joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016f7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x134]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401784
mov eax, dword [ebp - 0x12c]
jmp 0x4017ab
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x134]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401785
mov eax, dword [ebp - 0x12c]
jmp 0x4017ab
nop
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x401760
mov eax, 0
leave
ret

Function at 0x4017cb
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp + 8]
jne 0x401836
mov eax, dword [ebp - 0x12c]
jmp 0x40185d
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp + 8]
jne 0x401837
mov eax, dword [ebp - 0x12c]
jmp 0x40185d
nop
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x401823
mov eax, 0
leave
ret
Function at 0x402310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 4], esi
lea esi, [ebp + 0xc]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort

Function at 0x402360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x402386
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40241a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4023d5
cmp eax, 0x40
je 0x4023d5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x402379
cmp eax, 0x40
je 0x402379
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x402379
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
lea esi, [esi]
lea edi, [edi]
Function at 0x402bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14c
mov dword [esp + 0x13c], ebx
mov ebx, dword [esp + 0x150]
mov dword [esp + 0x140], esi
mov dword [esp + 0x144], edi
mov dword [esp + 0x148], ebp
call sym.__errno
test ebx, ebx
mov dword [eax], 0
je 0x402d8d
cmp byte [ebx], 0
je 0x402d62
mov dword [esp], ebx
call sym._GetFileAttributesA_4
sub esp, 4
cmp eax, 0xffffffff
je 0x402d71
test al, 0x10
je 0x402d62
lea ebp, [esp + 0x2c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sym.__fullpath
mov edx, ebp
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x402c3b
test eax, 0x8080
je 0x402d57
add al, al
sbb edx, 3
sub edx, ebp
add edx, 0x233
mov dword [esp], edx
call sym._malloc
test eax, eax
mov ebx, eax
mov esi, eax
je 0x402d80
lea edi, [eax + 0x22c]
mov dword [esp + 4], ebp
mov dword [esp], edi
call sym._strcpy
cmp byte [ebx + 0x22c], 0
je 0x402ce3
mov dword [esp + 4], 0x2f
mov dword [esp], edi
call sym._strrchr
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call sym._strlen
lea ebp, [ebx + eax + 0x22b]
cmp dword [esp + 0x1c], ebp
je 0x402ce3
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sym._strrchr
cmp ebp, eax
je 0x402ce3
mov dword [esp], edi
call sym._strlen
mov word [edi + eax], 0x5c
mov dword [esp], edi
call sym._strlen
lea edx, [esi + 0x120]
mov ecx, 0x41
mov word [edi + eax], 0x2a
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11c], 0
mov word [esi + 0x11e], 0
mov eax, ebx
mov esi, dword [esp + 0x140]
mov ebx, dword [esp + 0x13c]
mov edi, dword [esp + 0x144]
mov ebp, dword [esp + 0x148]
add esp, 0x14c
ret
shr eax, 0x10
add edx, 2
jmp 0x402c5c
call sym.__errno
xor ebx, ebx
mov dword [eax], 0x14
jmp 0x402d32
call sym.__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x402d32
call sym.__errno
mov dword [eax], 0xc
jmp 0x402d32
lea esi, [esi]
call sym.__errno
mov dword [eax], 0xe
jmp 0x402d32
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x43b651
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
dec esi
call fcn.0043b68b
mov esi, 0xc197ba3b
xor dword [eax], edx
mov esi, 0xa1d797ac
inc eax
or edi, esi
sub esi, edi
sub esi, 0x97b3354d
cmp eax, ebx
jne fcn.0043b651
mov edi, 0x55f4cde2
mov edi, esi
or esi, edi
ret
Function at 0x10028a2
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
push esi
mov esi, ecx
push 2
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push dword [esi + 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1019be0
lea eax, [ebp - 0x10]
push eax
push fcn.01002900
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x4c], eax
pop esi
leave
ret 4
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x4c]
call fcn.01002900
test eax, eax
jne 0x10028d8
mov eax, dword [ebp - 0xc]
jmp 0x10028ed

Function at 0x1002eed
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x101ee5f
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esi + 8]
cmp ecx, 0xdbba00
jbe 0x1002efa
jmp 0x1020727
mov dword [esi + 8], eax
mov ecx, esi
pop esi
jmp fcn.01028ebe
Function at 0x1003070
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
cmp eax, 0xffffffea
mov esi, ecx
jbe 0x100319e
cmp eax, 0xffffffec
je 0x101e98f
cmp eax, 0xfffffff1
je 0x1020eee
cmp eax, 0xfffffff4
jne 0x10031d0
push 0
push edi
mov ecx, esi
call fcn.010030b6
pop edi
pop esi
pop ebx
leave
ret 4
je 0x101038e
cmp eax, 0xfffffd33
je 0x1004eeb
cmp eax, 0xfffffd37
je 0x101d917
cmp eax, 0xfffffd3a
je 0x1020e69
cmp eax, 0xfffffdee
je 0x1020e02
xor eax, eax
jmp 0x10030af
push edi
mov ecx, esi
call fcn.01004e76
jmp 0x10031d0
mov ecx, esi
call fcn.0101450a
jmp 0x10031d0
cmp dword [esi + 0x60], 0
jne 0x1020ece
test byte [edi + 0x14], 2
je 0x10031d0
jmp 0x1020ed6
push dword [edi + 0xc]
lea ecx, [esi + 0x38]
call fcn.01004ed5
push 1
push 0
push eax
mov ecx, esi
call fcn.0100203b
test eax, eax
je 0x10031d0
cmp dword [eax], 0
je 0x10031d0
mov ecx, esi
call fcn.010026e3
mov dword [esi + 0x44], eax
jmp 0x10031d0
push dword [edi + 4]
lea ecx, [esi + 0x38]
call fcn.01004ed5
push 1
xor ebx, ebx
push ebx
push eax
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.0100203b
test eax, eax
je 0x1020e4d
cmp dword [eax], ebx
jne 0x1020e4d
push dword [ebp + 8]
mov ecx, esi
lea ebx, [edi + 0x10]
call fcn.01003901
push eax
push 0x1027060
push 0x50
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0
push 0x50
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*2 + 0x10]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.01003348
jmp 0x10031d0
push dword [edi + 0xc]
lea ecx, [esi + 0x38]
call fcn.01004ed5
mov ecx, esi
mov edi, eax
call fcn.010026e3
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esi + 0x44], eax
je 0x1020ea0
push eax
mov ecx, esi
call fcn.010021a4
cmp eax, edi
jne 0x1020ea0
push 0x11
call ebx
test ax, ax
jge 0x1020eaa
push 0
push edi
mov ecx, esi
call fcn.010040c5
push 0x11
call ebx
test ax, ax
jl 0x10031d0
push 0
push edi
mov ecx, esi
call fcn.010040c5
push edi
mov ecx, esi
call fcn.0102a5d9
jmp 0x10031d0
xor eax, eax
inc eax
jmp 0x10030af
push dword [edi + 0x10]
lea ecx, [esi + 0x38]
call fcn.01004ed5
push eax
mov ecx, esi
call fcn.01004095
jmp 0x10031d0
mov edi, dword [edi + 0xc]
cmp edi, 0xd
je 0x1020eff
cmp edi, 0x20
jne 0x10031d0
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x447
push dword [esi + 0x38]
call edi
mov ebx, eax
test ebx, ebx
jl 0x1020ece
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x43f
push dword [esi + 0x38]
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], 0x80000004
call edi
xor byte [ebp - 0x10], 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x440
push dword [esi + 0x38]
call edi
push 1
push 0
push ebx
mov ecx, esi
call fcn.0100203b
push 0
push eax
push ebx
mov ecx, esi
call fcn.0101ea9d
jmp 0x1020ece
Function at 0x10030b6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
jne 0x10030d6
mov eax, dword [ebx + 0x2c]
mov dword [ebp + 0xc], eax
mov esi, eax
mov eax, dword [ebx + 0xc]
and dword [ebp + 8], 0
dec eax
je 0x100311c
sub eax, 0x10000
jne 0x1004e4b
test byte [ebx + 0x28], 8
jne 0x1004e07
test byte [esi + 4], 1
jne 0x10207d4
test byte [esi + 4], 0x20
jne 0x101964b
cmp dword [esi], 0
je 0x102083e
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp + 8], 0x20
jmp 0x1003112
call fcn.01004e31
test eax, eax
jne 0x10030f5
mov eax, dword [edi + 0x7c]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [edi + 0x68], eax
mov dword [ebp + 8], 0x12
jmp 0x10030f5
dec eax
jne 0x1003112
cmp dword [esi], 0
je 0x1020785
test byte [ebx + 0x28], 8
je 0x1003112
push dword [edi + 0x68]
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x1003112
mov dword [ebp + 8], 4
jmp 0x1003109
push dword [ebx + 0x24]
lea ecx, [edi + 0x38]
call fcn.01004ed5
mov ecx, dword [ebx + 0x1c]
lea esi, [ebx + 0x54]
cmp ecx, dword [esi]
jl 0x1004e5b
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
sub ecx, dword [ebx + 0x6c]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 4]
push 0
push eax
call fcn.01003901
mov ecx, dword [ebp - 4]
push eax
push dword [ebx + 0x10]
call fcn.010291f2
mov edi, dword [ebp - 4]
jmp 0x1004e5b
mov eax, dword [edi + 0x80]
test eax, eax
je 0x1020806
push 0
lea ecx, [ebx + 0x14]
push ecx
mov ecx, dword [ebx]
xor edx, edx
cmp ecx, dword [edi + 0x38]
push 0
setne dl
inc edx
inc edx
push edx
push dword [ebx + 0x10]
push eax
call dword [sym.imp.UxTheme.dll_DrawThemeBackground]
or byte [ebp + 0xa], 0x40
jmp 0x10030ff
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call esi
push 0xd
mov dword [ebx + 0x50], eax
call esi
push 0xe
mov dword [ebx + 0x48], eax
call esi
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x28]
test al, 0x40
jne 0x1020832
or eax, 0x40
or byte [ebp + 0xa], 1
mov dword [ebx + 0x28], eax
or byte [ebp + 0xa], 2
mov esi, dword [ebp + 0xc]
jmp 0x10030ff
push dword [ebx + 0x24]
or dword [ebp + 8], 0x10
lea ecx, [edi + 0x38]
call fcn.01004ed5
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
mov ecx, edi
call fcn.01003901
push eax
push dword [ebx + 0x10]
mov ecx, edi
call fcn.010291f2
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ebx + 0x6c], eax
jmp 0x1003112
Function at 0x10041d2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 2
push 1
push 0
push 0
push 0x1016370
push 0x80000001
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100422d
mov ecx, dword [esi + 0x64]
call fcn.01004230
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x1016354
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x1004e31
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, eax
and cx, 0x3ff
cmp cx, 4
je 0x10206d0
xor eax, eax
ret
shr ax, 0xa
cmp ax, 1
je 0x10206e4
cmp ax, 2
jne 0x1004e48
xor eax, eax
inc eax
ret

Function at 0x1004ed5
Capabilities:
Capture webcam image

Disassembly:
push 0
push dword [esp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4
Function at 0x10060cb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x1023a24
push ebx
lea eax, [esi + 8]
cmp word [eax], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, 0x400
je 0x1014479
lea eax, [esi + 0xac]
cmp word [eax], 0
je 0x101448e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1023a2b
push ebx
mov ecx, esi
call fcn.010155c4
mov eax, dword [esi + 0x1b8]
cmp eax, ebx
je 0x1006149
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.01005fcd
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, dword [ebp - 0xc]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x10]
sar edi, 1
cmp eax, dword [ebp - 0x18]
jle 0x1006182
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.01006233
mov eax, dword [ebp - 0xc]
add eax, edi
add eax, ebx
cmp eax, dword [ebp + 0xc]
jl 0x1010de2
xor edi, edi
cmp dword [esi + 0x1b8], edi
je 0x10061b6
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x103e698]
lea eax, [ebx + eax*4]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push edi
push edi
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push dword [esi + 4]
call ebx
push eax
push edi
push 0xfffffffffffffff0
push dword [esi + 4]
call ebx
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov ecx, dword [0x103e64c]
mov eax, dword [0x103e0c0]
mov edx, dword [ebp - 0x24]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
mov esi, ecx
sub esi, edx
cmp esi, eax
jge 0x1006219
lea ecx, [edx + eax]
sub ecx, edx
movzx eax, cx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop edi
pop ebx
pop esi
leave
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x10061a0
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x1010df8
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.01010e1c
mov eax, dword [ebp - 0xc]
add edi, eax
lea eax, [edi + ebx]
cmp eax, dword [ebp + 0xc]
jge 0x10061a0
jmp 0x1023a32
push 0x28
push eax
push 0x1003
push ebx
call edi
and word [esi + 0x58], 0
jmp 0x1006104
push 0x28
push eax
push 0x1f
push ebx
call edi
and word [esi + 0xfc], 0
jmp 0x1006114
xor eax, eax
jmp 0x100622e
xor eax, eax
jmp 0x100622c
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x10061a0
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x10061a0
mov dword [ebp - 0x18], ecx
jmp 0x10061a0
Function at 0x100804c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 0x1017228
push 0x100
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
and word [ebp - 0x208], 0
add esp, 0x10
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x408]
push eax
push 0x80000001
mov dword [ebp + 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x10080af
cmp word [ebp - 0x208], ax
jne 0x1014165
leave
ret 4
push 0x20013
push eax
lea eax, [ebp - 0x208]
push eax
call sub.WINMM.dll_PlaySoundW
jmp 0x10080af
Function at 0x10089fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x580
push 0x28e44000
lea eax, [ebp - 0x14]
push eax
call fcn.01008b5c
lea esi, [ebx + 0x20]
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x102596a
push ebx
push 0x1008b78
push dword [ebx + 0xe0]
call dword [fcn.01016754]
push 0x40000069
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1008b20
and dword [ebp - 4], eax
lea esi, [ebx + 0x44]
push edi
mov ecx, dword [ebp - 4]
shl ecx, 3
mov eax, dword [ecx + 0x1016814]
mov ecx, dword [ecx + 0x1016818]
lea edi, [esi - 4]
mov dword [ebx + 0x28], ecx
cmp dword [edi], 0
mov dword [ebp - 0xc], eax
je 0x102597a
push dword [ebp - 4]
mov ecx, ebx
call fcn.01008621
test eax, eax
je 0x1008b0f
test byte [ebx + 0x28], 8
je 0x1008ab0
push 0x20000
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x102598f
push dword [ebp - 0xc]
call fcn.01008b30
test eax, eax
jne 0x100b1a8
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x100b1a8
mov eax, dword [edi]
test eax, eax
je 0x100b0f0
push dword [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_ILIsEqual]
test eax, eax
je 0x100b0f0
cmp dword [esi], 0
jne 0x100b0f0
cmp dword [esi + 4], 0
je 0x100b0f0
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_ILFree]
inc dword [ebp - 4]
add esi, 0x1c
cmp dword [ebp - 4], 6
jb 0x1008a65
pop edi
pop esi
mov dword [ebx + 0xf4], 1
xor eax, eax
pop ebx
leave
ret
mov ecx, dword [edi]
xor edx, edx
cmp ecx, edx
je 0x100b0fc
cmp dword [esi], edx
je 0x100b166
mov eax, dword [esi - 0xc]
cmp eax, edx
mov dword [esi], edx
mov dword [esi - 8], eax
je 0x100b1a1
mov eax, dword [eax]
push ecx
mov dword [esi + 0xc], eax
mov dword [esi + 8], edx
call dword [sym.imp.SHELL32.dll_ILFree]
and dword [edi], 0
push 4
lea ecx, [esi - 0xc]
call fcn.01008243
test eax, eax
je 0x100b15d
push dword [ebp - 8]
push dword [ebx + 0x2c]
call fcn.0100a4ff
test eax, eax
mov dword [ebp - 0xc], eax
je 0x100b15d
mov eax, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [edi], eax
lea eax, [esi - 0xc]
push eax
push dword [ebp - 0xc]
mov ecx, ebx
call fcn.0100b1c6
mov ecx, dword [ebp - 0xc]
call fcn.0100827b
lea eax, [esi - 8]
push eax
call fcn.01009728
cmp dword [ebx + 4], 0
je 0x1008b06
cmp dword [esi + 4], 0
jne 0x1008b06
mov edi, dword [edi]
test edi, edi
je 0x1008b06
xor eax, eax
inc eax
push eax
push edi
push 0x2381f
push dword [ebp - 4]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 4]
call fcn.0100a20a
jmp 0x1008b06
xor eax, eax
jmp 0x100b10e
lea ecx, [esi - 0xc]
call fcn.01009a8f
jmp 0x1008b0f
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
jmp 0x1008a39
push edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [esi], 1
jmp 0x1008a89
or dword [ebx + 0x28], 1
jmp 0x1008ab0