
mov eax, dword [0x10460bc]
mov edx, dword [ebp - 0x24]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
mov esi, ecx
sub esi, edx
cmp esi, eax
jge 0x101e09f
lea ecx, [edx + eax]
sub ecx, edx
movzx eax, cx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop edi
pop ebx
pop esi
leave
ret 8
xor eax, eax
jmp 0x101e0b4
xor eax, eax
jmp 0x101e0b2
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x101e026
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x101e026
mov dword [ebp - 0x18], ecx
jmp 0x101e026
Function at 0x101f86b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1046080]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x101f8f8
lea eax, [ebp - 0x40c]
push 0x100
push eax
call fcn.0101f955
and word [ebp - 0x20c], 0
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x40c]
push eax
push SysReAllocString
mov dword [ebp - 0x410], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x101f8ec
cmp word [ebp - 0x20c], ax
je 0x101f8ec
push 0x20013
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.WINMM.dll_PlaySoundW
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4

Function at 0x101fb21
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea eax, [ebp - 0x34]
push eax
push 1
push 0x411
push dword [esi + 0x20]
call ebx
lea eax, [esi + 0x2b8]
push eax
mov eax, dword [esi + 0x2bc]
push dword [eax + 0x288]
mov ecx, esi
push 0x43e
push 2
call fcn.010075bc
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
test byte [eax + 0x28c], 0x10
jne 0x101fa31
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [ebp + 0xc]
cmp eax, 0x1388
jb 0x101fa31
call edi
push 0x101fa48
mov dword [ebp - 4], eax
call fcn.0101f86b
mov ecx, esi
call fcn.010074ec
mov ecx, 0x10460f8
call fcn.0101f7be
jmp 0x102717a
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push edi
push 0x439
push dword [esi + 0x20]
add ecx, 0x88
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x10], ecx
call ebx
push edi
mov ecx, esi
mov dword [esi + 0x2c4], 1
call fcn.0101f6f2
jmp 0x1021ab9
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2bc]
test eax, eax
jne 0x1021aad
jmp 0x1027166
add eax, 8
push eax
push ecx
push 0x421
push dword [esi + 0x20]
call ebx
jmp 0x1027166
mov ecx, dword [eax + 0x28c]
and ecx, 0xf
jmp 0x101fb4c
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1021a9f
jmp 0x101fb4c
cmp dword [esi + 0x2bc], edi
pop edi
jne 0x101f9cd
jmp 0x101f9fe
mov eax, dword [esi + 0x2bc]
test eax, eax
push edi
jne 0x101fa07
jmp 0x101fa31
and dword [ebp - 0x34], 0
push 0xb
xor eax, eax
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov dword [0x1046118], 1
mov ecx, dword [esi + 0x2bc]
xor edi, edi
cmp ecx, edi
jne 0x101fa6e
jmp 0x101fa96
Function at 0x10211bd
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x1046080]
or dword [ebp + 0x1c], 4
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x614], edi
mov word [ebp - 0x20c], bx
jne 0x102535e
mov dword [ebp - 0x610], ebx
cmp esi, ebx
je 0x102538f
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x102538f
cmp word [ebp - 0x20c], bx
je 0x102124d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x102124d
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x102537a
cmp eax, 5
je 0x102537a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x102538f
cmp dword [ebp + 0x14], ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
jne 0x10253a5
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x10253c3
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x10460dc]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x610], eax
jmp 0x10211fb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x102124d
push ebx
push 0x10
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x1021262
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x14]
push dword [0x10460dc]
call esi
lea ebx, [ebp - 0x40c]
jmp 0x1021276
push edi
lea eax, [ebp - 0x60c]
push eax
push dword [ebp + 0x18]
push dword [0x10460dc]
call esi
lea eax, [ebp - 0x60c]
jmp 0x1021281
Function at 0x10214ab
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
je 0x1028187
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
push ecx
setne bl
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
call esi
cmp eax, ebx
je 0x1021acb
pop esi
pop ebx
pop edi
leave
ret 0x10
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x1021adb
mov ecx, dword [ebp - 4]
jmp 0x10214d8
push 1
push edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call ebx
test eax, eax
je 0x1021b0c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x20], 0x20
je 0x1028197
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1021adb
cmp dword [ebp + 0x10], 0xffffffff
je 0x1021ad3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x10214d8
or eax, 0xffffffff
cmp ecx, eax
jne 0x10214d0
jmp 0x10214f6
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1021adb

Function at 0x1021e6a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov edi, ecx
cmp dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x1021ed0
cmp dword [ebp + 8], ebx
push esi
push 5
pop eax
lea esi, [edi + 8]
jne 0x1026b49
inc dword [esi]
cmp dword [esi], eax
ja 0x1021ecf
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push 0x101fe68
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021ecf
push 4
push esi
push 4
push ebx
push 0x101fee4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov dword [edi + 0xc], ebx
pop edi
pop ebx
leave
ret 4
mov dword [esi], eax
jmp 0x1021e90

Function at 0x1021f6c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax + 0xc], 0x71
push edi
mov edi, ecx
je 0x1028e94
xor eax, eax
pop edi
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jl 0x1028ecf
push 0x11
call esi
test ax, ax
jl 0x1028ecf
push 0x12
call esi
test ax, ax
jl 0x1028ecf
test byte [edi + 0x48], 8
je 0x1028ecf
mov ecx, edi
call fcn.0101af9b
test eax, eax
jl 0x1028ecf
push eax
mov ecx, edi
call fcn.0103fe83
pop esi
jmp 0x1021f82
Function at 0x102b49b
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb00
mov eax, dword [0x1046080]
push ebx
push esi
push edi
push 0x1d
mov dword [ebp - 4], eax
mov edi, 0x1030
mov ebx, 0x21a
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x102b4cb
add edi, 4
inc ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0xa4]
push eax
push 0x20c
push dword [0x10460dc]
call esi
push 0x400
lea eax, [ebp - 0xaac]
push eax
push ebx
push dword [0x10460dc]
call esi
push edi
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xaac]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x102b57f
push 0x104
lea eax, [ebp - 0x2ac]
push eax
push 0x102b590
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0xb00], esi
lea edi, [ebp - 0xafc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0xb00]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b57f
push dword [ebp - 0xab8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xabc]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret

Function at 0x102b665
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1046080]
push 7
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x102b6a9
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 2
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x34]
jmp 0x102b6ac
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4
Function at 0x102b716
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x1046080]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push esi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x624], esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp eax, esi
mov dword [ebp - 0x628], eax
je 0x102b8eb
push ebx
push eax
call fcn.0102b243
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x62c], eax
je 0x102b8e2
lea ecx, [ebp - 0x644]
push ecx
push 4
push eax
push 0x102b294
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 0x620], eax
je 0x102b8da
push edi
xor eax, eax
mov dword [ebp - 0x63c], esi
lea edi, [ebp - 0x638]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x688], esi
lea edi, [ebp - 0x684]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102b8c3
push 0x102b968
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x102b8c3
push dword [ebp - 0x640]
lea eax, [ebp - 0x61c]
push 0x400
push 0x102b900
push 0x208
push eax
call fcn.0101f955
add esp, 0x14
test eax, eax
jl 0x102b8c3
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x688]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x688], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b8c3
push dword [ebp - 0x63c]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x102b89d
push dword [ebp - 0x638]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x624], 1
call edi
push dword [ebp - 0x620]
call edi
cmp dword [ebp + 0xc], esi
je 0x102b8ab
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 0x620]
push esi
call fcn.010214ab
jmp 0x102b8ab
push 5
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x63c]
call ebx
push dword [ebp - 0x638]
call ebx
cmp dword [ebp - 0x624], esi
jne 0x102b8d1
push 5
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x620]
call ebx
pop edi
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x628]
call ebx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
pop esi
call fcn.01001aff
leave
ret 8
Function at 0x102ba2a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x102ba43
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x102bb49
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0x102bb80
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x102bb47
cmp dword [ebp - 8], ebx
jne 0x102bb47
cmp dword [ebp - 4], ebx
jne 0x102bb47
cmp dword [ebp - 0xc], eax
je 0x102bb47
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ebx, 0x102bb68
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102bb47
cmp dword [ebp - 8], 3
jne 0x102bb47
test dword [ebp - 4], 3
jne 0x102bb47
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi + 8], eax
je 0x102bb47
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102bb3a
cmp dword [ebp - 8], 3
jne 0x102bb3a
mov eax, dword [ebp - 4]
test al, 3
jne 0x102bb3a
shr eax, 2
mov edi, eax
cmp edi, 0xa
jle 0x102bb3a
cmp edi, 0xca
jge 0x102bb3a
xor ecx, ecx
inc ecx
cmp ecx, edi
mov dword [esi + 0x10], edi
jge 0x102bb38
mov eax, dword [esi + 8]
add eax, 4
mov edx, dword [eax]
cmp edx, dword [eax - 4]
jbe 0x102bb36
cmp edx, 0xffff
ja 0x102bb36
inc ecx
add eax, 4
cmp ecx, dword [esi + 0x10]
jl 0x102bb1e
cmp ecx, edi
je 0x102bb47
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi + 8], 0
pop edi
pop ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x102bb55
mov dword [esi + 0xc], eax
jmp 0x102bb63
mov dword [esi + 0xc], 0x102bba8
mov dword [esi + 0x10], 0x1a
pop esi
leave
ret

Function at 0x102bc15
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x102bc50
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x102bc50
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [esi + 4]
push 4
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ecx, esi
pop esi
jmp fcn.0102ba2a
pop esi
ret

Function at 0x102bc17
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x102bc50
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x102bc50
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [esi + 4]
push 4
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ecx, esi
pop esi
jmp fcn.0102ba2a
pop esi
ret
Function at 0x102cb26
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
and dword [ebp - 4], edi
push edi
push 0x10133d0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [ebp + 8]
jne 0x102cb91
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push 0x102cbb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102cb84
cmp dword [ebp - 8], 1
jne 0x102cb84
cmp word [ebx], ax
je 0x102cb84
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x102cbaa
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test edi, edi
je 0x102cbaa
push 1
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x102da58
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4

Function at 0x1031f88
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1046080]
push 0x208
mov dword [ebp - 4], eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
push dword [0x10460dc]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103201c
and dword [ebp - 0x450], 0
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x44c]
rep stosd dword es:[edi], eax
push 0x3e
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
pop edi
je 0x1031fe9
and word [eax], 0
inc eax
inc eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x414]
push eax
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x440], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4
Function at 0x1032e5f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1046080]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 1
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1032ed5
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push ebx
push 0x1032f68
push 0x104
push eax
call fcn.0101f955
add esp, 0x14
inc dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1032e8b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01006409
jmp 0x1032f49
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
test edi, edi
je 0x1032f48
push edi
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.0100660f
and word [edi], 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push ebx
push 0x1032f58
push 0x104
push eax
call fcn.0101f955
add esp, 0x18
inc dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1032ef9
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01006409
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01001aff
leave
ret 8