joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10081380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
mov ebp, dword [esp + 0x124]
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
mov byte [ebp], 0
test ebx, ebx
je 0x100813b0
mov byte [ebx], 0
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.systemcurrentcontrolsetcontrolcomputernamecomputername
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call edi
test esi, esi
jne 0x10081467
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push esi
push esi
push str.computername
push edx
mov dword [esp + 0x34], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10081455
push eax
call edi
test ebx, ebx
je 0x10081446
push 0x103
lea eax, [esp + 0x25]
push esi
push eax
mov byte [esp + 0x2c], 0
call fcn.1012e060
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x24]
call fcn.100652a0
mov ecx, esi
push ecx
push str.Unable_to_read_ComputerName_key__Error:__s
push ebx
call fcn.10127dc0
add esp, 0x10
mov edx, dword [esp + 0x10]
push edx
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100814b0
mov edx, dword [esp + 0x10]
push edx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100814b0
push esi
call edi
test ebx, ebx
je 0x100814ae
push 0x103
lea eax, [esp + 0x25]
push 0
push eax
mov byte [esp + 0x2c], 0
call fcn.1012e060
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x24]
call fcn.100652a0
mov ecx, esi
push ecx
push str.Unable_to_read_ComputerName_key__Error:__s
push ebx
call fcn.10127dc0
add esp, 0x10
xor ebx, ebx
cmp byte [ebp], 0
mov eax, ebp
je 0x100814be
inc eax
cmp byte [eax], 0
jne 0x100814b8
sub eax, ebp
mov esi, eax
test ebx, ebx
je 0x100814d5
cmp byte [ebp], 0
je 0x100814d5
cmp esi, 0xf
jl 0x10081575
push 0x103
lea edx, [esp + 0x25]
push 0
push edx
mov byte [esp + 0x2c], 0
call fcn.1012e060
add esp, 0xc
push str.Hostname
lea eax, [esp + 0x18]
lea edi, [esp + 0x24]
mov ecx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov edx, reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0x104
call fcn.10059d80
cmp byte [esp + 0x20], 0
je 0x10081575
mov edi, 1
lea eax, [esp + 0x20]
cmp esi, 0xf
jne 0x1008154c
inc eax
cmp byte [eax], 0
jne 0x10081527
lea ecx, [esp + 0x20]
sub eax, ecx
cmp eax, 0xf
jbe 0x1008155e
mov edx, ebp
mov eax, ecx
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10081540
jmp 0x1008155e
mov edx, ebp
lea ecx, [esp + 0x20]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10081554
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10081569
mov byte [eax], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x10081577
mov eax, ebx
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x118
ret 4
Function at 0x100818f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
test byte [0x101cd970], 1
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
jne 0x10081914
or dword [0x101cd970], 1
call esi
mov dword [0x101cd96c], eax
xor edi, edi
cmp dword [0x101a477c], 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
je 0x10081947
call esi
sub eax, dword [0x101cd96c]
cmp eax, 0x6d60
ja 0x10081947
mov eax, dword [0x101a477c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call esi
mov dword [0x101cd96c], eax
push edi
lea eax, [esp + 0x18]
push eax
push edi
call fcn.10081810
add esp, 0xc
cmp eax, 0x7a
jne 0x10081a99
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10128320
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x10081a99
push 1
lea edx, [esp + 0x18]
push edx
push ebx
call fcn.10081810
add esp, 0xc
test eax, eax
jne 0x10081a90
push 4
call fcn.10128320
mov esi, eax
add esp, 4
cmp esi, edi
je 0x10081a90
lea eax, [esp + 0x18]
push eax
push esi
call fcn.10081b40
add esp, 8
cmp eax, 0x6f
jne 0x10081a84
push esi
call fcn.10128243
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call fcn.10128320
mov ebp, eax
add esp, 4
mov dword [esp + 0x1c], ebp
cmp ebp, edi
je 0x10081a90
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.10081b40
add esp, 8
test eax, eax
jne 0x10081a78
mov edi, dword [ebx]
xor esi, esi
test edi, edi
jbe 0x10081a47
lea edx, [ebx + 0x224]
mov eax, ebp
xor ecx, ecx
test ecx, ecx
jne 0x10081a27
mov ebp, dword [eax + 0x19c]
cmp ebp, dword [edx - 0x20]
jne 0x10081a1d
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x10081a0c
test ecx, ecx
je 0x10081a38
mov eax, dword [edx]
cmp eax, 3
je 0x10081a6d
cmp eax, 4
je 0x10081a6d
cmp eax, 5
je 0x10081a6d
mov ebp, dword [esp + 0x1c]
inc esi
add edx, 0x35c
cmp esi, edi
jb 0x10081a08
mov esi, dword [esp + 0x20]
push ebx
call fcn.10128243
add esp, 4
push ebp
call fcn.10128243
add esp, 4
mov dword [0x101a477c], esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x1c]
mov esi, 1
jmp 0x10081a4b
push ebx
call fcn.10128243
add esp, 4
push ebp
jmp 0x10081a91
push ebx
call fcn.10128243
add esp, 4
push esi
jmp 0x10081a91
push ebx
call fcn.10128243
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov dword [0x101a477c], eax
pop ebx
add esp, 0x14
ret
Function at 0x10082c20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
xor eax, eax
push esi
push edi
cmp dword [ebp + 0x18], eax
jne 0x10082c55
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
or eax, 0x50000
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp esi, eax
je 0x10082d35
mov ebx, dword [ebp + 0x10]
cmp ebx, eax
je 0x10082d35
cmp byte [esi], 0
mov eax, esi
je 0x10082c8c
inc eax
cmp byte [eax], 0
jne 0x10082c86
sub eax, esi
inc eax
push eax
call fcn.10128320
mov edi, eax
add esp, 4
test edi, edi
je 0x10082d35
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebx], 0
mov eax, ebx
je 0x10082cb7
inc eax
cmp byte [eax], 0
jne 0x10082cb1
sub eax, ebx
inc eax
push eax
call fcn.10128320
mov esi, eax
add esp, 4
test esi, esi
jne 0x10082cdb
push edi
call fcn.10128243
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0xc]
push edx
or ecx, 0x50000
push 0
push 0x10082b80
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
call fcn.10127f7d
add esp, 0xc
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x10082d35
cmp dword [esp + 0x1c], 0
jne 0x10082d35
mov esi, 5
call fcn.1005a8b0
cmp dword [esp + 0x1c], 0
je 0x10082d24
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10083430
Capabilities:
Check os version

Disassembly:
push ecx
push ebx
mov ebx, 1
test byte [0x101cd70c], bl
jne 0x10083472
or dword [0x101cd70c], ebx
cmp dword [0x101c8674], 0
jne 0x10083468
mov dword [0x101c8674], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10083468
cmp al, 6
jb 0x10083468
mov dword [0x101c8678], ebx
mov eax, dword [0x101c8678]
mov dword [0x101cd708], eax
mov eax, dword [0x101a4780]
cmp eax, 0xffffffff
jne 0x10083486
call fcn.100677f0
mov dword [0x101a4780], eax
cmp eax, 2
jle 0x100834d1
call fcn.10067710
test eax, eax
je 0x100834d1
cmp dword [0x101cd708], 0
je 0x100834a6
call fcn.10066930
test eax, eax
jne 0x100834d1
cmp esi, 0xfffffffe
jne 0x100834b9
lea ecx, [esp + 4]
push ecx
push 0
call fcn.10083610
jmp 0x100834bd
mov dword [esp + 4], esi
call fcn.100837e0
cmp eax, dword [esp + 4]
je 0x100834d1
test eax, eax
je 0x100834d1
xor eax, eax
pop ebx
pop ecx
ret
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10083610
Capabilities:
Check os version

Disassembly:
sub esp, 8
test byte [0x101cd720], 1
push ebx
push ebp
push esi
mov esi, 1
jne 0x10083634
or dword [0x101cd720], esi
call fcn.1006b740
mov dword [0x101cd71c], eax
mov eax, 2
test byte [0x101cd720], al
jne 0x10083674
or dword [0x101cd720], eax
cmp dword [0x101c8674], 0
jne 0x1008366a
mov dword [0x101c8674], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1008366a
cmp al, 6
jb 0x1008366a
mov dword [0x101c8678], esi
mov eax, dword [0x101c8678]
mov dword [0x101cd718], eax
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x1008367e
mov dword [ebx], esi
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1008368d
mov dword [ebp], 0
cmp dword [0x101cd71c], 0
jne 0x100836a1
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
cmp dword [0x101cbe00], 0
jne 0x100836c3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x101cbe00], eax
test eax, eax
je 0x10083696
cmp eax, 0xffffffff
je 0x10083696
cmp dword [0x101cbe10], 0
jne 0x10083722
mov ecx, str.Wtsapi32.dll
call fcn.1005a380
mov dword [0x101cbe10], eax
test eax, eax
je 0x10083696
cmp eax, 0xffffffff
je 0x10083696
mov ecx, dword [0x101cbe00]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push ecx
call esi
mov edx, dword [0x101cbe10]
push str.WTSQuerySessionInformationA
push edx
mov dword [0x101cbe04], eax
call esi
mov dword [0x101cbe08], eax
mov eax, dword [0x101cbe10]
push str.WTSFreeMemory
push eax
call esi
mov dword [0x101cbe0c], eax
mov eax, dword [0x101cbe04]
test eax, eax
je 0x10083696
cmp dword [0x101cbe08], 0
je 0x10083696
cmp dword [0x101cbe0c], 0
je 0x10083696
push edi
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x1008375f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 8
xor esi, esi
push edi
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [0x101cbe08]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x10083799
cmp dword [esp + 0x14], 4
jne 0x10083799
cmp ebx, esi
je 0x10083799
xor ecx, ecx
cmp dword [eax], esi
sete cl
mov dword [ebx], ecx
cmp eax, esi
je 0x100837a8
push eax
call dword [0x101cbe0c]
mov dword [esp + 0x10], esi
mov esi, edi
test ebp, ebp
je 0x100837b1
mov dword [ebp], edi
cmp dword [0x101cd718], 0
je 0x100837bf
test edi, edi
jbe 0x100837bf
dec edi
call fcn.100834e0
test eax, eax
je 0x100837d3
call fcn.10083430
test eax, eax
jne 0x100837d3
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10085ab0
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov ecx, str.SystemCurrentControlSetServicesTcpipParameters
cmp dword [esp + 0x1c], ebx
jne 0x10085b6e
lea eax, [esp + 0x10]
push eax
push str.MaxUserPort
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
mov ebp, 0xfffe
cmp al, 1
jne 0x10085af9
cmp dword [esp + 0x10], ebp
je 0x10085b02
jmp 0x10085afd
mov dword [esp + 0x10], ebx
mov edi, 1
lea ecx, [esp + 0x10]
push ecx
push str.MaxUserPortOld
mov ecx, str.SystemCurrentControlSetServicesTcpipParameters
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
cmp al, 1
je 0x10085b37
mov eax, dword [esp + 0x10]
mov esi, str.MaxUserPortOld
mov ebx, str.SystemCurrentControlSetServicesTcpipParameters
mov ecx, reloc.WS2_32.dll_bind
call fcn.10059bf0
test edi, edi
je 0x10085c2c
mov eax, ebp
mov esi, str.MaxUserPort
mov ebx, str.SystemCurrentControlSetServicesTcpipParameters
mov ecx, reloc.WS2_32.dll_bind
mov dword [esp + 0x10], ebp
call fcn.10059bf0
cmp al, 1
jne 0x10085c2c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
lea edx, [esp + 0x10]
push edx
push str.MaxUserPortOld
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
cmp al, 1
jne 0x10085c62
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
cmp eax, 0xfffe
jne 0x10085c38
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push ebx
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call edi
mov esi, eax
push esi
call ebp
cmp esi, ebx
jne 0x10085bf0
mov ecx, dword [esp + 0x1c]
push str.MaxUserPort
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10085be5
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call edi
mov esi, eax
push esi
call ebp
test esi, esi
jne 0x10085c2c
mov ecx, dword [esp + 0x1c]
push str.MaxUserPortOld
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, ebx
je 0x10085ba9
mov esi, str.MaxUserPort
mov ebx, str.SystemCurrentControlSetServicesTcpipParameters
mov ecx, reloc.WS2_32.dll_bind
call fcn.10059bf0
cmp al, 1
jne 0x10085bf0
mov dword [esp + 0x14], 1
jmp 0x10085bf0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10085c70
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov ecx, str.SystemCurrentControlSetServicesTcpipParameters
cmp dword [esp + 0x1c], ebx
jne 0x10085d2c
lea eax, [esp + 0x10]
push eax
push str.TcpTimedWaitDelay
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
lea ebp, [ebx + 0x3c]
cmp al, 1
jne 0x10085cb7
cmp dword [esp + 0x10], ebp
je 0x10085cc0
jmp 0x10085cbb
mov dword [esp + 0x10], ebx
mov edi, 1
lea ecx, [esp + 0x10]
push ecx
push str.TcpTimedWaitDelayOld
mov ecx, str.SystemCurrentControlSetServicesTcpipParameters
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
cmp al, 1
je 0x10085cf5
mov eax, dword [esp + 0x10]
mov esi, str.TcpTimedWaitDelayOld
mov ebx, str.SystemCurrentControlSetServicesTcpipParameters
mov ecx, reloc.WS2_32.dll_bind
call fcn.10059bf0
test edi, edi
je 0x10085de8
mov eax, ebp
mov esi, str.TcpTimedWaitDelay
mov ebx, str.SystemCurrentControlSetServicesTcpipParameters
mov ecx, reloc.WS2_32.dll_bind
mov dword [esp + 0x10], ebp
call fcn.10059bf0
cmp al, 1
jne 0x10085de8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
lea edx, [esp + 0x10]
push edx
push str.TcpTimedWaitDelayOld
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
cmp al, 1
jne 0x10085e1e
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
cmp eax, 0x3c
jne 0x10085df4
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push ebx
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call edi
mov esi, eax
push esi
call ebp
cmp esi, ebx
jne 0x10085dac
mov ecx, dword [esp + 0x1c]
push str.TcpTimedWaitDelay
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10085da1
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call edi
mov esi, eax
push esi
call ebp
test esi, esi
jne 0x10085de8
mov ecx, dword [esp + 0x1c]
push str.TcpTimedWaitDelayOld
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, ebx
je 0x10085d65
mov esi, str.TcpTimedWaitDelay
mov ebx, str.SystemCurrentControlSetServicesTcpipParameters
mov ecx, reloc.WS2_32.dll_bind
call fcn.10059bf0
cmp al, 1
jne 0x10085dac
mov dword [esp + 0x14], 1
jmp 0x10085dac
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10086030
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
push 1
xor ebp, ebp
push ebp
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
mov esi, ecx
call ebx
test eax, eax
jne 0x1008616e
push 0x103
push eax
lea ecx, [esp + 0x1d]
push ecx
mov byte [esp + 0x20], al
call fcn.1012e060
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ebp
push ebp
push str.ScreenSaveActive
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008616e
mov eax, dword [esp + 0xc]
xor edx, edx
cmp byte [esp + 0x14], 0x30
push edi
setne dl
push eax
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100860ec
cmp edi, 1
je 0x100860f5
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10127db1
add esp, 0x110
ret
cmp esi, 1
jne 0x100860d1
test edi, edi
jne 0x100860d1
push esi
lea ecx, [esp + 0x1c]
push 0x10159cd0
push ecx
call fcn.10127dc0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
jne 0x100860d1
cmp byte [esp + 0x18], 0
lea eax, [esp + 0x18]
je 0x10086136
nop
inc eax
cmp byte [eax], 0
jne 0x10086130
lea ecx, [esp + 0x18]
sub eax, ecx
inc eax
push eax
mov eax, dword [esp + 0x14]
mov edx, ecx
push edx
push 1
push 0
push str.ScreenSaveActive
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x100860d3
mov ecx, dword [esp + 0x118]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x110
ret
Function at 0x10086190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x740
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x73c], eax
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x63d]
push ebx
push eax
mov byte [esp + 0x644], bl
call fcn.1012e060
add esp, 0xc
push 0x103
lea ecx, [esp + 0x115]
push ebx
push ecx
mov byte [esp + 0x11c], bl
call fcn.1012e060
add esp, 0xc
push 0x103
lea edx, [esp + 0x535]
push ebx
push edx
mov byte [esp + 0x53c], bl
call fcn.1012e060
add esp, 0xc
push 0x103
lea eax, [esp + 0xd]
push ebx
push eax
mov byte [esp + 0x14], bl
call fcn.1012e060
lea ecx, [esp + 0x14]
add esp, 0xc
push ecx
lea edx, [esp + 0x114]
lea ecx, [esp + 0x63c]
call fcn.10071b20
add esp, 4
cmp byte [esp + 8], bl
jne 0x10086256
cmp byte [esp + 0x110], bl
je 0x10086256
lea ecx, [esp + 8]
lea edx, [esp + 0x110]
call fcn.10060880
lea edx, [esp + 0x110]
push edx
push 0x104
lea eax, [esp + 0x538]
push eax
push 0x1014d980
push str.InstalledForEScan
push 0x10156244
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ebx, ebx
cmp byte [esp + 0x530], 0x30
setne bl
cmp byte [esp + 8], 0
je 0x100862ae
lea ecx, [esp + 8]
push 0
push ecx
call fcn.100612a0
add esp, 8
test eax, eax
je 0x100862ae
lea edx, [esp + 8]
push edx
jmp 0x100862b6
lea eax, [esp + 0x638]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call edi
test ebx, ebx
jne 0x100863e2
push 0x103
lea ecx, [esp + 0x325]
push ebx
push ecx
mov byte [esp + 0x32c], bl
call fcn.1012e060
add esp, 0xc
push 0x104
lea edx, [esp + 0x324]
push edx
push 0x1014d5e3
mov edx, str.InstallDirectory
mov ecx, str.MailScan
call fcn.1005ffb0
add esp, 0xc
cmp byte [esp + 0x320], bl
je 0x100863e2
lea eax, [esp + 0x320]
push ebx
push eax
call fcn.100612a0
add esp, 8
cmp eax, 1
jne 0x100863e2
push 0x103
lea ecx, [esp + 0x42d]
push ebx
push ecx
mov byte [esp + 0x434], bl
call fcn.1012e060
add esp, 0xc
push 0x103
lea edx, [esp + 0x21d]
push ebx
push edx
mov byte [esp + 0x224], bl
call fcn.1012e060
add esp, 0xc
push esi
lea eax, [esp + 0x42c]
push eax
call edi
mov ecx, esi
call fcn.10065200
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.AVPLITE
push esi
call ebx
push 0
push esi
call fcn.100612a0
add esp, 8
test eax, eax
je 0x100863d7
push esi
lea edx, [esp + 0x21c]
push edx
call edi
lea ecx, [esp + 0x218]
call fcn.10065200
push str..avs
lea eax, [esp + 0x21c]
push eax
call ebx
push 1
push 0
xor edx, edx
lea ecx, [esp + 0x220]
call fcn.10060eb0
add esp, 8
test eax, eax
je 0x100863e2
lea ecx, [esp + 0x428]
push ecx
push esi
call edi
mov ecx, dword [esp + 0x744]
pop edi
pop ebx
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret
Function at 0x10086670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor esi, esi
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0x10
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 8]
cmp eax, esi
je 0x10086703
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100866e8
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push esi
push esi
push esi
push str.SCRNSAVE.EXE
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 8]
cmp eax, esi
je 0x10086703
push esi
lea edx, [esp + 0xc]
push edx
push esi
push 0x72
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret

Function at 0x10086b20
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x830
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x82c], eax
push ebp
push esi
xor ebp, ebp
mov esi, ecx
push edi
mov dword [esp + 0x10], ebp
cmp esi, ebp
je 0x10086c65
cmp byte [esi], 0
je 0x10086c65
cmp ebx, ebp
je 0x10086c65
push ebp
push esi
mov byte [ebx], 0
call fcn.10069e60
add esp, 8
push esi
test eax, eax
jne 0x10086c27
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x820], ebp
call esi
push 0x1014d5e3
lea ecx, [esp + 0x418]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
push ebp
push 0x10086a20
mov dword [esp + 0x828], ebp
call fcn.10127f7d
add esp, 0xc
mov dword [esp + 0x824], eax
cmp eax, 0xffffffff
je 0x10086c36
cmp dword [esp + 0x81c], ebp
jne 0x10086bd3
mov esi, 5
call fcn.1005a8b0
cmp dword [esp + 0x81c], ebp
je 0x10086bc0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x2710
jae 0x10086c0b
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push 5
call ebp
cmp dword [esp + 0x818], 1
je 0x10086c15
call esi
sub eax, edi
cmp eax, 0x2710
jb 0x10086bf0
xor ebp, ebp
cmp dword [esp + 0x818], 1
jne 0x10086c52
cmp byte [esp + 0x414], 0
je 0x10086c36
lea eax, [esp + 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x82c]
xor ecx, esp
call fcn.10127db1
add esp, 0x830
ret
mov eax, dword [esp + 0x828]
cmp eax, ebp
je 0x10086c36
mov dword [eax], 1
jmp 0x10086c36
mov ecx, dword [esp + 0x838]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.10127db1
add esp, 0x830
ret