joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bdad
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0xa00]
sub esp, 0xa80
mov eax, dword [0x10171b0]
mov dword [ebp + 0x9fc], eax
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 8], eax
mov dword [ebp - 0x48], 0x105
je 0x100bf63
push ebx
push edi
push 0xd
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xa08]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x104b
push 0xfa7
push dword [esi]
mov dword [ebp - 0x80], 4
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
cmp dword [ebp - 0x7c], 0xffffffff
je 0x100bf0b
mov eax, dword [ebp - 0x60]
test eax, eax
mov dword [ebp - 0x4c], eax
je 0x100bf0b
mov ecx, dword [eax]
lea edx, [ebp + 0x5d4]
push edx
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
je 0x100be36
and word [ebp + 0x7e0], 0
jmp 0x100be56
lea eax, [ebp + 0x5d4]
push eax
push 0x105
lea eax, [ebp + 0x7e0]
push eax
call fcn.01002f60
test eax, eax
jl 0x100bf0b
push 0x104
lea eax, [ebp - 0x44]
push eax
push 0x11f8
push dword [0x101728c]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp + 0x3cc]
push eax
push 0x11f9
push dword [0x101728c]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp + 0x7e0]
push eax
lea eax, [ebp + 0x3cc]
push eax
lea eax, [ebp + 0x1c4]
push 0x104
push eax
call fcn.01003b41
add esp, 0x10
push 0x24
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x1c4]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x100bf0b
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp + 0x7e0]
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0x105
call fcn.01009a40
test eax, eax
jl 0x100bf0b
and word [ebp + 0x82c], 0
lea eax, [ebp + 0x7e0]
push eax
push 0x105
lea eax, [ebp + 0x5d4]
push eax
call fcn.01002f60
test eax, eax
jge 0x100bf0f
xor eax, eax
jmp 0x100bf61
lea eax, [ebp + 0x9ec]
push eax
lea eax, [ebp + 0x5d4]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
lea edx, [ebp + 0x9ec]
push edx
push eax
call dword [ecx + 0x18]
push 0xfa7
push dword [esi]
call edi
push 0
push dword [ebp + 0xa08]
mov esi, eax
push 0x1008
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x9fc]
pop esi
call fcn.010120e3
add ebp, 0xa00
leave
ret 4
Function at 0x100c6ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1001bf4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c754
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push 0x10000002
push 0x1001be0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueA]
test eax, eax
jne 0x100c74b
inc esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x7fff0001
add eax, 0x8000ffff
pop esi
leave
ret 8

Function at 0x100d06e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x100d150
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x100d0eb
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x100d13b
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x100d15a
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100d13b
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.0100d056
test eax, eax
je 0x100d15a
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x100d15a
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x100d09b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x100d153
Function at 0x100db8e
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1013947
call fcn.010136c0
sub esp, 0x224
mov eax, dword [0x10171b0]
push esi
push edi
push 0xfa1
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
cmp eax, edi
je 0x100dc05
cmp dword [esi], edi
jne 0x100dd09
push 0x34
call fcn.010121b7
pop ecx
mov dword [ebp - 0x22c], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x100dbe6
push 3
mov ecx, eax
call fcn.01009e6f
jmp 0x100dbe8
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi], eax
je 0x100dc05
push eax
call fcn.01009e93
test eax, eax
jge 0x100dc0c
push dword [esi]
call fcn.0100afb0
mov dword [esi], edi
xor eax, eax
jmp 0x100dd0c
push 0x20019
call sym.mobsync.dll_RegGetHandlerTopLevelKey
cmp eax, edi
mov dword [ebp - 0x22c], eax
je 0x100dca7
push ebx
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x228]
push ecx
push edi
mov dword [ebp - 0x230], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
jmp 0x100dc92
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x100dc78
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call fcn.01009ec1
test eax, eax
jne 0x100dc78
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
push dword [esi]
call fcn.0100ab6f
inc dword [ebp - 0x230]
push ebx
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x22c]
call edi
test eax, eax
je 0x100dc42
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
pop ebx
lea eax, [ebp + 8]
push eax
push 3
push dword [esi]
call fcn.0100ab31
jmp 0x100dcd8
push edi
push edi
push 0x100
push edi
push dword [ebp + 8]
push dword [esi]
call fcn.0100ac09
lea eax, [ebp + 8]
push eax
push 3
push dword [ebp + 8]
push dword [esi]
call fcn.0100a180
test eax, eax
je 0x100dcb6
lea eax, [ebp + 8]
push eax
push 5
push dword [esi]
call fcn.0100ab31
jmp 0x100dd05
push dword [ebp + 8]
push dword [esi]
call fcn.0100afd2
lea eax, [ebp + 8]
push eax
push 5
push dword [ebp + 8]
push dword [esi]
call fcn.0100a180
test eax, eax
je 0x100dceb
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.010120e3
leave
ret 8
Function at 0x100f572
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1013981
call fcn.010136c0
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x2c], ebx
je 0x100f597
xor eax, eax
cmp dword [esi + 0x30], ebx
sete al
jmp 0x100f6a9
push edi
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.0100f250
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.010135f1
cmp dword [esi + 0x2c], ebx
jne 0x100f680
push 0x1001e44
mov dword [esi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x30], eax
je 0x100f64c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001e60
push eax
call edi
push 0x1001e74
push dword [esi + 0x30]
mov dword [esi + 0x34], eax
call edi
push 0x1001e88
push dword [esi + 0x30]
mov dword [esi + 0x38], eax
call edi
push 0x1001e98
push dword [esi + 0x30]
mov dword [esi + 0x3c], eax
call edi
push 0x1001ea8
push dword [esi + 0x30]
mov dword [esi + 0x40], eax
call edi
push 0x1001ec0
push dword [esi + 0x30]
mov dword [esi + 0x44], eax
call edi
push 0x1001ed4
push dword [esi + 0x30]
mov dword [esi + 0x48], eax
call edi
push 0x1001ee8
push dword [esi + 0x30]
mov dword [esi + 0x4c], eax
call edi
push 0x1001f00
push dword [esi + 0x30]
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x100f674
cmp dword [esi + 0x38], ebx
je 0x100f666
cmp dword [esi + 0x4c], ebx
je 0x100f666
cmp dword [esi + 0x3c], ebx
je 0x100f666
xor edi, edi
jmp 0x100f677
cmp eax, ebx
je 0x100f674
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x30], ebx
xor edi, edi
inc edi
mov dword [esi + 0x2c], 1
jmp 0x100f68a
xor eax, eax
cmp dword [esi + 0x30], ebx
sete al
mov edi, eax
cmp dword [ebp - 0x18], ebx
jbe 0x100f69a
mov ecx, dword [ebp - 0x14]
dec dword [ebp - 0x18]
call fcn.01013606
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0100f26c
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100f6b7
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1013981
call fcn.010136c0
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x100f6dc
xor eax, eax
cmp dword [esi + 0x5c], ebx
sete al
jmp 0x100f7e0
push edi
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.0100f250
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.010135f1
cmp dword [esi + 0x58], ebx
jne 0x100f7b7
push 0x1001f18
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x5c], eax
je 0x100f774
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001f30
push eax
call edi
push 0x1001f40
push dword [esi + 0x5c]
mov dword [esi + 0x60], eax
call edi
push 0x1001f50
push dword [esi + 0x5c]
mov dword [esi + 0x64], eax
call edi
push 0x1001f60
push dword [esi + 0x5c]
mov dword [esi + 0x68], eax
call edi
push 0x1001f74
push dword [esi + 0x5c]
mov dword [esi + 0x6c], eax
call edi
push 0x1001f8c
push dword [esi + 0x5c]
mov dword [esi + 0x70], eax
call edi
push 0x1001fa4
push dword [esi + 0x5c]
mov dword [esi + 0x74], eax
call edi
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x100f7ab
cmp dword [esi + 0x60], ebx
je 0x100f79d
cmp dword [esi + 0x68], ebx
je 0x100f79d
cmp dword [esi + 0x6c], ebx
je 0x100f79d
cmp dword [esi + 0x70], ebx
je 0x100f79d
cmp dword [esi + 0x74], ebx
je 0x100f79d
cmp dword [esi + 0x78], ebx
je 0x100f79d
xor edi, edi
jmp 0x100f7ae
cmp eax, ebx
je 0x100f7ab
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x5c], ebx
xor edi, edi
inc edi
mov dword [esi + 0x58], 1
jmp 0x100f7c1
xor eax, eax
cmp dword [esi + 0x5c], ebx
sete al
mov edi, eax
cmp dword [ebp - 0x18], ebx
jbe 0x100f7d1
mov ecx, dword [ebp - 0x14]
dec dword [ebp - 0x18]
call fcn.01013606
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0100f26c
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100f90b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x1002090
push SysReAllocString
mov dword [ebp - 4], 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x100f9c3
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x100206c
push dword [ebp - 0x10]
mov dword [ebp - 8], ebx
call edi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x100f9a4
cmp dword [ebp - 0xc], eax
je 0x100f9a4
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x1002050
push dword [ebp - 0x10]
mov dword [ebp - 8], ebx
call edi
mov esi, eax
test esi, esi
jne 0x100f995
cmp dword [ebp - 0xc], eax
jne 0x100f9b0
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [eax], 2
jmp 0x100f9b0
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x100f9d4
test esi, esi
jle 0x100f9d1
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x100fa07
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push 0x1002090
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x100fa8f
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
je 0x100fa52
dec eax
push 1
pop ecx
je 0x100fa4f
dec eax
dec eax
je 0x100fa4c
push 0x57
pop esi
jmp 0x100fa86
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x100206c
push dword [ebp - 4]
call edi
mov esi, eax
test esi, esi
jne 0x100fa86
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push esi
push 0x1002050
push dword [ebp - 4]
call edi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x100fa9f
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x10102a0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x20
push ebp
push esi
push 1
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebp
jne 0x10102c2
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push edi
push 0x14
push 0x1002164
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
mov edi, eax
call ebx
cmp edi, ebp
jne 0x10102ee
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x101030e
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x18], 4
jne 0x101031f
push edi
call ebx
xor eax, eax
jmp 0x10103d2
push ebp
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x101033c
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor ebp, ebp
add esi, 0x15f90
inc ebp
mov dword [esp + 0x10], 0x435
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10103c1
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x10103b9
cmp eax, 3
je 0x10103b9
cmp eax, 4
je 0x10103b4
cmp eax, 5
jbe 0x1010382
cmp eax, 7
jbe 0x10103b9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x10103b9
mov eax, dword [esp + 0x2c]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x10103a9
mov ecx, 0x2710
cmp eax, ecx
jbe 0x10103ab
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10103bb
and dword [esp + 0x10], 0
xor ebp, ebp
test ebp, ebp
jne 0x1010355
jmp 0x10103cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
push edi
call ebx
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x1011b1f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10171b0]
push esi
mov esi, ecx
cmp dword [esi + 0x44], 0
mov dword [ebp - 4], eax
push edi
je 0x1011baa
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x430
push dword [esi + 0x40]
call edi
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x1011b75
xor eax, eax
jmp 0x1011bad
lea eax, [ebp - 0x210]
push eax
push 0xff3
push dword [esi + 0x40]
call edi
push eax
call fcn.010115ba
lea eax, [ebp - 0x210]
push eax
push 0
push 0x478
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010120e3
leave
ret
Function at 0x10120e3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10171b0]
jne 0x10120ec
ret
jmp 0x10120f1
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x10171b0]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x1017304]
test eax, eax
je 0x1012115
call eax
cmp dword [0x1017308], 0
je 0x101215c
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1017308]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010120e3
add ebp, 0x2a8
leave
ret
Function at 0x10121ef
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb0
mov eax, dword [0x10171b0]
and word [ebp - 0x34], 0
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 0x40], 0
push 0x27
pop ecx
mov dword [ebp + 0x6c], eax
xor eax, eax
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
push 0x50
pop ebx
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x23
mov edi, 0x400
push edi
call esi
test eax, eax
je 0x10122c3
xor eax, eax
cmp word [ebp - 0x34], 0x30
sete al
test eax, eax
mov dword [ebp - 0x38], eax
je 0x1012269
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x1005
push edi
call esi
test eax, eax
je 0x10122c3
xor eax, eax
cmp word [ebp - 0x34], 0x31
sete al
mov dword [ebp - 0x40], eax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x25
push edi
call esi
test eax, eax
je 0x10122c3
xor eax, eax
cmp word [ebp - 0x34], 0x31
push ebx
sete al
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push 0x1e
push edi
call esi
xor esi, esi
cmp eax, esi
je 0x10122c3
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp + 0x7c]
xor ecx, ecx
cmp dword [ebp - 0x3c], esi
setne cl
add eax, ecx
mov ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
and ecx, 3
lea eax, [eax + ecx + 4]
cmp eax, ebx
jbe 0x10122bf
xor eax, eax
cmp eax, esi
jne 0x10122d6
push dword [ebp + 0x7c]
push 0x10021f4
push dword [ebp + 0x78]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x1012344
cmp dword [ebp - 0x38], esi
mov edi, dword [ebp + 0x78]
mov word [edi], si
je 0x10122fb
cmp dword [ebp - 0x40], esi
je 0x10122f3
push ebx
push 0x10021ec
push edi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push ebx
mov ebx, 0x10021e8
jmp 0x1012301
push ebx
mov ebx, 0x10021e4
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push ebx
push edi
call esi
cmp dword [ebp - 0x3c], 0
je 0x1012318
push dword [ebp + 0x7c]
push ebx
push edi
call esi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x34]
push eax
push edi
call esi
push dword [ebp + 0x7c]
push 0x10021dc
push edi
call esi
cmp dword [ebp - 0x38], 0
je 0x1012344
cmp dword [ebp - 0x40], 0
jne 0x1012344
push dword [ebp + 0x7c]
push 0x10021d4
push edi
call esi
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
call fcn.010120e3
add ebp, 0x70
leave
ret 8
Function at 0x10001670
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a2078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x10099380]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x28321e38
mov dword [ebp - 0x28], 0x2f382933
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x17
jb 0x100016b4
mov byte [ebp - 0x24], 0
mov cl, 0xd
mov dword [ebp - 0x1c], 0x7f68660d
xor eax, eax
mov dword [ebp - 0x18], 0x3e616863
mov dword [ebp - 0x14], 0x6169233f
mov word [ebp - 0x10], 0x61
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xc
jae 0x100016f3
mov cl, byte [ebp - 0x1c]
jmp 0x100016e4
lea eax, [ebp - 0x3b]
mov byte [ebp - 0xf], 0
push eax
lea eax, [ebp - 0x1b]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10017cc0
cmp al, 0xe9
jne 0x1000179d
movaps xmm0, xmmword [0x10099170]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x36
nop
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10001730
cmp byte [ebp - 0x1f], 0
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
jne 0x1000175d
xor ecx, ecx
jmp 0x1000176c
lea ecx, [ebp - 0x1f]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001763
sub ecx, edx
push ecx
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002710
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.1001b780
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x1000179d
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.100025f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100017b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d08
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a2078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov cl, 0x65
mov dword [ebp - 0x1c], 0x80c1165
mov dword [ebp - 0x18], 0x11002200
xor eax, eax
mov dword [ebp - 0x14], 0x80c31
mov byte [ebp - 0x10], 0
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xb
jae 0x10001801
mov cl, byte [ebp - 0x1c]
jmp 0x100017f2
mov byte [ebp - 0x10], 0
mov cl, 0x5e
mov dword [ebp - 0x34], 0x2c3b355e
xor eax, eax
mov dword [ebp - 0x30], 0x6d323b30
mov dword [ebp - 0x2c], 0x323a706c
mov word [ebp - 0x28], 0x32
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 0xc
jae 0x10001833
mov cl, byte [ebp - 0x34]
jmp 0x10001824
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x27], 0
push eax
lea eax, [ebp - 0x33]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10017cc0
cmp al, 0xe9
jne 0x100018dd
movaps xmm0, xmmword [0x10099440]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x4d
nop
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x10
jb 0x10001870
cmp byte [ebp - 0x37], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
jne 0x1000189d
xor ecx, ecx
jmp 0x100018ac
lea ecx, [ebp - 0x37]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100018a3
sub ecx, edx
push ecx
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x24]
call fcn.10002710
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.1001b780
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x100018dd
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.100025f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret