joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e7df
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0xa8], 0xffffffff
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esi + 4], eax
cmp eax, edi
je 0x102e91e
push ebx
push edi
push dword [0x10b10b4]
mov dword [ebp - 0xa8], edi
push edi
push eax
mov eax, 0x80000000
push eax
push eax
push eax
push eax
push 0x80000001
push edi
push 0x10321fc
push edi
call fcn.01031349
mov dword [esi + 0x50], eax
cmp eax, edi
je 0x102e896
mov eax, dword [esi + 4]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
push 0x50
lea eax, [ebp - 0xa4]
push eax
lea ebx, [esi + 0x1c]
push 0x35a
mov dword [ebx], 0x30
mov dword [esi + 0x20], 0xa1
push dword [0x10b10b4]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push edi
push 0x432
push dword [esi + 0x50]
lea eax, [ebp - 0xa4]
mov dword [esi + 0x40], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [esi + 0x50]
call fcn.01018ae7
push edi
push edi
push 0x1021468
mov ebx, 0x10213f0
push ebx
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
xor ecx, ecx
cmp eax, edi
sete cl
push 0x1f4
push 0x102e934
push ebx
add ecx, ecx
xor ecx, dword [esi + 0x74]
and ecx, 2
xor dword [esi + 0x74], ecx
call fcn.01010590
mov dword [esi + 0x60], eax
call dword [sym.imp.UxTheme.dll_BufferedPaintInit]
xor ecx, ecx
cmp eax, edi
sete cl
lea eax, [esi + 8]
push eax
push dword [esi + 4]
shl ecx, 4
xor ecx, dword [esi + 0x74]
and ecx, 0x10
xor dword [esi + 0x74], ecx
call dword [sym.imp.ole32.dll_RegisterDragDrop]
push 0xc
xor eax, eax
lea ecx, [ebp - 0xb4]
push ecx
inc eax
push eax
push edi
push dword [esi + 4]
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], eax
call dword [sym.imp.USER32.dll_SetGestureConfig]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa8]
pop edi
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret 4
Function at 0x1035291
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
and edi, 1
and dword [ebp - 0x418], 0
mov eax, 0x10353a0
test edi, edi
jne 0x10352c7
mov eax, 0x103538c
push ebx
push eax
push 0x1035340
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0100ecf0
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x1050857
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000001
mov dword [ebp - 0x41c], 0x208
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
je 0x1050813
test esi, esi
jne 0x1050857
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 8
cmp dword [ebp - 0x41c], eax
je 0x1035321
cmp word [ebp - 0x20c], ax
je 0x1035321
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xffc00000
add eax, 0x400000
or eax, 0x292013
push eax
push 0
push ebx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x1035321
test byte [ebp + 0xc], 2
je 0x1035329
jmp 0x105a1e8
cmp dword [ebp - 0x418], 0
jne 0x1035329
xor eax, eax
test edi, edi
sete al
mov dword [ebp - 0x418], 1
mov edi, eax
jmp 0x10352b9
Function at 0x10358c1
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x1052a46
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
mov eax, dword [ebp + 0xc]
push ebx
push edi
movsx edi, ax
shr eax, 0x10
movsx ebx, ax
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
pop edi
pop ebx
test eax, eax
je 0x10358db
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0106c95d
mov dword [ebp - 4], 1
jmp 0x10358db
Function at 0x1038e0b
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
test byte [0x10b1100], 1
push edi
mov edi, ecx
je 0x103ce10
mov eax, dword [0x10b10fc]
test eax, eax
jne 0x10533f0
pop edi
ret
or dword [0x10b1100], 1
push 0
push 0
push 0
push 0x103ce44
push 0x100f4a0
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
mov dword [0x10b10fc], eax
jmp 0x1038e20
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1038e28
push 0
push 0x100f000
push 3
push 0x10661b8
call fcn.01003c49
mov ecx, edi
pop edi
jmp fcn.0104d11f

Function at 0x1039f0e
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc10]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x1039f31
push ebx
push ebx
push 0x438
push eax
call edi
push ebx
push ebx
push 0x1f
push dword [esi + 4]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push ebx
push 1
push 0x43f
push dword [esi + 0xc10]
call edi
pop edi
lea ecx, [esi + 0xaf8]
pop esi
pop ebx
jmp fcn.0103884f

Function at 0x103c510
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
lea eax, [ebp - 0x28]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edi, [esi + 0x4c]
mov eax, dword [edi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi]
mov dword [ebp - 0xc], eax
cmp eax, ecx
jne 0x103c5ed
push ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x50]
jne 0x103c5ec
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
push 0
sbb dword [ebp - 0x14], eax
push 0x3e8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.01012959
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edx
push eax
call fcn.0103c608
mov ecx, eax
cmp ecx, dword [esi + 0x60]
jae 0x103c650
mov ebx, dword [esi + 0x5c]
cmp ecx, ebx
jae 0x103c672
mov eax, ecx
imul eax, eax, 0xff
xor edx, edx
div ebx
mov byte [ebp - 8], al
cmp ecx, dword [esi + 0x60]
jae 0x103c669
mov ebx, dword [esi + 0x60]
mov eax, ebx
sub eax, ecx
imul eax, eax, 0xff
xor edx, edx
div ebx
mov byte [ebp - 4], al
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.010173bb
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi]
cmp dword [ebp - 0xc], eax
je 0x103c549
pop ebx
mov eax, dword [edi]
cmp dword [ebp - 0xc], eax
jne 0x103c604
mov esi, dword [esi + 0x50]
cmp dword [ebp - 0x10], esi
jne 0x103c604
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
leave
ret
cmp ecx, dword [esi + 0x5c]
jb 0x103c595
push 0
push 0xff
mov ecx, esi
call fcn.010173bb
jmp 0x103c5ec
mov byte [ebp - 4], 0
jmp 0x103c5cc
mov byte [ebp - 8], 0
jmp 0x103c5af
Function at 0x103cc2d
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push 2
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_GetAncestor]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov ebx, eax
call edi
test ax, ax
jl 0x105cec8
xor eax, eax
neg eax
sbb eax, eax
and eax, 0x103cce0
push eax
push 0x100
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_Ordinal_571]
mov ebx, eax
test ebx, ebx
jl 0x103ccd3
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
and dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x100e
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
lea eax, [ebp - 0x10]
push eax
push 0
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x1c]
push eax
push 0xcc
push dword [esi + 0x44]
call fcn.01037520
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
cmp ebx, 0x800704c7
je 0x103cc80
jmp 0x103ccca
push 0x11
call edi
test ax, ax
jge 0x103cc5a
xor eax, eax
inc eax
jmp 0x103cc5c

Function at 0x1041e38
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10b110c], 0
push esi
je 0x1048d44
mov eax, dword [0x10b110c]
cmp eax, 1
je 0x1059adf
push eax
call dword [0x10b1114]
test eax, eax
je 0x1059af6
pop esi
ret
call fcn.01048d5b
test eax, eax
jne 0x1041e46
jmp 0x1059b0d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1059b0d
pop esi
ret
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1059b11
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x10b110c]
call dword [0x10b1114]
mov edi, eax
test edi, edi
je 0x1059b36
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1059b52
mov edi, esi
add esi, 0xff0
push edi
push dword [0x10b110c]
call dword [0x10b1110]
add edi, 0x10
cmp edi, esi
jb 0x1059b3e
mov eax, edi
pop edi
jmp 0x1041e63
Function at 0x104570d
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
and dword [esi], 0
push edi
push 0x1045778
call fcn.010457ad
lea eax, [ebp + 0xc]
push eax
push 0x1045798
call fcn.01045309
mov edi, eax
test edi, edi
jl 0x1045761
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push esi
movzx eax, ax
push 0x10451f4
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x1045788
call fcn.010457ad
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x104750f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, ecx
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x20]
and dword [edi + 0x60], 0
and dword [edi + 0x5c], 0
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x24]
and eax, 0xe0000000
mov dword [ebp + 8], eax
jne 0x104755a
push 0xffffffffffffffec
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_GetWindowLongW]
shl eax, 7
not eax
and eax, 0x20000000
or eax, 0x40000000
mov dword [ebp + 8], eax
mov ecx, edi
call fcn.0103b73f
lea ebx, [edi + 0x6c]
mov eax, dword [ebx]
test eax, eax
jne 0x105b963
push ebx
call fcn.01018201
mov eax, dword [edi + 0x58]
and dword [ebp - 4], 0
cmp eax, dword [edi + 0x1e0]
je 0x105b973
push dword [esi + 0xc]
mov ecx, edi
call fcn.0104720f
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.010472c6
xor ebx, ebx
cmp eax, ebx
jl 0x104760b
mov eax, dword [esi + 0x24]
or eax, dword [ebp + 8]
mov ecx, dword [edi + 0x6c]
push eax
add esi, 0x10
push esi
call fcn.01047619
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ebx
jne 0x105b9c7
cmp dword [0x10b21ec], ebx
je 0x10475f6
mov al, byte [0x10b21f0]
cmp al, 4
jb 0x1047605
mov ecx, dword [0x10b21d8]
mov edx, dword [0x10b21dc]
mov eax, 0x10000
mov esi, 0x80000000
and ecx, eax
and edx, esi
or ecx, edx
jne 0x105ba31
cmp dword [ebp + 8], 0
jl 0x104760b
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
test al, al
je 0x10475d4
jmp 0x10475f6
mov ecx, edi
call fcn.01046b4e
jmp 0x10475fc
mov eax, dword [eax + 4]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x24]
jmp 0x104756e
lea ebx, [edi + 0x68]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
test eax, eax
je 0x105b996
push dword [esi + 0xc]
push dword [eax + 0xc]
call fcn.0107e942
test eax, eax
je 0x105b996
xor eax, eax
jmp 0x105b9bb
push ebx
call fcn.01018201
push dword [esi + 0xc]
mov ecx, edi
call fcn.0104720f
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.010472c6
test eax, eax
jl 0x104760b
mov ebx, dword [ebx]
mov dword [edi + 0x6c], ebx
inc dword [ebx]
jmp 0x104759e
cmp dword [0x10b21ec], ebx
je 0x10475f6
mov al, byte [0x10b21f0]
cmp al, 4
jae 0x105b9e4
test al, al
jne 0x10475f6
mov ecx, dword [0x10b21d8]
mov edx, dword [0x10b21dc]
mov eax, 0x10000
mov esi, 0x80080000
and ecx, eax
and edx, esi
or ecx, edx
je 0x10475f6
mov ecx, dword [0x10b21e0]
mov ebx, dword [0x10b21e4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0x10475f6
cmp eax, ebx
jne 0x10475f6
push 0x1065a38
jmp 0x105ba5a
mov ecx, dword [0x10b21e0]
mov ebx, dword [0x10b21e4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0x10475f6
cmp eax, ebx
jne 0x10475f6
push 0x105ba70
push dword [0x10b219c]
push dword [0x10b2198]
call fcn.010127a5
jmp 0x10475f6
Function at 0x104838b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push 0xcd
mov dword [ebp - 0x104], ebx
call fcn.010482df
mov esi, eax
mov dword [ebp - 0x100], esi
test esi, esi
je 0x10484d9
cmp dword [ebp + 8], 0
push edi
je 0x1054680
cmp dword [ebx + 0x3c8], 0
jne 0x105466d
cmp dword [ebx + 0xc7c], 0
jne 0x1054699
mov eax, dword [ebx + 0xd28]
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push eax
mov esi, 0x1a8
push esi
push dword [ebp - 0x100]
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea eax, [ebp - 0x11c]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
call fcn.010315dd
test eax, eax
jne 0x10484e9
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x118]
je 0x10484e9
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
push eax
push esi
push dword [ebp - 0x100]
call edi
cmp dword [ebx + 0xc70], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, dword [sym.imp.USER32.dll_ModifyMenuW]
jne 0x10546c0
push 0
push 0x1a0
push dword [ebp - 0x100]
call dword [sym.imp.USER32.dll_DeleteMenu]
cmp dword [0x10b10f4], 0
jne 0x1054745
mov ecx, dword [ebp - 0x104]
call fcn.01048242
test eax, eax
je 0x1054778
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0x10
push 0x10481c4
push 0x10484f8
push 0x80000001
mov dword [ebp - 0x10c], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x10547aa
mov eax, dword [ebp - 0x100]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 4
push 3
pop eax
jmp 0x104843d
push 0x400
push 1
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x10483dc
push 2
pop edi
push 0x400
push edi
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
dec edi
js 0x10483dc
jmp 0x1054683
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x1a8
push esi
call edi
cmp dword [ebp + 8], 0
jne 0x104844d
push 1
push 0x19d
push esi
jmp 0x104844b
mov eax, dword [ebp - 0x104]
cmp dword [eax + 0xcd4], 0
je 0x1048466
cmp dword [0x10b10f4], 0
jne 0x1048466
push 0x1e
lea eax, [ebp - 0x7c]
push eax
push 0x216
push dword [0x10b10b4]
call esi
push 0x1e
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax + 0xcd4]
push dword [eax]
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xfc]
push 0x40
push eax
call fcn.0100ecf0
add esp, 0x10
lea eax, [ebp - 0xfc]
push eax
mov eax, 0x1a0
push eax
push 0
push eax
push dword [ebp - 0x100]
call ebx
jmp 0x1048479
push 0x40
lea eax, [ebp - 0xfc]
push eax
push 0x352
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0xfc]
push eax
mov eax, 0x197
push eax
push 0
push eax
push dword [ebp - 0x100]
call ebx
jmp 0x1048486
push 3
push 0x193
push dword [ebp - 0x100]
call edi
push 3
push 0x194
push dword [ebp - 0x100]
call edi
push 3
push 0x195
push dword [ebp - 0x100]
call edi
jmp 0x1048499
cmp dword [ebp - 0x108], eax
je 0x10484d2
push 3
push 0x1a4
push dword [ebp - 0x100]
call edi
jmp 0x10484d2
Function at 0x104a249
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
call esi
mov edi, dword [ebp + 8]
test ax, ax
jl 0x1059f0f
push 0x11
call esi
test ax, ax
jl 0x1059f1a
pop edi
pop esi
pop ebp
ret 4
or dword [edi], 0x10000000
jmp 0x104a266
or dword [edi], 0x40000000
jmp 0x104a273
Function at 0x104e223
Capabilities:
Create process on windows

Disassembly:
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push edi
mov ecx, esi
call fcn.0104ec7d
push dword [0x10b10e8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x104e25f
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push edi
mov ecx, esi
call fcn.0106f4a5
jmp 0x104e25f
push 0
push 0x1f7
call fcn.01035783
jmp 0x104e25f
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x30002
push 0x127
lea edi, [esi + 0xc04]
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi]
mov ecx, esi
call fcn.01038ded
jmp 0x104e25f
push 0x102c83c
push dword [esi + 4]
call fcn.01034485
test eax, eax
jne 0x104e25f
push 0x1065bcc
push 0x1029150
push dword [esi + 4]
call fcn.0106da1a
jmp 0x104e25f
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x104e25f
mov ecx, esi
call fcn.0106e064
jmp 0x104e25f
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x104e25f
push eax
push 0xa086
mov ecx, esi
jmp 0x104e013
push ebx
mov ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebx
je 0x104e0d9
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
cmp edi, 0x1fb
sete al
push 0
lea eax, [eax + eax - 1]
push eax
push 0x43d
push dword [esi + 0xc10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebx
jmp 0x104e25f
push 5
xor edi, edi
push edi
push 0x104e210
push 0x104e1f8
push edi
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x104e25f
push 1
push 0
push 0x10b3700
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x104e25f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push 1
mov ecx, esi
call fcn.0106f981
jmp 0x104e25f
xor edi, edi
cmp dword [0x10b10f4], edi
jne 0x104e25f
push 2
push dword [esi + 4]
push edi
push 1
call dword [sym.imp.dwmapi.dll_Ordinal_113]
jmp 0x104e25f
call fcn.0106e0bd
jmp 0x104e25f
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, dword [esi + 0xe04]
je 0x104e266
lea eax, [edi - 0x1f4]
mov dword [esi + 0xe04], edi
cmp eax, 0x41
ja case.0x104e253.514
movzx eax, byte [eax + 0x104e1b3]
jmp dword [eax*4 + 0x104e177]
call fcn.0104e589
or dword [esi + 0xe04], 0xffffffff
pop edi
pop esi
pop ebp
ret 8
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
xor eax, eax
cmp dword [0x10b10f4], edi
push 1
sete al
mov ecx, esi
push eax
call fcn.010078f4
push 1
call fcn.0104f05f
jmp 0x104e25f
push dword [ebp + 0xc]
push edi
call fcn.0106f7c6
jmp 0x104e25f
Function at 0x104e425
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp + 0x1c], 4
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x614], edi
mov word [ebp - 0x20c], ax
cmp dword [ebp + 0xc], ebx
jne 0x10531eb
mov dword [ebp - 0x610], ebx
cmp esi, ebx
je 0x105321c
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x105321c
cmp word [ebp - 0x20c], bx
je 0x104e4b9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x104e4b9
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x1053207
cmp eax, 5
je 0x1053207
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x105321c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
cmp dword [ebp + 0x14], ebx
je 0x104e4f7
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x14]
push dword [0x10b10b4]
call esi
lea ebx, [ebp - 0x40c]
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x1053232
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x10b10b4]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x610], eax
jmp 0x104e467
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x104e4b9
push ebx
push 0x10
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x104e4ce
push edi
lea eax, [ebp - 0x60c]
push eax
push dword [ebp + 0x18]
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0x60c]
jmp 0x104e502

Function at 0x106a2e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x106a360
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100ecf0
add esp, 0x10
test eax, eax
jl 0x106a34f
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0
push 0x10002
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
neg eax
sbb eax, eax
inc eax
jmp 0x106a351
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100204d
leave
ret 0xc
Function at 0x106a9a5
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
mov dword [ebp - 0x40], 0x3c
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1029170
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 0x2000100
mov dword [ebp - 0x34], 0x1065bcc
call sub.SHELL32.dll_SHGetKnownFolderIDList
test eax, eax
jl 0x106a9f9
mov eax, dword [ebp - 4]
or dword [ebp - 0x3c], 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_ILFree]
leave
ret