joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e2ef
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp edi, esi
je 0x101e3c3
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x101e3c3
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x101e331
mov edi, 0x8007000e
jmp 0x101e3ec
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push 0x103d2cc
push 4
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x101e385
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101e37e
test byte [eax + 0x1c], 4
je 0x101e37e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x103b010]
push 0x1003fdc
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dce0
mov edi, 0x80004005
jmp 0x101e3ec
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push esi
push 0x101ebcc
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x101e3b7
cmp dword [ebp - 4], edi
je 0x101e37e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], edi
jmp 0x101e37e
mov ecx, dword [ebp - 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x101e3f6
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101e3e7
test byte [eax + 0x1c], 4
je 0x101e3e7
push 0x1003fdc
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov edi, 0x80070057
test esi, esi
je 0x101e3f6
push esi
call fcn.0101dd95
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x101e489
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x103c030], 2
push esi
mov esi, 0x80004005
je 0x101e4a4
mov esi, 0x83450065
jmp 0x101e4b9
push dword [ebp + 8]
push dword [0x103d29c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x101e4b9
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x101e4c5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x101e4fd
mov esi, 0x80070057
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101e536
test byte [eax + 0x1c], 4
je 0x101e536
push 0x1003fdc
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
jmp 0x101e536
cmp dword [0x103c030], 2
je 0x101e526
mov esi, 0x83450065
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101e536
test byte [eax + 0x1c], 4
je 0x101e536
push 0x1003fdc
push 0x2b
jmp 0x101e4f0
push dword [0x103d29c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x101eadc
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x103c030]
push ebx
push esi
mov esi, 0x80004005
mov ebx, 0x1003fdc
cmp eax, 1
je 0x101eafb
cmp eax, 3
jne 0x101eb9d
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x103d29c], eax
call esi
push 0x103d2c8
mov dword [0x103d2a0], eax
call fcn.0101dda6
mov esi, eax
test esi, esi
jge 0x101eb47
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101eb97
test byte [eax + 0x1c], 4
je 0x101eb97
push esi
push 0x1004190
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01020599
jmp 0x101eb92
push 0x103d2bc
call fcn.0101eff3
mov esi, eax
test esi, esi
jge 0x101eb74
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101eb97
test byte [eax + 0x1c], 4
je 0x101eb97
push esi
push 0x1004148
push ebx
push 0xb
jmp 0x101eb3a
push edi
xor eax, eax
mov edi, 0x103d2a4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
mov dword [0x103d2b0], esi
mov dword [0x103c030], 2
pop edi
mov eax, dword [0x103b010]
test esi, esi
jge 0x101ebc2
jmp 0x101eba2
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x101ebbd
test byte [eax + 0x1c], 4
je 0x101ebbd
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
call fcn.0101e9a0
mov eax, esi
pop esi
pop ebx
ret
Function at 0x101fdfc
Capabilities:
Lock the desktop

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x9c], 0
push edi
je 0x101fea7
push dword [ebp + 8]
add eax, 0x1c
push eax
lea ecx, [esi + 0x28]
call fcn.01023bcc
mov dword [ebp - 4], eax
mov ebx, 0x103b010
mov edi, 0x10043a8
test eax, eax
jge 0x101fe5c
mov eax, dword [0x103b010]
cmp eax, ebx
je 0x101fe80
test byte [eax + 0x1c], 4
je 0x101fe61
push dword [ebp - 4]
push 0x1004560
push edi
push 0x5c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01020599
mov eax, dword [0x103b010]
cmp eax, ebx
je 0x101fe80
test byte [eax + 0x1c], 4
je 0x101fe80
mov ecx, dword [esi + 0x24]
add ecx, 0x1c
push ecx
push edi
push 0x5d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dd0c
mov ecx, dword [esi + 0x154]
test ecx, ecx
je 0x101ff46
mov eax, dword [esi + 0x24]
push 1
push dword [ebp + 8]
add eax, 0x1c
push eax
push dword [ebp - 4]
call fcn.010233bf
jmp 0x101ff46
cmp dword [eax + 0xa0], 0
mov ebx, 0x103b010
mov edi, 0x10043a8
je 0x101fee1
mov eax, dword [0x103b010]
cmp eax, ebx
je 0x101fed7
test byte [eax + 0x1c], 4
je 0x101fed7
push edi
push 0x5e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
call dword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
jne 0x101ff46
mov eax, dword [0x103b010]
cmp eax, ebx
je 0x101fefe
test byte [eax + 0x1c], 4
je 0x101fefe
push edi
push 0x5f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
lea ecx, [esi + 0x28]
call fcn.01023b58
mov dword [ebp - 4], eax
test eax, eax
jge 0x101ff32
mov eax, dword [0x103b010]
cmp eax, ebx
je 0x101ff32
test byte [eax + 0x1c], 4
je 0x101ff32
push dword [ebp - 4]
push 0x1004530
push edi
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01020599
mov esi, dword [esi + 0x154]
test esi, esi
je 0x101ff46
push dword [ebp - 4]
mov ecx, esi
call fcn.01023418
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10201d8
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 6
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
mov edi, 0x10043a8
mov esi, 0x103b010
jge 0x102021e
mov ecx, dword [0x103b010]
cmp ecx, esi
je 0x102021e
test byte [ecx + 0x1c], 4
je 0x102021e
push eax
push edi
push 0xc3
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100dce0
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x100898c
mov dword [ebp - 4], ebx
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jge 0x1020368
mov eax, dword [0x103b010]
xor ebx, ebx
inc ebx
cmp eax, esi
je 0x102025b
test byte [eax + 0x1c], bl
je 0x102025b
push edi
push 0xc4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0100ebb0
and dword [ebp - 0x38], 0
and dword [ebp - 0x28], 0
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x4340
mov dword [ebp - 0x34], 0x1004684
mov dword [ebp - 0x30], 0x1004640
mov dword [ebp - 0x2c], 0x100460c
mov dword [ebp - 0x24], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x10202c9
mov eax, dword [0x103b010]
cmp eax, esi
je 0x1020388
test byte [eax + 0x1c], 4
je 0x1020388
push edi
push 0xc5
jmp 0x102037d
cmp dword [ebp - 0x20], 0x20
jg 0x10202ff
mov eax, dword [0x103b010]
cmp eax, esi
je 0x1020388
test byte [eax + 0x1c], 4
je 0x1020388
push dword [ebp - 0x20]
push edi
push 0xc6
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dce0
jmp 0x1020388
cmp dword [ebp - 8], 0
je 0x1020351
push 0x493e0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1020388
mov eax, dword [0x103b010]
cmp eax, esi
je 0x1020388
test byte [eax + 0x1c], 4
je 0x1020388
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x103b010]
push ebx
push edi
push 0xc7
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102b062
jmp 0x1020388
mov eax, dword [0x103b010]
cmp eax, esi
je 0x1020388
test byte [eax + 0x1c], 2
je 0x1020388
push edi
push 0xc8
jmp 0x102037d
mov eax, dword [0x103b010]
cmp eax, esi
je 0x1020388
test byte [eax + 0x1c], 1
je 0x1020388
push edi
push 0xc9
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x102039a
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
leave
ret
Function at 0x1025e49
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 0xa4]
call fcn.01024217
or dword [0x103c034], 0xffffffff
push 0x40
lea eax, [edi + 0x1c]
push eax
mov ecx, edi
call fcn.01025a31
xor ecx, ecx
test eax, eax
setge cl
xor ebx, ebx
push ebx
push ebx
push 8
lea eax, [edi + 4]
mov dword [ebp + 8], eax
mov dword [edi + 0x9c], ecx
or dword [eax + 8], 2
mov eax, 0x1006070
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x80000000
push eax
push ebx
mov ecx, edi
call fcn.010207c9
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, 0x80004005
jns 0x1025ef8
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1025fc9
test byte [eax + 0x1c], 4
je 0x1025fc9
push esi
push 0x1005be8
push 0x1006014
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01020599
jmp 0x1025fc9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x103c034], eax
cmp eax, 0xffffffff
jne 0x1025f54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1025f35
test byte [eax + 0x1c], 4
je 0x1025f35
push esi
push 0x1006014
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dce0
cmp esi, ebx
jle 0x1025f47
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x1025fcd
mov esi, 0x80004005
jmp 0x1025fcd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1025f84
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1025f35
test byte [eax + 0x1c], 4
je 0x1025f35
push esi
push 0x1006014
push 0xf
jmp 0x1025f2a
push ebx
push ebx
push ebx
push 0x1025dcb
push ebx
push 0x20
push 0x20
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [edi + 0xa8], eax
cmp eax, ebx
jne 0x1025fc7
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1025f4d
test byte [eax + 0x1c], 4
je 0x1025f4d
push 0x1006014
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
jmp 0x1025f4d
xor esi, esi
cmp esi, ebx
jge 0x1025fd5
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10294f1
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
push 0x10294ba
mov dword [ebp - 8], 1
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
leave
ret

Function at 0x1029526
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
push 0x10294ba
mov dword [ebp - 8], 2
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
leave
ret
Function at 0x102955b
Capabilities:
Set thread local storage value

Disassembly:
push 0x18
push 0x1038f28
call fcn.01011b8c
mov ebx, ecx
mov dword [ebp - 0x28], ebx
xor edi, edi
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x1c]
call fcn.0100e348
push ebx
push dword [0x103d3f0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x10295db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x103b010]
mov edi, 0x103b010
cmp eax, edi
je 0x10295b9
test byte [eax + 0x1c], 4
je 0x10295b9
push esi
push 0x1006784
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dce0
test esi, esi
jle 0x10295cb
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x10297b5
mov esi, 0x80004005
jmp 0x10297b5
mov ecx, dword [ebx + 0x8c]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
call dword [eax + 0xc]
mov esi, eax
cmp esi, edi
jge 0x1029629
mov eax, dword [0x103b010]
mov edi, 0x103b010
cmp eax, edi
je 0x10297b5
test byte [eax + 0x1c], 4
je 0x10297b5
push esi
push 0x10051c8
push 0x1006784
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01020599
jmp 0x10297b5
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x18]
call fcn.01027696
mov esi, eax
cmp esi, edi
jge 0x1029665
mov eax, dword [0x103b010]
mov edi, 0x103b010
cmp eax, edi
je 0x10297b5
test byte [eax + 0x1c], 4
je 0x10297b5
push esi
push 0x1006e14
push 0x1006784
push 0x1a
jmp 0x1029619
or dword [ebx + 0x4a4], 0xffffffff
push 0x20
push edi
mov ecx, ebx
call fcn.0102788e
mov esi, eax
cmp esi, edi
jge 0x10296aa
mov eax, dword [0x103b010]
mov edi, 0x103b010
cmp eax, edi
je 0x10297b5
test byte [eax + 0x1c], 4
je 0x10297b5
push esi
push 0x1006db8
push 0x1006784
push 0x1c
jmp 0x1029619
mov dword [ebp - 0x20], 1
mov ecx, ebx
call fcn.010294f1
mov esi, eax
cmp esi, edi
jge 0x10296ec
mov eax, dword [0x103b010]
mov edi, 0x103b010
cmp eax, edi
je 0x10297b5
test byte [eax + 0x1c], 4
je 0x10297b5
push esi
push 0x1006d70
push 0x1006784
push 0x1d
jmp 0x1029619
mov dword [ebp - 4], edi
mov ecx, dword [ebx + 0x8c]
mov eax, dword [ecx]
call dword [eax + 0x20]
push eax
call fcn.0102b8ce
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x103b010]
mov edi, 0x103b010
cmp eax, edi
je 0x102972d
test byte [eax + 0x1c], 4
je 0x102972d
push 0x1006784
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov ecx, ebx
call fcn.0102ad85
mov esi, eax
test esi, esi
jge 0x10297b5
mov eax, dword [0x103b010]
cmp eax, edi
je 0x10297b5
test byte [eax + 0x1c], 4
je 0x10297b5
push esi
push 0x1006d34
push 0x1006784
push 0x20
jmp 0x1029619
cmp dword [ebp - 0x20], 0
je 0x10297f5
push 0x10
push 0
mov ecx, ebx
call fcn.0102788e
mov esi, eax
test esi, esi
jge 0x10297f5
mov eax, dword [0x103b010]
cmp eax, edi
je 0x10297bb
test byte [eax + 0x1c], 4
je 0x10297bb
push esi
push 0x1006cd8
push 0x1006784
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01020599
jmp 0x10297bb
lea ecx, [ebp - 0x1c]
call fcn.01020564
mov eax, esi
call fcn.01011bd1
ret
Function at 0x102e069
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [esi + 0x18], ebx
jne 0x102e0e5
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
mov eax, 0x80000000
push eax
push eax
push eax
push eax
push ebx
push ebx
push 0x1008318
push 0xfffffffffffffffd
call fcn.010207c9
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x102e0e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x103b010]
cmp ecx, 0x103b010
je 0x102e246
test byte [ecx + 0x1c], 4
je 0x102e246
push eax
push 0x10082fc
push 0x1008194
push 0xb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01020599
jmp 0x102e246
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x102e12e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x102e135
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x103b010]
cmp ecx, 0x103b010
je 0x102e246
test byte [ecx + 0x1c], 4
je 0x102e246
push eax
push 0x10082d4
push 0x1008194
push 0xc
jmp 0x102e0d5
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, esi
call fcn.0102ddad
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x102e174
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x102e246
test byte [eax + 0x1c], 4
je 0x102e246
push 0x1008194
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
jmp 0x102e246
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
push 0x12
call edi
push 0x11
call edi
movzx eax, word [esi + 0x1e]
push 1
push eax
mov ecx, esi
call fcn.0102df20
movzx eax, word [esi + 0x1e]
push ebx
push eax
mov ecx, esi
call fcn.0102df20
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1c]
push eax
lea ecx, [ebp - 8]
call fcn.01024217
push dword [ebp + 0xc]
mov edi, dword [ebp - 8]
mov eax, dword [edi]
push 1
push dword [esi + 0x20]
mov ecx, edi
call dword [eax + 0x24]
cmp eax, ebx
jl 0x102e1f6
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x102e1ed
test byte [eax + 0x1c], 2
je 0x102e1ed
push 0x1008194
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov dword [ebp - 4], 1
jmp 0x102e23f
cmp eax, 0x83450004
jne 0x102e218
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x102e23c
test byte [eax + 0x1c], 4
je 0x102e23c
push 0x1008194
push 0xf
jmp 0x102e231
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x102e23c
test byte [eax + 0x1c], 4
je 0x102e23c
push 0x1008194
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov dword [ebp - 4], ebx
mov eax, dword [edi]
push edi
call dword [eax + 8]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x10324cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
push esi
mov esi, ecx
lea ecx, [eax + eax]
mov dword [ebp - 4], 1
mov dword [ebp + 0x10], ecx
cmp eax, 1
jb 0x1032542
cmp dword [esi + 8], 0
je 0x1032528
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 4], eax
test eax, eax
jne 0x1032525
cmp dword [ebp - 4], 1
je 0x1032525
cmp dword [ebp - 4], 2
je 0x1032525
mov dword [esi + 4], 0x57
mov ecx, dword [ebp + 0x10]
cmp dword [esi + 4], 0
jne 0x1032538
test ecx, ecx
je 0x1032538
shr ecx, 1
mov dword [ebx], ecx
jmp 0x1032542
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov word [ecx], ax
and dword [ebx], eax
pop esi
pop ebx
leave
ret 0xc

Function at 0x10326e1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
je 0x1032719
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1032714
test byte [eax + 0x1c], 4
je 0x1032714
push 0x10084fc
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov eax, dword [esi + 0x24]
jmp 0x103277d
mov edx, dword [esi + 4]
cmp dword [esi + 8], edx
jne 0x103274c
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1032745
test byte [eax + 0x1c], 4
je 0x1032745
push 0x10084fc
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov eax, 0x103
jmp 0x103277d
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 4], eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 0x10]
mov dword [eax], ecx
mov ecx, dword [esi]
mov ecx, dword [ecx]
lea eax, [esi + 0x14]
push eax
push 0
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [esi + 4]
mov dword [esi + 0x24], eax
pop esi
leave
ret
Function at 0x1034be9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x544b2fba
mov dword [ebp - 0x1c], 0xef0bc9df
mov dword [ebp - 0x18], 0x39d589ae
mov dword [ebp - 0x14], 0xe5ea8173
test edi, edi
je 0x1034d77
mov ecx, dword [eax + 0xc]
push ebx
mov ebx, dword [eax + 4]
and edi, 3
mov dword [ebp - 4], ecx
mov ecx, dword [eax]
push esi
mov esi, dword [eax + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ecx
mov edi, 0xf993291a
je 0x1034c80
mov eax, dword [ebp - 0xc]
sub dword [ebp + 8], eax
mov eax, dword [edx]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add eax, ecx
imul eax, eax, 0x6f6e65f
mov ecx, edi
sub ecx, eax
xor ebx, ecx
mov eax, ebx
shr eax, 0x1f
xor esi, ecx
add ebx, ebx
xor ebx, dword [ebp + eax*4 - 0x18]
mov eax, esi
shr eax, 0x1f
add esi, esi
xor esi, dword [ebp + eax*4 - 0x20]
add edx, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jne 0x1034c44
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 8], 0
je 0x1034d67
mov eax, dword [edx]
add ecx, eax
imul ecx, ecx, 0x6f6e65f
mov eax, edi
sub eax, ecx
xor ebx, eax
mov ecx, dword [edx + 4]
xor esi, eax
add eax, ecx
imul eax, eax, 0x6f6e65f
mov ecx, edi
sub ecx, eax
mov eax, ebx
shr eax, 0x1f
mov dword [ebp - 0xc], eax
lea eax, [ebx + ebx]
mov ebx, dword [ebp - 0xc]
xor eax, dword [ebp + ebx*4 - 0x18]
mov ebx, esi
shr ebx, 0x1f
add esi, esi
xor esi, dword [ebp + ebx*4 - 0x20]
mov ebx, dword [edx + 8]
add ebx, ecx
imul ebx, ebx, 0x6f6e65f
xor eax, ecx
xor esi, ecx
mov ecx, edi
sub ecx, ebx
mov ebx, eax
shr ebx, 0x1f
add eax, eax
xor eax, dword [ebp + ebx*4 - 0x18]
mov ebx, esi
xor eax, ecx
shr ebx, 0x1f
add esi, esi
xor esi, dword [ebp + ebx*4 - 0x20]
mov ebx, dword [edx + 0xc]
xor esi, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [edx + 8]
add ebx, ecx
add ebx, dword [edx + 4]
mov ecx, dword [edx + 0xc]
add ebx, dword [edx]
add edx, 0x10
add dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
add ecx, ebx
imul ecx, ecx, 0x6f6e65f
mov ebx, edi
sub ebx, ecx
mov ecx, ebx
mov ebx, eax
add eax, eax
shr ebx, 0x1f
xor eax, dword [ebp + ebx*4 - 0x18]
xor eax, ecx
mov ebx, eax
add eax, eax
shr ebx, 0x1f
xor eax, dword [ebp + ebx*4 - 0x18]
mov ebx, eax
mov eax, esi
shr eax, 0x1f
mov dword [ebp - 0xc], eax
lea eax, [esi + esi]
mov esi, dword [ebp - 0xc]
xor eax, dword [ebp + esi*4 - 0x20]
xor eax, ecx
mov esi, eax
shr esi, 0x1f
add eax, eax
xor eax, dword [ebp + esi*4 - 0x20]
sub dword [ebp + 8], 4
mov esi, eax
jne 0x1034c8a
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [eax + 8], esi
pop esi
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edx
mov dword [eax], ecx
pop ebx
pop edi
leave
ret 4
Function at 0x10359d2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1035a31
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [0x103b010]
cmp ecx, 0x103b010
je 0x1035a22
test byte [ecx + 0x1c], 4
je 0x1035a22
push eax
push 0x100d6d8
push 0x100d6c4
push 0x1f
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01020599
call esi
push eax
push 2
mov ecx, edi
call fcn.010359a4
pop esi
jmp 0x1035a77
cmp eax, dword [ebp + 0xc]
jbe 0x1035a75
mov eax, dword [0x103b010]
cmp eax, 0x103b010
je 0x1035a5a
test byte [eax + 0x1c], 4
je 0x1035a5a
push 0x100d6c4
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100dedd
mov dword [edi + 0x8778], 2
mov dword [edi + 0x877c], 0x18
mov eax, 0x80070018
jmp 0x1035a77
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x1005c1f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0xffffffffffffffec
push ebx
mov esi, ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 8
je 0x1005c85
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x1005c85
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, dword [esi + 0x64]
jne 0x1005c66
call edi
sub eax, dword [esi + 0x68]
cmp eax, 0x3e8
jbe 0x1005c84
push 0x13
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esi + 0x34]
push 0xffffffffffffffff
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [esi + 0x64], ebx
call edi
mov dword [esi + 0x68], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4