joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10211cd
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x1046080]
or dword [ebp + 0x1c], 4
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x614], edi
mov word [ebp - 0x20c], bx
jne 0x10253be
mov dword [ebp - 0x610], ebx
cmp esi, ebx
je 0x10253ef
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10253ef
cmp word [ebp - 0x20c], bx
je 0x102125d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x102125d
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x10253da
cmp eax, 5
je 0x10253da
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10253ef
cmp dword [ebp + 0x14], ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
jne 0x1025405
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x1025423
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x10460dc]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x610], eax
jmp 0x102120b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x102125d
push ebx
push 0x10
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x1021272
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x14]
push dword [0x10460dc]
call esi
lea ebx, [ebp - 0x40c]
jmp 0x1021286
push edi
lea eax, [ebp - 0x60c]
push eax
push dword [ebp + 0x18]
push dword [0x10460dc]
call esi
lea eax, [ebp - 0x60c]
jmp 0x1021291
Function at 0x10214bb
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
je 0x10281ef
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
push ecx
setne bl
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
call esi
cmp eax, ebx
je 0x1021adb
pop esi
pop ebx
pop edi
leave
ret 0x10
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x1021aeb
mov ecx, dword [ebp - 4]
jmp 0x10214e8
push 1
push edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call ebx
test eax, eax
je 0x1021b1c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x20], 0x20
je 0x10281ff
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1021aeb
cmp dword [ebp + 0x10], 0xffffffff
je 0x1021ae3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x10214e8
or eax, 0xffffffff
cmp ecx, eax
jne 0x10214e0
jmp 0x1021506
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1021aeb

Function at 0x1021e7a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov edi, ecx
cmp dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x1021ee0
cmp dword [ebp + 8], ebx
push esi
push 5
pop eax
lea esi, [edi + 8]
jne 0x1026bb1
inc dword [esi]
cmp dword [esi], eax
ja 0x1021edf
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push 0x101fe78
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021edf
push 4
push esi
push 4
push ebx
push 0x101fef4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov dword [edi + 0xc], ebx
pop edi
pop ebx
leave
ret 4
mov dword [esi], eax
jmp 0x1021ea0

Function at 0x1021f7c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax + 0xc], 0x71
push edi
mov edi, ecx
je 0x1028efc
xor eax, eax
pop edi
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jl 0x1028f37
push 0x11
call esi
test ax, ax
jl 0x1028f37
push 0x12
call esi
test ax, ax
jl 0x1028f37
test byte [edi + 0x48], 8
je 0x1028f37
mov ecx, edi
call fcn.0101afab
test eax, eax
jl 0x1028f37
push eax
mov ecx, edi
call fcn.0103ff33
pop esi
jmp 0x1021f92
Function at 0x102b54f
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb00
mov eax, dword [0x1046080]
push ebx
push esi
push edi
push 0x1d
mov dword [ebp - 4], eax
mov edi, 0x1030
mov ebx, 0x21a
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x102b57f
add edi, 4
inc ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0xa4]
push eax
push 0x20c
push dword [0x10460dc]
call esi
push 0x400
lea eax, [ebp - 0xaac]
push eax
push ebx
push dword [0x10460dc]
call esi
push edi
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xaac]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x102b633
push 0x104
lea eax, [ebp - 0x2ac]
push eax
push 0x102b640
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0xb00], esi
lea edi, [ebp - 0xafc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0xb00]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b633
push dword [ebp - 0xab8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xabc]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret

Function at 0x102b715
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1046080]
push 7
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x102b759
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 2
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x34]
jmp 0x102b75c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4
Function at 0x102b7c6
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x1046080]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push esi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x624], esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp eax, esi
mov dword [ebp - 0x628], eax
je 0x102b99b
push ebx
push eax
call fcn.0102b2f7
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x62c], eax
je 0x102b992
lea ecx, [ebp - 0x644]
push ecx
push 4
push eax
push 0x102b348
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 0x620], eax
je 0x102b98a
push edi
xor eax, eax
mov dword [ebp - 0x63c], esi
lea edi, [ebp - 0x638]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x688], esi
lea edi, [ebp - 0x684]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102b973
push 0x102ba18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x102b973
push dword [ebp - 0x640]
lea eax, [ebp - 0x61c]
push 0x400
push 0x102b9b0
push 0x208
push eax
call fcn.0101f965
add esp, 0x14
test eax, eax
jl 0x102b973
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x688]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x688], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b973
push dword [ebp - 0x63c]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x102b94d
push dword [ebp - 0x638]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x624], 1
call edi
push dword [ebp - 0x620]
call edi
cmp dword [ebp + 0xc], esi
je 0x102b95b
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 0x620]
push esi
call fcn.010214bb
jmp 0x102b95b
push 5
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x63c]
call ebx
push dword [ebp - 0x638]
call ebx
cmp dword [ebp - 0x624], esi
jne 0x102b981
push 5
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x620]
call ebx
pop edi
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x628]
call ebx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
pop esi
call fcn.01001aff
leave
ret 8
Function at 0x102bada
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x102baf3
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x102bbf9
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0x102bc30
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x102bbf7
cmp dword [ebp - 8], ebx
jne 0x102bbf7
cmp dword [ebp - 4], ebx
jne 0x102bbf7
cmp dword [ebp - 0xc], eax
je 0x102bbf7
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ebx, 0x102bc18
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102bbf7
cmp dword [ebp - 8], 3
jne 0x102bbf7
test dword [ebp - 4], 3
jne 0x102bbf7
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi + 8], eax
je 0x102bbf7
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102bbea
cmp dword [ebp - 8], 3
jne 0x102bbea
mov eax, dword [ebp - 4]
test al, 3
jne 0x102bbea
shr eax, 2
mov edi, eax
cmp edi, 0xa
jle 0x102bbea
cmp edi, 0xca
jge 0x102bbea
xor ecx, ecx
inc ecx
cmp ecx, edi
mov dword [esi + 0x10], edi
jge 0x102bbe8
mov eax, dword [esi + 8]
add eax, 4
mov edx, dword [eax]
cmp edx, dword [eax - 4]
jbe 0x102bbe6
cmp edx, 0xffff
ja 0x102bbe6
inc ecx
add eax, 4
cmp ecx, dword [esi + 0x10]
jl 0x102bbce
cmp ecx, edi
je 0x102bbf7
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi + 8], 0
pop edi
pop ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x102bc05
mov dword [esi + 0xc], eax
jmp 0x102bc13
mov dword [esi + 0xc], 0x102bc58
mov dword [esi + 0x10], 0x1a
pop esi
leave
ret

Function at 0x102bcc5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x102bd00
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x102bd00
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [esi + 4]
push 4
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ecx, esi
pop esi
jmp fcn.0102bada
pop esi
ret
Function at 0x102cbd6
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
and dword [ebp - 4], edi
push edi
push 0x10133f0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [ebp + 8]
jne 0x102cc41
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push 0x102cc64
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102cc34
cmp dword [ebp - 8], 1
jne 0x102cc34
cmp word [ebx], ax
je 0x102cc34
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x102cc5a
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test edi, edi
je 0x102cc5a
push 1
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x102db08
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4
Function at 0x1031d8c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1046080]
push ebx
push edi
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.01031cd7
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x220], eax
setne al
cmp dword [ebp + 8], 0xffffffff
je 0x1031f66
cmp dword [ebp - 0x220], 0xffffffff
setne cl
cmp al, cl
je 0x1031f66
cmp al, bl
je 0x1031f7a
lea eax, [ebp - 0x210]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1031f66
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x1031f98
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
cmp eax, ebx
mov dword [ebp - 0x210], eax
je 0x1031f66
push esi
lea eax, [ebp - 0x218]
push eax
push 0x1031fec
push 3
push ebx
mov esi, 0x102a300
push esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1031f59
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
lea edx, [ebp - 0x214]
push edx
push 0x1015c24
push eax
call dword [ecx]
test eax, eax
jl 0x1031f4d
push dword [ebp - 0x210]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1031f41
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x18]
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
push 1
push esi
push dword [ebp - 0x214]
mov esi, dword [sym.imp.SHLWAPI.dll_IUnknown_Exec]
mov word [ebp - 0x230], 3
mov dword [ebp - 0x228], 0x1a
call esi
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x2f
push 0x1031ffc
push dword [ebp - 0x214]
mov dword [ebp - 0x228], ebx
call esi
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
push edx
push 0x100af7c
push eax
call dword [ecx]
test eax, eax
jl 0x1031f41
mov eax, dword [edi + 0x40]
push dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x1031f35
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
push 2
movsx eax, ax
push 2
push eax
push ecx
call dword [edx + 0x18]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
pop edi
pop ebx
call fcn.01001aff
leave
ret 4
mov ecx, edi
call fcn.01031cd7
cmp eax, 0xffffffff
je 0x1031f66
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
jmp 0x1031f7a
Function at 0x1032038
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1046080]
push 0x208
mov dword [ebp - 4], eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
push dword [0x10460dc]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10320cc
and dword [ebp - 0x450], 0
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x44c]
rep stosd dword es:[edi], eax
push 0x3e
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
pop edi
je 0x1032099
and word [eax], 0
inc eax
inc eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x414]
push eax
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x440], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4
Function at 0x1032f0f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1046080]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], 1
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1032f85
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push ebx
push 0x1033018
push 0x104
push eax
call fcn.0101f965
add esp, 0x14
inc dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1032f3b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01006409
jmp 0x1032ff9
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
test edi, edi
je 0x1032ff8
push edi
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.0100660f
and word [edi], 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push ebx
push 0x1033008
push 0x104
push eax
call fcn.0101f965
add esp, 0x18
inc dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1032fa9
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01006409
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01001aff
leave
ret 8
Function at 0x103391e
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1046080]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
push 0x1033a24
push ebx
mov dword [ebp - 4], eax
mov edi, ecx
call esi
test eax, eax
jne 0x1033963
cmp dword [0x1046090], eax
push 1
sete al
mov ecx, edi
push eax
call fcn.01002d89
jmp 0x10339ff
push 0x1033a18
push ebx
call esi
test eax, eax
jne 0x10339ff
and dword [ebp - 0x248], eax
push 0xe
pop ecx
lea edi, [ebp - 0x244]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10339ff
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
test eax, eax
mov dword [ebp - 0x224], eax
je 0x10339ff
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x244], 4
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x23c], 0x1029e1c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 0x224]
call dword [sym.imp.SHELL32.dll_ILFree]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret 4

Function at 0x1033a37
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4cc
mov eax, dword [0x1046080]
push ebx
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
push 0x16
lea eax, [ebp - 0x478]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1033b26
cmp dword [ebp + 8], ebx
push esi
lea eax, [ebp - 0x270]
mov esi, 0x136
je 0x1033a7e
push 0x1033b58
jmp 0x1033a83
push 0x1033b38
push esi
push eax
call fcn.0100660f
push edi
lea eax, [ebp - 0x478]
push eax
push esi
lea eax, [ebp - 0x270]
push eax
call fcn.0101e2e9
push 0x1033b34
push esi
lea eax, [ebp - 0x270]
push eax
call fcn.0101e2e9
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c8]
rep stosd dword es:[edi], eax
inc eax
mov dword [ebp - 0x4a0], eax
mov word [ebp - 0x49c], ax
xor eax, eax
mov dword [ebp - 0x488], ebx
lea edi, [ebp - 0x484]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x4cc]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x270]
push eax
push ebx
mov dword [ebp - 0x4cc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x1033b25
push dword [ebp - 0x488]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x484]
call esi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01001aff
leave
ret 4
Function at 0x10341a9
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x440], esi
jne 0x103425a
push 2
push dword [ebp + 8]
call fcn.010216ab
test eax, eax
jne 0x103425a
push 0xffffffffffffffff
push esi
push 3
push 0x28
push 0x10083b4
call fcn.0102ba37
push esi
push esi
push esi
push 0x1034260
push 0x100bde0
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x103420c
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1034213
mov ecx, edi
call fcn.01033ef5
mov ecx, edi
call fcn.0103274c
push dword [ebp + 8]
lea esi, [edi + 0x400]
mov dword [esi], 2
call dword [sym.imp.SHELL32.dll_Ordinal_60]
and dword [esi], 0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jge 0x103425a
push 0x11
call esi
test ax, ax
jge 0x103425a
push 0x12
call esi
test ax, ax
jge 0x103425a
mov ecx, edi
call fcn.010319a3
pop edi
pop esi
pop ebp
ret 4

Function at 0x1034b27
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
mov ebx, SysReAllocString
je 0x1034bcd
push 1
push 0x1019c34
push 0x101fe78
push ebx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
test eax, eax
mov dword [ebp - 4], eax
je 0x1034bcd
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
pop edi
push dword [esi + 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x14], 0x10001
call dword [0x102ad00]
test eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jbe 0x1034bbd
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_IStream_Write]
test eax, eax
jl 0x1034bbd
push dword [ebp - 4]
push dword [esi + 0x1c]
call dword [0x1034c08]
test eax, eax
je 0x1034bbd
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 8], 0
pop edi
jne 0x1034bff
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x101fe78
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034bff
push 0x1019c34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret