joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b4b0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b65b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x44b63c
mov dl, 1
mov eax, dword [0x40fbb4]
call fcn.00402fd8
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403d54
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44b62b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00439a38
test al, al
je 0x44b61e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44b66c
lea eax, [ebp - 0x254]
call fcn.00409a54
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44b61e
xor eax, eax
push ebp
push 0x44b617
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44b6a4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44b600
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403f84
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x44b600
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403f84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b61e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44b521
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.004134d4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b662
lea eax, [ebp - 0x260]
call fcn.00403d54
ret

Function at 0x44bea8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48f7d0]
cmp byte [eax + 0x95], 0
jne 0x44bf19
cmp dword [0x48f7ec], 0
jne 0x44beda
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44be64
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48f7ec], eax
cmp dword [0x48f7e8], 0
jne 0x44bef5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x48f7e8], eax
cmp dword [0x48f7f0], 0
jne 0x44bf19
push esp
push 0
push 0
push 0x44be08
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x48f7f0], eax
pop edx
ret
Function at 0x44c010
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44c027
add esp, 0xfffffff0
call fcn.00403348
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004180d0
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40f688]
call fcn.00402fd8
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40f688]
call fcn.00402fd8
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x419db4]
call fcn.0041fec8
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x44c19c
mov eax, dword [0x48de88]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00420298
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44dba4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48de88]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cc3c
test eax, eax
je 0x44c11a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409398
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cc64
test eax, eax
je 0x44c12e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403f84
mov eax, dword [0x48dd0c]
cmp byte [eax], 0
jne 0x44c15f
mov eax, ebx
call fcn.0044c288
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44c191
call fcn.004033a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c4f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48f7d0]
cmp dword [eax + 0x24], 0
je 0x44c59b
cmp dword [ebx + 0x84], 0
jne 0x44c595
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44c488
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x44c595
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44c55e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44c595
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00411240
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44c56d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44cfa8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x44cfdd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403e3c
jmp 0x44cfe7
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403da8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44df18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x44df50
mov eax, esi
call fcn.00435768
test al, al
je 0x44df50
mov eax, dword [ebx + 0x74]
call fcn.0043546c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44df50
push 0
mov eax, dword [ebx + 0x74]
call fcn.0043546c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x452bec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x452c51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
mov dword [ebx + 0xc], esi
test esi, esi
jne 0x452c3b
lea ecx, [ebp - 4]
mov edx, 2
mov eax, dword [0x48f828]
call fcn.00452a58
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4528f0]
call fcn.0040bf68
call fcn.004037a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c58
lea eax, [ebp - 4]
call fcn.00403d54
ret

Function at 0x452c60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x452d7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
mov ecx, 0xff
mov edx, dword [ebp - 4]
call fcn.00409418
mov eax, ebx
call fcn.00405de4
mov ebx, eax
push 0xa
lea eax, [ebp - 0x104]
push eax
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
jne 0x452d07
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0xb
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x110]
mov edx, 3
mov eax, dword [0x48f828]
call fcn.00452a58
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x4528f0]
call fcn.0040bfa4
call fcn.004037a0
jmp 0x452d5c
push esi
push ebx
call sub.kernel32.dll_LoadResource
mov dword [edi + 8], eax
cmp dword [edi + 8], 0
jne 0x452d5c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0xb
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x114]
mov edx, 4
mov eax, dword [0x48f828]
call fcn.00452a58
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x4528f0]
call fcn.0040bfa4
call fcn.004037a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452d81
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00403d78
ret
Function at 0x47cf8b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x48db46
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47cfe3
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x48db67
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47cfd9
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47cfe7
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x100022b4
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push 0x48
mov eax, 0x1000c708
call fcn.1000b995
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x4c], eax
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0x54], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
lea eax, [ebp - 0x48]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.10002239
cmp dword [ebp - 0x38], ebx
jne 0x10002315
push 9
pop esi
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.10008247
push dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.1000ba18
ret 0xc
cmp dword [edi + 0xc], 0x400
jbe 0x10002322
push 8
jmp 0x100022ef
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp dword [esi + 0x14], 2
push 0xffffffffffffffff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ebx
lea eax, [esi + 0x68]
je 0x10002348
lea eax, [esi + 0x4c]
push eax
call fcn.10008247
cmp dword [esi + 8], ebx
jne 0x10002384
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000235f
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x10002384
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10008247
jmp 0x100022ed
mov eax, dword [ebp - 0x48]
push 8
pop esi
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x34], esi
jae 0x10002395
lea eax, [ebp - 0x48]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x50]
push ecx
push 0x40c
push dword [ebp - 0x4c]
push 0x410
push edi
push eax
call dword [sym.imp.kernel32.dll_CallNamedPipeW]
cmp eax, ebx
jne 0x100023e2
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push 1
cmp eax, 0x5b4
jne 0x100023d8
call fcn.10008247
push 0xa
jmp 0x100022ef
call fcn.10008247
jmp 0x100022f0
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10008247
xor esi, esi
jmp 0x100022f0
Function at 0x10002faf
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x10002fd0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x10002fcc
xor eax, eax
ret

Function at 0x10002fde
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x10002fff
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x10002ffb
xor eax, eax
ret

Function at 0x100068d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1000cb1e
call fcn.1000b9cb
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call fcn.10004616
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x1000692c
call fcn.100036d3
mov esi, eax
jmp 0x10006a02
push ebx
push edi
push eax
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10006945
call fcn.100036d3
jmp 0x100069f4
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x1000693b
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x1000697f
mov esi, 0x8007000e
jmp 0x100069f6
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10008247
mov dword [ebp - 4], 1
jmp 0x100069ad
cmp dword [ebp - 0x418], esi
je 0x10006978
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x1000693b
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.10008247
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10006a1b
lea ecx, [ebp - 0x418]
call fcn.10004030
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10003fb2
mov eax, esi
call fcn.1000ba27
ret 0x10
Function at 0x10008247
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10008256
pop dword [ebp - 0x30]
mov eax, 0xf2a8bf85
sub eax, 0xe2a83d2f
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x69466245
add dword [ebp - 0x40], 0xe50be306
mov dword [ebp - 0x3c], 0x7f5c5bd1
add dword [ebp - 0x3c], 0xb2d6f074
mov dword [ebp - 0x38], 0xae2bae5f
add dword [ebp - 0x38], 0x9e2095cf
mov dword [ebp - 0x34], 0x6ed020ea
add dword [ebp - 0x34], 0x912fdf16
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x27437e73
add dword [ebp - 0x40], 0x4d2eeae3
mov dword [ebp - 0x3c], 0xaa33ac63
add dword [ebp - 0x3c], 0x9738b512
mov dword [ebp - 0x38], 0xd017a5ee
sub dword [ebp - 0x38], 0x6ca83982
mov dword [ebp - 0x34], 0xaf86b8f2
add dword [ebp - 0x34], 0x5079470e
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3dce8
push 0
call eax
mov ecx, 0x48847325
sub ecx, 0x488416d3
xor ebx, ebx
add ebx, eax
mov edi, 0x749ebae5
sub edi, 0x649d16e5
add edi, dword [ebp - 0x30]
mov edx, 0x8ff91ee
add dword [ebp - 4], eax
mov esi, dword [edi]
xor dword [ebp - 0x28], edx
add esi, edx
sub dword [ebp - 0x14], 0x92c5e35a
mov dword [ebx], esi
xor dword [ebp - 0x1c], 0xc7a06f22
add ebx, 0x225d94d0
add ebx, 0xdda26b34
add edi, 0xb4657b10
add edi, 0x4b9a84f4
loop 0x1000836a
add eax, 0x9883be8a
add eax, 0x677da591
xor ebx, ebx
add ebx, eax
add eax, 0x506ec2e5
add eax, 0xaf913d20
mov ecx, 0x7872ef48
sub ecx, 0x6872ef48
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10009b34
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1000cdf8
call fcn.1000b95f
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
call esi
test eax, eax
jne 0x10009c78
cmp dword [ebp - 0x18], 1
jne 0x10009c78
mov edi, dword [ebp - 0x14]
shr edi, 1
inc edi
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
push ecx
call fcn.10008247
mov edi, eax
pop ecx
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x10009c6a
push dword [ebp - 0x14]
push ebx
push edi
call fcn.10008247
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x10009c6a
cmp dword [ebp - 0x18], 1
jne 0x10009c6a
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10008247
mov esi, dword [ebp + 0x10]
pop ecx
mov dword [esi], eax
cmp eax, ebx
je 0x10009c6a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.10008247
lea eax, [ebp - 0x20]
push eax
push 0x100102f4
push edi
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x10009c50
push edi
call fcn.10008247
pop ecx
cmp al, bl
je 0x10009c50
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [esi]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x10009c6a
push dword [esi]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [esi], ebx
jmp 0x10009c6a
cmp dword [ebp - 0x1c], ebx
je 0x10009c78
push dword [ebp - 0x1c]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.1000ba04
ret
Function at 0x10009c7e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x438
mov eax, 0x1000ce13
call fcn.1000b9cb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
fldz
add esp, 0x18
fstp qword [ebp - 0x444]
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSoftGrid
mov ebx, 0x104
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10009ecd
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x428], esi
push esi
jmp 0x10009d98
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll__wtof]
fldz
fcomp st(1)
pop ecx
fnstsw ax
test ah, 5
jp 0x10009d78
fld qword [ebp - 0x444]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x10009d78
lea eax, [ebp - 0x21c]
fstp qword [ebp - 0x444]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x10009d7a
fstp st(0)
inc dword [ebp - 0x428]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call edi
mov dword [ebp - 0x430], eax
cmp eax, esi
je 0x10009d30
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0x103
jne 0x10009ecd
mov edi, dword [sym.imp.MSVCR100.dll_wcslen]
push str.ClientUserInterface
call edi
mov ebx, str.SoftwareMicrosoftSoftGrid_
push ebx
mov dword [ebp - 0x430], eax
call edi
mov ecx, dword [ebp - 0x430]
lea edi, [ecx + eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10008247
add esp, 0xc
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x10009ecd
push edi
push esi
push eax
call fcn.10008247
push ebx
push edi
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov ebx, dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x424]
push eax
push edi
push dword [ebp - 0x428]
call ebx
add esp, 0xc
push str.ClientUserInterface
push edi
push dword [ebp - 0x428]
call ebx
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10009ec1
push dword [ebp - 0x434]
push str.LaunchCommand
push dword [ebp - 0x42c]
call fcn.10009b34
add esp, 0xc
push dword [ebp - 0x43c]
push 0x100102f8
push dword [ebp - 0x42c]
call fcn.10009b34
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.1000ba27
ret