joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040f369
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f31e
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040f369
pop ecx

Function at 0x413370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4199e0], ecx
add edx, 1
cmp edx, 0x100
jb 0x413372
cmp edx, 0x800
jae 0x41345b
mov edi, edi
mov eax, dword [edx*4 + 0x4195e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4199e0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x4199dc], eax
jb 0x413430
mov dword [0x4199b4], 0x413ab0
call fcn.004135a0
test eax, eax
jne 0x413478
mov dword [0x4199b4], 0x4139d0
ret
Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.004016ae
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x759229f4
Capabilities:
Query service status
Start service
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
call fcn.75925d38
test al, al
je 0x75922aa1
push ebx
call fcn.75925b8f
push 1
xor ebx, ebx
push ebx
push ebx
mov byte [ebp - 2], al
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x75922aa0
lea eax, [ebp - 0x10]
push eax
push 1
push 0xc
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
jne 0x75933d4f
push esi
push edi
push 0x34
push 0x75922ab4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x75922a90
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x75922a8d
cmp byte [ebp - 2], bl
je 0x75922aa7
cmp dword [ebp - 0x28], 1
jne 0x75922a8d
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push edi
call esi
push dword [ebp - 8]
call esi
cmp byte [ebp - 1], bl
pop edi
pop esi
jne 0x75933d6f
pop ebx
xor eax, eax
leave
ret 4
cmp dword [ebp - 0x28], 4
jne 0x75922a8d
jmp 0x75933d5d
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov dword [ebp - 0xc], eax
jmp 0x75922a4c
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x75922a8d
cmp dword [ebp - 0xc], ebx
je 0x75933d7e
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x75922aa0
Function at 0x75923606
Capabilities:
Resume thread
Set current directory
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x7594d0ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x214], eax
xor eax, eax
cmp dword [esi], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov word [ebp - 0x20c], ax
je 0x7592364f
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call fcn.75924466
push esi
push edi
call fcn.75924196
cmp dword [0x7594d0b0], 0
je 0x75923676
push dword [esi]
call fcn.75924a4e
push dword [edi + 4]
mov eax, dword [0x7594d0fc]
call dword [eax + 0x50]
call fcn.75924df5
push 0x75923738
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcstok]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x759236bd
push esi
push edi
call fcn.75923cd9
cmp word [ebp - 0x20c], 0
pop edi
pop esi
pop ebx
je 0x759236ab
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
call fcn.75921930
leave
ret 0x18
cmp word [eax], 0x20
je 0x75932e59
lea ecx, [ebp - 0x224]
push ecx
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [esi]
push edi
push dword [ebp - 0x214]
push eax
call fcn.759237de
test eax, eax
je 0x7592372c
inc dword [ebp - 0x210]
lea eax, [edi + 0x58]
push eax
lea eax, [ebp - 0x224]
push eax
push edi
call fcn.75923c63
test eax, eax
je 0x75932e6a
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x75923738
push 0
jmp 0x75923682
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x20
jne 0x759236c7
jmp 0x75932e59
push 5
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x75923714
Function at 0x759249da
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x78
pop ebx
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x75924a3b
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x75924a38
cmp dword [ebp - 8], 0xea
je 0x759335d7
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret 0x10
mov edi, eax
test edi, edi
jne 0x759249fc
jmp 0x75924a38
push 0x42
add ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
jmp 0x75924a41
Function at 0x75924ce9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.75923741
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp + 0x18], ebx
push ebx
sete al
mov edi, eax
lea eax, [esi + 0x58]
push eax
call fcn.75923884
cmp eax, ebx
mov dword [ebp + 0x18], eax
je 0x75924dc9
mov eax, dword [esi + 0x8c]
cmp eax, ebx
je 0x75924dc1
lea ecx, [ebp - 4]
push ecx
push 0x2001f
push ebx
push 0x75923f84
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x75924dc1
cmp edi, ebx
jne 0x75924d5b
push dword [ebp - 4]
call fcn.7592495b
cmp eax, ebx
je 0x75924db8
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push ebx
push 0x75923f70
push dword [ebp - 4]
call edi
push dword [ebp + 0x10]
call esi
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push ebx
push 0x75924ddc
push dword [ebp - 4]
call edi
push dword [ebp + 0x14]
call esi
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push ebx
push 0x75924b48
push dword [ebp - 4]
call edi
mov esi, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
call fcn.759237a6
cmp dword [ebp - 8], ebx
je 0x75924dd4
push esi
call fcn.75923abb
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x75924e39
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push 0x75923fe0
push 2
lea eax, [ebp - 4]
push eax
call fcn.75924153
mov ebx, dword [ebp + 8]
push ebx
call fcn.75923741
test eax, eax
je 0x75924ec5
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push 0x2001f
push edi
push edi
push edi
push 0x75922eb0
push dword [ebx + 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x75924ebe
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
mov esi, 0x75924ee4
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x759328e5
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
push ebx
call fcn.75923abb
pop edi
cmp word [ebp - 4], 0x31
pop ebx
jne 0x75924eda
push 0x75923f64
push dword [ebp + 0xc]
jmp 0x75a3ee38
xor eax, eax
inc eax
leave
ret 0xc
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 4]
push eax
push 1
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x75924eb4
Function at 0x75925fe7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x75922808
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push 0x75925ec0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7592604c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x759261cb
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x75932f3d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x7594d110], eax
jne 0x759262a1
cmp dword [esi + 0xa24], edi
jne 0x759262a1
push edi
push 0x759262e4
call fcn.75925fe7
test eax, eax
jne 0x759262a1
push ebx
push edi
push edi
push 1
push edi
lea ebx, [esi + 0xa14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [ebx], edi
mov dword [esi + 0xa18], eax
je 0x759262a0
cmp eax, edi
je 0x759262a0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xa20], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xa30], eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x759259df
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0xa1c], eax
je 0x759262a0
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x75926424
push 0x5ff
push 0xffffffffffffffff
push edi
push ebx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 1
mov dword [ebp + 8], eax
je 0x759263fa
pop ebx
mov eax, dword [esi + 0xa24]
cmp eax, edi
je 0x759262da
cmp dword [ebp + 0x14], edi
jne 0x75932f4c
push dword [ebp + 0x18]
push 0x993
push dword [esi + 0xa24]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp + 0x18]
call fcn.75926315
test byte [ebp + 0x10], 2
jne 0x75932f5b
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0x14
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x7592626f
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp + 8], 1
je 0x7592626f
jmp 0x759262a0
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x759262dd
push dword [ebp + 0x14]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x759262b4
push dword [esi + 0xa24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x759262da
Function at 0x75927464
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor esi, esi
push esi
push 0x759274e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x759274dd
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x759274d3
cmp dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
ja 0x7592f508
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
xor eax, eax
inc eax
pop esi
leave
ret 4
push edi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x7592f574
push ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0x1c]
push eax
push eax
push 6
call fcn.759272c1
mov edi, eax
cmp edi, esi
je 0x7592f574
or dword [edi + 4], 2
push edi
push dword [ebp + 8]
call fcn.75927239
test eax, eax
jne 0x7592f56e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call fcn.75928931
cmp eax, esi
je 0x7592f56e
or dword [eax + 4], 2
push edi
call fcn.759292d3
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x7592f509
jmp 0x75a35518
Function at 0x759277db
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, eax
cmp edi, 2
jae 0x759305a4
xor eax, eax
pop edi
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
shl esi, 3
mov eax, dword [esi + 0x7594d3d4]
test eax, eax
jne 0x759305d1
mov eax, edi
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x759305cb
xor eax, eax
jmp 0x75930618
mov dword [esi + 0x7594d3d4], eax
push edi
mov edi, dword [ebp + 0x10]
push edi
push eax
call fcn.75938318
test eax, eax
je 0x759305c7
push 0
push eax
push 0x170
push 0x966
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1f4
push 1
push dword [ebp + 8]
mov dword [esi + 0x7594d3d0], edi
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
pop esi
jmp 0x759277f8

Function at 0x75927802
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
lea ebx, [ebx*8 + 0x7594d3d4]
push esi
mov esi, dword [ebx]
test esi, esi
jne 0x7593061e
pop esi
pop ebx
pop ebp
ret 4
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
test eax, eax
jbe 0x75930644
push edi
lea edi, [esi + 4]
mov dword [ebp + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_DestroyIcon]
add edi, 8
dec dword [ebp + 8]
jne 0x75930633
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebx], 0
jmp 0x7592781d

Function at 0x75927864
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x75925ec0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x759278bb
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x759278c0
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x75927a33
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0xe
pop edi
lea eax, [ebp - 8]
push eax
push 0x75922eb0
push 0x80000002
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x75927a90
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x75927a9c
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x75927a96
cmp dword [ebp - 0x10], 4
jne 0x75927a96
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
leave
ret
mov dword [ebp - 4], edi
jmp 0x75927a87
Function at 0x75927acd
Capabilities:
Get graphical window text
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x7594d0ac]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
and word [ebp - 0x404], 0
push esi
lea eax, [ebp - 0x404]
push eax
push 0x7592902c
push 0x75927b3c
push 0x75922808
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
cmp word [ebp - 0x404], 0
jne 0x75932f7b
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.75921930
leave
ret 4
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea esi, [eax + eax]
mov ecx, 0xff
sub ecx, eax
push ecx
lea eax, [ebp + esi - 0x202]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x75932fb7
mov word [ebp + esi - 0x204], 0x20
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x75927b2c

Function at 0x75927c63
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push 1
xor esi, esi
push esi
push 0x75926438
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x75927cbe
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x75927ccc
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x75927cb5
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], esi
pop esi
setne al
leave
ret