joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019df2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push ebx
push 0x1019c24
push 0x101fe68
push 0x80000001
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x1019e81
push edi
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_IStream_Read]
test eax, eax
jl 0x1019e7a
cmp dword [ebp - 0x18], 0x14
jne 0x1019e7a
mov edi, dword [ebp - 4]
push dword [ebp - 0x14]
mov ecx, edi
call fcn.01019c49
test eax, eax
je 0x1019e7a
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x1019e7a
cmp dword [ebp - 0xc], ebx
jbe 0x1019e7a
mov eax, dword [ebp - 8]
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push eax
push esi
call dword [ecx + 0x14]
test eax, eax
jne 0x1019e7a
push esi
call dword [fcn.01019e94]
mov dword [edi + 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ecx + 0x1c], ebx
pop esi
setne al
pop ebx
leave
ret 4

Function at 0x1019efb
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x1046080]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1019f90
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1019f71
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x1019f7c
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1022a3e
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01001aff
leave
ret
cmp word [ebp - 0x20c], si
je 0x1019f65
push edi
push 0x10
pop ecx
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
mov dword [ebp - 0x268], 0x44
mov word [ebp - 0x238], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x1019f65
push dword [ebp - 0x224]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x220]
call esi
jmp 0x1019f65
Function at 0x101bc59
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ecx + 0x74], 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 2
push 8
lea eax, [ebp - 8]
push eax
push 3
push 0x10090b8
push 0x1009008
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
leave
ret
Function at 0x101c6e4
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x3b8]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 4], 0x10
je 0x101c712
push ebx
push ebx
push 0x438
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [esi + 0x3ac]
cmp dword [edi], ebx
jne 0x1025699
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x38]
mov dword [esi + 0xc], 1
call edi
push 2
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [esi + 0x38]
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 4]
call edi
push 2
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push edi
push dword [esi + 4]
call ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [ebp - 0x1c]
push edi
push edi
push 0x1f
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x10256b5
lea eax, [esi + 0x4b8]
cmp dword [eax], edi
lea ebx, [esi + 0x4b0]
je 0x101c7c2
mov ebx, eax
mov eax, dword [ebx]
cmp eax, edi
je 0x10256bd
push dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x10256ce
cmp dword [ebp - 4], 0x10
jne 0x101c7ff
push edi
push 0x10002
push 0x128
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.0100ed3a
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0103022a
jmp 0x101c720
mov dword [ebp - 4], edi
jmp 0x101c7b0
mov ecx, esi
call fcn.0100fe2b
mov eax, dword [ebx]
cmp eax, edi
jne 0x101c7cc
call fcn.0100ab49
jmp 0x101c7e5
Function at 0x101df4f
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x101e026
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x10165f0
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.01016619
mov eax, dword [ebp - 0xc]
add edi, eax
lea eax, [edi + ebx]
cmp eax, dword [ebp + 0xc]
jge 0x101e026
jmp 0x1026a8c
push 0x28
push eax
push 0x1003
push ebx
call edi
and word [esi + 0x104], 0
jmp 0x101df8d
push 0x28
push eax
push 0x1f
push ebx
call edi
and word [esi + 0x60], 0
jmp 0x101df9a
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x1026a7e
push ebx
lea eax, [esi + 0xb4]
cmp word [eax], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, 0x400
je 0x1017c69
lea eax, [esi + 0x10]
cmp word [eax], 0
je 0x1017c81
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1026a85
push ebx
mov ecx, esi
call fcn.01020207
mov eax, dword [esi + 0x1b0]
cmp eax, ebx
je 0x101dfcf
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101e19c
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, dword [ebp - 0xc]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x10]
sar edi, 1
cmp eax, dword [ebp - 0x18]
jle 0x101e008
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0101e0be
mov eax, dword [ebp - 0xc]
add eax, edi
add eax, ebx
cmp eax, dword [ebp + 0xc]
jl 0x10165da
xor edi, edi
cmp dword [esi + 0x1b0], edi
je 0x101e03c
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x104673c]
lea eax, [ebx + eax*4]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push edi
push edi
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push dword [esi + 4]
call ebx
push eax
push edi
push 0xfffffffffffffff0
push dword [esi + 4]
call ebx
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov ecx, dword [0x1046738]
mov eax, dword [0x10460bc]
mov edx, dword [ebp - 0x24]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
mov esi, ecx
sub esi, edx
cmp esi, eax
jge 0x101e09f
lea ecx, [edx + eax]
sub ecx, edx
movzx eax, cx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop edi
pop ebx
pop esi
leave
ret 8
xor eax, eax
jmp 0x101e0b4
xor eax, eax
jmp 0x101e0b2
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x101e026
cmp ecx, dword [ebp - 0x18]
mov ebx, eax
jle 0x101e026
mov dword [ebp - 0x18], ecx
jmp 0x101e026
Function at 0x101f86b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1046080]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x101f8f8
lea eax, [ebp - 0x40c]
push 0x100
push eax
call fcn.0101f955
and word [ebp - 0x20c], 0
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x80000001
mov dword [ebp - 0x410], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x101f8ec
cmp word [ebp - 0x20c], ax
je 0x101f8ec
push 0x20013
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.WINMM.dll_PlaySoundW
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4

Function at 0x101fb21
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea eax, [ebp - 0x34]
push eax
push 1
push 0x411
push dword [esi + 0x20]
call ebx
lea eax, [esi + 0x2b8]
push eax
mov eax, dword [esi + 0x2bc]
push dword [eax + 0x288]
mov ecx, esi
push 0x43e
push 2
call fcn.010075bc
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
test byte [eax + 0x28c], 0x10
jne 0x101fa31
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [ebp + 0xc]
cmp eax, 0x1388
jb 0x101fa31
call edi
push 0x101fa48
mov dword [ebp - 4], eax
call fcn.0101f86b
mov ecx, esi
call fcn.010074ec
mov ecx, 0x10460f8
call fcn.0101f7be
jmp 0x10271b2
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push edi
push 0x439
push dword [esi + 0x20]
add ecx, 0x88
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x10], ecx
call ebx
push edi
mov ecx, esi
mov dword [esi + 0x2c4], 1
call fcn.0101f6f2
jmp 0x1021ab9
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2bc]
test eax, eax
jne 0x1021aad
jmp 0x102719e
add eax, 8
push eax
push ecx
push 0x421
push dword [esi + 0x20]
call ebx
jmp 0x102719e
mov ecx, dword [eax + 0x28c]
and ecx, 0xf
jmp 0x101fb4c
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1021a9f
jmp 0x101fb4c
cmp dword [esi + 0x2bc], edi
pop edi
jne 0x101f9cd
jmp 0x101f9fe
mov eax, dword [esi + 0x2bc]
test eax, eax
push edi
jne 0x101fa07
jmp 0x101fa31
and dword [ebp - 0x34], 0
push 0xb
xor eax, eax
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov dword [0x1046118], 1
mov ecx, dword [esi + 0x2bc]
xor edi, edi
cmp ecx, edi
jne 0x101fa6e
jmp 0x101fa96
Function at 0x10211bd
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x1046080]
or dword [ebp + 0x1c], 4
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x614], edi
mov word [ebp - 0x20c], bx
jne 0x1025396
mov dword [ebp - 0x610], ebx
cmp esi, ebx
je 0x10253c7
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10253c7
cmp word [ebp - 0x20c], bx
je 0x102124d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x102124d
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x10253b2
cmp eax, 5
je 0x10253b2
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10253c7
cmp dword [ebp + 0x14], ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
jne 0x10253dd
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x10253fb
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x10460dc]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x610], eax
jmp 0x10211fb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x102124d
push ebx
push 0x10
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x1021262
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x14]
push dword [0x10460dc]
call esi
lea ebx, [ebp - 0x40c]
jmp 0x1021276
push edi
lea eax, [ebp - 0x60c]
push eax
push dword [ebp + 0x18]
push dword [0x10460dc]
call esi
lea eax, [ebp - 0x60c]
jmp 0x1021281
Function at 0x10214ab
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
je 0x10281bf
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
push ecx
setne bl
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
call esi
cmp eax, ebx
je 0x1021acb
pop esi
pop ebx
pop edi
leave
ret 0x10
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x1021adb
mov ecx, dword [ebp - 4]
jmp 0x10214d8
push 1
push edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call ebx
test eax, eax
je 0x1021b0c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x20], 0x20
je 0x10281cf
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1021adb
cmp dword [ebp + 0x10], 0xffffffff
je 0x1021ad3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x10214d8
or eax, 0xffffffff
cmp ecx, eax
jne 0x10214d0
jmp 0x10214f6
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1021adb

Function at 0x1021e6a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov edi, ecx
cmp dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x1021ed0
cmp dword [ebp + 8], ebx
push esi
push 5
pop eax
lea esi, [edi + 8]
jne 0x1026b81
inc dword [esi]
cmp dword [esi], eax
ja 0x1021ecf
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push 0x101fe68
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021ecf
push 4
push esi
push 4
push ebx
push 0x101fee4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov dword [edi + 0xc], ebx
pop edi
pop ebx
leave
ret 4
mov dword [esi], eax
jmp 0x1021e90

Function at 0x1021f6c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax + 0xc], 0x71
push edi
mov edi, ecx
je 0x1028ecc
xor eax, eax
pop edi
pop ebp
ret 4
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jl 0x1028f07
push 0x11
call esi
test ax, ax
jl 0x1028f07
push 0x12
call esi
test ax, ax
jl 0x1028f07
test byte [edi + 0x48], 8
je 0x1028f07
mov ecx, edi
call fcn.0101af9b
test eax, eax
jl 0x1028f07
push eax
mov ecx, edi
call fcn.0103ff03
pop esi
jmp 0x1021f82
Function at 0x102b51f
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb00
mov eax, dword [0x1046080]
push ebx
push esi
push edi
push 0x1d
mov dword [ebp - 4], eax
mov edi, 0x1030
mov ebx, 0x21a
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x102b54f
add edi, 4
inc ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0xa4]
push eax
push 0x20c
push dword [0x10460dc]
call esi
push 0x400
lea eax, [ebp - 0xaac]
push eax
push ebx
push dword [0x10460dc]
call esi
push edi
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xaac]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x102b603
push 0x104
lea eax, [ebp - 0x2ac]
push eax
push 0x102b610
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0xb00], esi
lea edi, [ebp - 0xafc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0xb00]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b603
push dword [ebp - 0xab8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xabc]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001aff
leave
ret

Function at 0x102b6e5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1046080]
push 7
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x102b729
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 2
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x34]
jmp 0x102b72c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.01001aff
leave
ret 4
Function at 0x102b796
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x1046080]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push esi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x624], esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp eax, esi
mov dword [ebp - 0x628], eax
je 0x102b96b
push ebx
push eax
call fcn.0102b2c7
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x62c], eax
je 0x102b962
lea ecx, [ebp - 0x644]
push ecx
push 4
push eax
push 0x102b318
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 0x620], eax
je 0x102b95a
push edi
xor eax, eax
mov dword [ebp - 0x63c], esi
lea edi, [ebp - 0x638]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x688], esi
lea edi, [ebp - 0x684]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102b943
push 0x102b9e8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x102b943
push dword [ebp - 0x640]
lea eax, [ebp - 0x61c]
push 0x400
push 0x102b980
push 0x208
push eax
call fcn.0101f955
add esp, 0x14
test eax, eax
jl 0x102b943
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x688]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x688], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b943
push dword [ebp - 0x63c]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x102b91d
push dword [ebp - 0x638]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x624], 1
call edi
push dword [ebp - 0x620]
call edi
cmp dword [ebp + 0xc], esi
je 0x102b92b
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 0x620]
push esi
call fcn.010214ab
jmp 0x102b92b
push 5
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x63c]
call ebx
push dword [ebp - 0x638]
call ebx
cmp dword [ebp - 0x624], esi
jne 0x102b951
push 5
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x620]
call ebx
pop edi
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x628]
call ebx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
pop esi
call fcn.01001aff
leave
ret 8
Function at 0x102baaa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x102bac3
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x102bbc9
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 0x102bc00
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x102bbc7
cmp dword [ebp - 8], ebx
jne 0x102bbc7
cmp dword [ebp - 4], ebx
jne 0x102bbc7
cmp dword [ebp - 0xc], eax
je 0x102bbc7
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ebx, 0x102bbe8
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102bbc7
cmp dword [ebp - 8], 3
jne 0x102bbc7
test dword [ebp - 4], 3
jne 0x102bbc7
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi + 8], eax
je 0x102bbc7
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x102bbba
cmp dword [ebp - 8], 3
jne 0x102bbba
mov eax, dword [ebp - 4]
test al, 3
jne 0x102bbba
shr eax, 2
mov edi, eax
cmp edi, 0xa
jle 0x102bbba
cmp edi, 0xca
jge 0x102bbba
xor ecx, ecx
inc ecx
cmp ecx, edi
mov dword [esi + 0x10], edi
jge 0x102bbb8
mov eax, dword [esi + 8]
add eax, 4
mov edx, dword [eax]
cmp edx, dword [eax - 4]
jbe 0x102bbb6
cmp edx, 0xffff
ja 0x102bbb6
inc ecx
add eax, 4
cmp ecx, dword [esi + 0x10]
jl 0x102bb9e
cmp ecx, edi
je 0x102bbc7
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi + 8], 0
pop edi
pop ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x102bbd5
mov dword [esi + 0xc], eax
jmp 0x102bbe3
mov dword [esi + 0xc], 0x102bc28
mov dword [esi + 0x10], 0x1a
pop esi
leave
ret

Function at 0x102bc95
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x102bcd0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x102bcd0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [esi + 4]
push 4
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ecx, esi
pop esi
jmp fcn.0102baaa
pop esi
ret
Function at 0x102cba6
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
and dword [ebp - 4], edi
push edi
push 0x10133d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [ebp + 8]
jne 0x102cc11
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push 0x102cc34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102cc04
cmp dword [ebp - 8], 1
jne 0x102cc04
cmp word [ebx], ax
je 0x102cc04
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x102cc2a
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test edi, edi
je 0x102cc2a
push 1
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x102dad8
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4