joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc07d80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0xc07da3
mov eax, 1
jmp 0xc07eae
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0xc07db9
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0xc07dc3
mov eax, 2
jmp 0xc07eae
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0xc07dee
mov eax, 1
jmp 0xc07eae
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0xc07e14
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0xc07e14
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0xc07e1e
mov eax, 2
jmp 0xc07eae
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00c19cb0
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0xc07e5f
mov eax, 3
jmp 0xc07eae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0xc07eac
mov eax, 1
jmp 0xc07eae
xor eax, eax
pop ebp
ret

Function at 0xc08850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0xc08866
xor eax, eax
jmp 0xc088a6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0xc0888b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0xc0888f
xor eax, eax
jmp 0xc088a6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.00c088b0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0xc1a960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xc1a990
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0xc1a9a3
xor eax, eax
jmp 0xc1aa61
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0xc1a9be
xor eax, eax
jmp 0xc1aa61
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0xc1a9dc
xor eax, eax
jmp 0xc1aa61
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0xc1aa1e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0xc1aa5f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00c19cd0
add esp, 8
test eax, eax
jne 0xc1aa5d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0xc1aa61
jmp 0xc1aa15
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41baa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x41bac2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41bac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41bab8
mov eax, 1
add ebx, ebx
jne 0x41badb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41bad0
jne 0x41baec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41bad0
xor ecx, ecx
sub eax, 3
jb 0x41bb00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41bb72
mov ebp, eax
add ebx, ebx
jne 0x41bb0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41bb18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41bb3c
inc ecx
add ebx, ebx
jne 0x41bb28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41bb1d
jne 0x41bb39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41bb1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41bb5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41bb4d
jmp 0x41babe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41bb5c
add edi, ecx
jmp 0x41babe
pop esi
mov edi, esi
mov ecx, 0x956
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41bb7a
cmp byte [edi], 4
jne 0x41bb7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41bb7f
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41bbee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b9c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ba4c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41bbac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ba50]
or eax, eax
je 0x41bbe8
mov dword [ebx], eax
add ebx, 4
jmp 0x41bbc9
call dword [esi + 0x1ba54]
popal
jmp 0x40ef30
Function at 0x100253e
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
push esi
mov esi, ecx
push 2
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push dword [esi + 0x50]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10236b1
lea eax, [ebp - 0x10]
push eax
push fcn.01002595
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
pop esi
leave
ret 4
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x50]
call fcn.01002595
test eax, eax
jne 0x1002576
mov eax, dword [ebp - 0xc]
jmp 0x100258b
Function at 0x1002db7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x102376a
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esi + 8]
cmp ecx, 0xdbba00
jbe 0x1002dc6
mov dword [esi + 8], eax
mov ecx, esi
pop esi
jmp fcn.0102cef7
Function at 0x1003d35
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
cmp eax, 0xffffffea
mov esi, ecx
jbe 0x1005187
cmp eax, 0xffffffec
je 0x102424b
cmp eax, 0xfffffff1
je 0x10241da
cmp eax, 0xfffffff4
jne 0x10051ba
push 0
push edi
mov ecx, esi
call fcn.01003d82
pop edi
pop esi
pop ebx
leave
ret 4
je 0x101489f
cmp eax, 0xfffffd33
je 0x10148ab
cmp eax, 0xfffffd37
je 0x1021f47
cmp eax, 0xfffffd3a
je 0x1024155
cmp eax, 0xfffffdee
jne 0x10051ba
jmp 0x10240ef
xor eax, eax
jmp 0x1003d76
mov ecx, esi
call fcn.0100fad9
jmp 0x10051ba
push edi
mov ecx, esi
call fcn.0102f732
jmp 0x10051ba
cmp dword [esi + 0x64], 0
jne 0x10241ba
test byte [edi + 0x14], 2
je 0x10051ba
jmp 0x10241c2
push dword [edi + 4]
lea ecx, [esi + 0x3c]
call fcn.0102d71b
push 1
xor ebx, ebx
push ebx
push eax
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.010021c0
test eax, eax
je 0x1024139
cmp dword [eax], ebx
jne 0x1024139
push dword [ebp + 8]
mov ecx, esi
lea ebx, [edi + 0x10]
call fcn.01004ba4
push eax
push 0x1024284
push 0x50
push ebx
call fcn.0101f8d5
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0
push 0x50
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*2 + 0x10]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0100440a
jmp 0x10051ba
push dword [edi + 0xc]
lea ecx, [esi + 0x3c]
call fcn.0102d71b
mov ecx, esi
mov edi, eax
call fcn.01002619
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esi + 0x48], eax
je 0x102418c
push eax
mov ecx, esi
call fcn.010027e6
cmp eax, edi
jne 0x102418c
push 0x11
call ebx
test ax, ax
jge 0x1024196
push 0
push edi
mov ecx, esi
call fcn.01003826
push 0x11
call ebx
test ax, ax
jl 0x10051ba
push 0
push edi
mov ecx, esi
call fcn.01003826
push edi
mov ecx, esi
call fcn.0102edca
jmp 0x10051ba
xor eax, eax
inc eax
jmp 0x1003d76
push dword [edi + 0x10]
lea ecx, [esi + 0x3c]
call fcn.0102d71b
push eax
mov ecx, esi
call fcn.010037e9
jmp 0x10051ba
mov edi, dword [edi + 0xc]
cmp edi, 0xd
je 0x10241eb
cmp edi, 0x20
jne 0x10051ba
push 0
push 0
push 0x447
lea edi, [esi + 0x3c]
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
jl 0x10241ba
lea eax, [ebp - 0x20]
push eax
push ebx
mov ecx, edi
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], 0x80000004
call fcn.0100222f
xor byte [ebp - 0x10], 1
lea eax, [ebp - 0x20]
push eax
push ebx
mov ecx, edi
call fcn.01003b3f
push 1
push 0
push ebx
mov ecx, esi
call fcn.010021c0
push 0
push eax
push ebx
mov ecx, esi
call fcn.0102f693
jmp 0x10241ba
push dword [edi + 0xc]
lea ecx, [esi + 0x3c]
call fcn.0102d71b
push 1
push 0
push eax
mov ecx, esi
call fcn.010021c0
test eax, eax
je 0x10051ba
cmp dword [eax], 0
je 0x10051ba
mov ecx, esi
call fcn.01002619
mov dword [esi + 0x48], eax
jmp 0x10051ba
Function at 0x1003d82
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
jne 0x1003da4
mov eax, dword [ebx + 0x2c]
mov dword [ebp + 0xc], eax
mov esi, eax
mov eax, dword [ebx + 0xc]
and dword [ebp + 8], 0
dec eax
je 0x1003de2
sub eax, 0x10000
jne 0x1003deb
test byte [ebx + 0x28], 8
jne 0x1003e0b
test byte [esi + 4], 1
jne 0x10239ed
test byte [esi + 4], 0x20
jne 0x10207e7
cmp dword [esi], 0
je 0x1023a57
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp + 8], 0x20
jmp 0x1003dd8
dec eax
jne 0x1003dd8
cmp dword [esi], 0
je 0x102399e
test byte [ebx + 0x28], 8
je 0x1003dd8
push dword [edi + 0x6c]
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x1003dd8
call fcn.01003e36
test eax, eax
jne 0x1003dbb
mov eax, dword [edi + 0x80]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [edi + 0x6c], eax
mov dword [ebp + 8], 0x12
jmp 0x1003dbb
mov dword [ebp + 8], 4
jmp 0x1003dcf
push dword [ebx + 0x24]
lea ecx, [edi + 0x3c]
call fcn.0102d71b
mov ecx, dword [ebx + 0x1c]
lea esi, [ebx + 0x54]
cmp ecx, dword [esi]
jl 0x1003df7
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
sub ecx, dword [ebx + 0x6c]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 4]
push 0
push eax
call fcn.01004ba4
mov ecx, dword [ebp - 4]
push eax
push dword [ebx + 0x10]
call 0x102ea4a
mov edi, dword [ebp - 4]
jmp 0x1003df7
mov eax, dword [edi + 0x84]
test eax, eax
je 0x1023a1f
push 0
lea ecx, [ebx + 0x14]
push ecx
mov ecx, dword [ebx]
xor edx, edx
cmp ecx, dword [edi + 0x3c]
push 0
setne dl
inc edx
inc edx
push edx
push dword [ebx + 0x10]
push eax
call dword [sym.imp.UxTheme.dll_DrawThemeBackground]
or byte [ebp + 0xa], 0x40
jmp 0x1003dc5
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call esi
push 0xd
mov dword [ebx + 0x50], eax
call esi
push 0xe
mov dword [ebx + 0x48], eax
call esi
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x28]
test al, 0x40
jne 0x1023a4b
or eax, 0x40
or byte [ebp + 0xa], 1
mov dword [ebx + 0x28], eax
or byte [ebp + 0xa], 2
mov esi, dword [ebp + 0xc]
jmp 0x1003dc5
push dword [ebx + 0x24]
or dword [ebp + 8], 0x10
lea ecx, [edi + 0x3c]
call fcn.0102d71b
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
mov ecx, edi
call fcn.01004ba4
push eax
push dword [ebx + 0x10]
mov ecx, edi
call 0x102ea4a
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ebx + 0x6c], eax
jmp 0x1003dd8

Function at 0x1003e36
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, eax
and cx, 0x3ff
cmp cx, 4
je 0x1023647
xor eax, eax
ret
shr ax, 0xa
cmp ax, 1
je 0x102365b
cmp ax, 2
jne 0x1003e4d
xor eax, eax
inc eax
ret
Function at 0x10057ec
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 2
push 1
push 0
push 0
push 0x1005868
push 0x80000001
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1005849
mov ecx, dword [esi + 0x68]
call fcn.01005893
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x100584c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x1008221
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x580
push 0x28e44000
lea eax, [ebp - 0x14]
push eax
call fcn.010080a1
lea esi, [ebx + 0x20]
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x1028506
push ebx
push 0x10080c5
push dword [ebx + 0xe0]
call dword [fcn.01007a14]
and dword [ebp - 4], 0
lea esi, [ebx + 0x44]
mov ecx, dword [ebp - 4]
shl ecx, 3
mov eax, dword [ecx + 0x1007f98]
mov ecx, dword [ecx + 0x1007f9c]
lea edi, [esi - 4]
mov dword [ebx + 0x28], ecx
cmp dword [edi], 0
mov dword [ebp - 0xc], eax
je 0x1028516
push dword [ebp - 4]
mov ecx, ebx
call fcn.01007ff7
test eax, eax
je 0x1008324
test byte [ebx + 0x28], 8
je 0x10082c5
push 0x20000
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x102852b
push dword [ebp - 0xc]
call fcn.0100834a
test eax, eax
jne 0x100b6c6
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x100b6c6
mov eax, dword [edi]
test eax, eax
je 0x100b60e
push dword [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_ILIsEqual]
test eax, eax
je 0x100b60e
cmp dword [esi], 0
jne 0x100b60e
cmp dword [esi + 4], 0
je 0x100b60e
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_ILFree]
inc dword [ebp - 4]
add esi, 0x1c
cmp dword [ebp - 4], 6
jb 0x100827a
pop edi
pop esi
mov dword [ebx + 0xf4], 1
xor eax, eax
pop ebx
leave
ret
mov ecx, dword [edi]
xor edx, edx
cmp ecx, edx
je 0x100b61a
cmp dword [esi], edx
je 0x100b684
mov eax, dword [esi - 0xc]
cmp eax, edx
mov dword [esi], edx
mov dword [esi - 8], eax
je 0x100b6bf
mov eax, dword [eax]
push ecx
mov dword [esi + 0xc], eax
mov dword [esi + 8], edx
call dword [sym.imp.SHELL32.dll_ILFree]
and dword [edi], 0
push 4
lea ecx, [esi - 0xc]
call fcn.01007980
test eax, eax
je 0x100b67b
push dword [ebp - 8]
push dword [ebx + 0x2c]
call fcn.0100b552
test eax, eax
mov dword [ebp - 0xc], eax
je 0x100b67b
mov eax, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [edi], eax
lea eax, [esi - 0xc]
push eax
push dword [ebp - 0xc]
mov ecx, ebx
call fcn.0100b8f2
mov ecx, dword [ebp - 0xc]
call fcn.01007f52
lea eax, [esi - 8]
push eax
call fcn.0100b6d8
cmp dword [ebx + 4], 0
je 0x100831b
cmp dword [esi + 4], 0
jne 0x100831b
mov edi, dword [edi]
test edi, edi
je 0x100831b
xor eax, eax
inc eax
push eax
push edi
push 0x2381f
push dword [ebp - 4]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 4]
call fcn.01009c0d
jmp 0x100831b
xor eax, eax
jmp 0x100b62c
lea ecx, [esi - 0xc]
call fcn.01011722
jmp 0x1008324
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
jmp 0x1008261
push edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [esi], 1
jmp 0x100829e
or dword [ebx + 0x28], 1
jmp 0x10082c5
Function at 0x1008f9d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x7c], ebx
jne 0x1008fc6
cmp dword [esi + 0x74], ebx
je 0x1008fc6
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1012d20
pop esi
pop ebx
leave
ret
push edi
xor edi, edi
inc edi
push edi
push ebx
push 0x100bf94
push 0x100bdb8
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
test eax, eax
je 0x1012d63
dec dword [esi + 0x74]
push 3
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [esi + 0x7c], edi
mov esi, dword [esi + 0x24]
push 0x4e
push esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0xd1
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_Ordinal_178]
pop edi
jmp 0x1008fc6

Function at 0x100925f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, ecx
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x48]
xor ebx, ebx
cmp eax, ebx
je 0x1009288
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push 1
push ebx
push eax
call dword [ecx + 0x24]
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x1009080
push 0x1008fd0
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 8], 8
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
add edi, 0xc
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x10092d1
mov ecx, esi
mov dword [esi + 0x74], 3
call fcn.01008f9d
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4
Function at 0x100eaf0
Capabilities:
Set registry value

Disassembly:
push 0
push 1
push 0x590
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
mov edi, edi
push esi
mov esi, ecx
call fcn.0100eb82
test eax, eax
je 0x100da6c
push 0x40000042
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x100da6c
call fcn.0100be97
test eax, eax
je 0x102548d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x100da7e
push 1
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push 0
push 0
push 0x590
push dword [esi + 4]
mov dword [esi + 0x43c], 1
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 1
push 0xf3
push 0x130
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
pop esi
jmp fcn.0100ecf2
push 0
push 1
push 0x590
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x321
push 0x320
mov ecx, esi
call fcn.0102feb1
pop esi
ret

Function at 0x100eb82
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x100ebd4
push 0x100bdb8
push 0x80000001
mov esi, ecx
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call fcn.0100be97
test eax, eax
je 0x102546c
cmp dword [ebp - 4], 2
sbb eax, eax
neg eax
pop esi
leave
ret
mov eax, dword [ebp - 4]
sub eax, 0
je 0x1025485
dec eax
jne 0x102547e
mov ecx, esi
call fcn.0100ecf2
xor eax, eax
jmp 0x100ebce
xor eax, eax
inc eax
jmp 0x100ebce
Function at 0x100ec99
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, edi
mov byte [ebp - 1], 0
je 0x100ecda
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x100ecda
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
mov dword [ecx], edi
push 0x17
mov dword [eax], edi
call esi
test eax, eax
jne 0x100ece2
push 0x16
call esi
test eax, eax
jne 0x100ece2
push 0x15
call esi
test eax, eax
jne 0x100ece2
pop esi
mov al, byte [ebp - 1]
pop edi
leave
ret 8
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
jmp 0x10225c8
test eax, eax
je 0x100ecd9
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
push 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
pop edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1022988
push 0x1022920
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x1022621
cmp dword [ebp - 8], eax
je 0x1022621
mov eax, dword [ebp + 8]
mov dword [eax], 0x1022910
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x10228fc
jmp 0x10226f3
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10228d4
push 0x1022860
push ebx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x1022653
cmp dword [ebp - 0x10], edi
jne 0x1022653
cmp dword [ebp - 8], eax
jne 0x10226f7
push 0x15
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x10226f7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1022850
push 0x10227e0
mov ebx, 0x80000001
push ebx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x102268b
cmp dword [ebp - 8], eax
je 0x10226f7
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10227d0
push 0x1022758
push ebx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x10226b2
cmp dword [ebp - 8], eax
je 0x10226f7
call fcn.0102b0f9
test al, al
jne 0x10226f7
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1022920
push ebx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x10226e1
cmp dword [ebp - 8], eax
je 0x10226f7
mov eax, dword [ebp + 8]
mov dword [eax], 0x1022740
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x1022700
mov byte [ebp - 1], 1
pop ebx
jmp 0x100ecd9

Function at 0x100ecf2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0x100ebd4
push 0x100bdb8
push 0x80000001
mov dword [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
leave
ret