joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016fc6
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0
push edi
mov ebp, eax
call fcn.010170d9
test eax, eax
jl 0x10170c0
push dword [ebp + 4]
push dword [esi + 8]
call fcn.01016ee7
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_IStream_WritePidl]
test eax, eax
jl 0x10170c0
jmp 0x1017070
sub esp, 0x14
push ebp
push esi
push edi
push 1
push 0x101cc0c
push 0x101cb90
mov esi, ecx
xor ebp, ebp
push 0x80000001
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ebp
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov edi, eax
cmp edi, ebp
je 0x10170d2
push 4
lea eax, [esp + 0x1c]
push eax
push edi
mov dword [esp + 0x24], 9
call dword [sym.imp.SHLWAPI.dll_IStream_Write]
test eax, eax
jl 0x10170c1
mov dword [esp + 0xc], ebp
add esi, 0x38
push ebx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
call fcn.01018e69
test eax, eax
je 0x10170a6
mov eax, dword [esp + 0x10]
movzx eax, byte [eax*8 + 0x101b0d0]
push eax
push edi
call fcn.010170d9
test eax, eax
jl 0x10170c0
mov eax, dword [esi]
cmp eax, ebp
je 0x1017098
cmp dword [esi + 8], ebp
je 0x1017098
cmp dword [eax], ebp
mov dword [esp + 0x14], ebp
jle 0x1017098
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x14]
mov ebx, dword [eax + ecx*4]
mov eax, dword [ebx]
cmp ebp, eax
jne 0x1016f94
push 1
push edi
call fcn.010170d9
test eax, eax
jl 0x10170c0
push dword [ebx + 4]
push edi
call dword [sym.imp.SHLWAPI.dll_IStream_WritePidl]
test eax, eax
jl 0x10170c0
inc dword [esp + 0x14]
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [eax]
jl 0x101705a
push 2
push edi
call fcn.010170d9
test eax, eax
jl 0x10170c0
xor ebp, ebp
inc dword [esp + 0x10]
add esi, 0x1c
cmp dword [esp + 0x10], 6
jb 0x101701f
mov dword [esp + 0x18], 1
pop ebx
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp dword [esp + 0x14], 0
je 0x1025cd9
pop edi
pop esi
pop ebp
add esp, 0x14
ret
push 0x101cc0c
push 0x101cb90
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x10170d2
Function at 0x101833c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and eax, 0xf
push eax
mov esi, ecx
push 0x421
push dword [esi + 0x20]
call ebx
test byte [ebp + 0xc], 0x10
jne 0x101838e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [ebp + 0x14]
cmp eax, 0x1388
jb 0x101838e
call edi
push 0x101b4a0
mov dword [ebp - 4], eax
call fcn.010090f3
mov ecx, esi
call fcn.01008907
mov ecx, 0x103f0f8
call fcn.010090db
push 0xb
pop ecx
xor eax, eax
mov dword [0x103f118], 1
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x2bc]
add eax, 0x88
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x439
push dword [esi + 0x20]
mov dword [ebp - 0x34], 0x30
call ebx
xor edi, edi
inc edi
push 0
mov ecx, esi
mov dword [esi + 0x2c4], edi
call fcn.01017f6f
lea eax, [ebp - 0x34]
push eax
push edi
push 0x411
push dword [esi + 0x20]
call ebx
lea eax, [esi + 0x2b8]
push eax
push dword [ebp + 0x10]
mov ecx, esi
push 0x43e
push 2
call fcn.010081c5
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1018ce2
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [edi]
xor edx, edx
cmp ecx, edx
je 0x100e398
cmp dword [esi], edx
je 0x100e402
mov eax, dword [esi - 0xc]
cmp eax, edx
mov dword [esi], edx
mov dword [esi - 8], eax
je 0x1016c02
mov eax, dword [eax]
push ecx
mov dword [esi + 0xc], eax
mov dword [esi + 8], edx
call dword [sym.imp.SHELL32.dll_ILFree]
and dword [edi], 0
push 4
lea ecx, [esi - 0xc]
call fcn.01018805
test eax, eax
je 0x100e3f9
push dword [ebp - 8]
push dword [ebx + 0x2c]
call fcn.01011432
test eax, eax
mov dword [ebp - 0xc], eax
je 0x100e3f9
mov eax, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [edi], eax
lea eax, [esi - 0xc]
push eax
push dword [ebp - 0xc]
mov ecx, ebx
call fcn.01011516
mov ecx, dword [ebp - 0xc]
call fcn.01018863
lea eax, [esi - 8]
push eax
call fcn.0100c0e8
cmp dword [ebx + 4], 0
je 0x1018dec
cmp dword [esi + 4], 0
jne 0x1018dec
mov edi, dword [edi]
test edi, edi
je 0x1018dec
xor eax, eax
inc eax
push eax
push edi
push 0x2381f
push dword [ebp - 4]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 4]
call fcn.0100d54e
jmp 0x1018dec
push edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [esi], 1
jmp 0x1018d6f
xor eax, eax
jmp 0x100e3aa
lea ecx, [esi - 0xc]
call fcn.0100c628
jmp 0x1018df5
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x580
push 0x28e44000
lea eax, [ebp - 0x14]
push eax
call fcn.01018edd
lea esi, [ebx + 0x20]
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x1025dd6
push ebx
push 0x1018ef9
push dword [ebx + 0xe0]
call dword [fcn.0101b020]
push 0x40000069
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1018e06
and dword [ebp - 4], eax
lea esi, [ebx + 0x44]
push edi
mov ecx, dword [ebp - 4]
shl ecx, 3
mov eax, dword [ecx + 0x101b0d0]
mov ecx, dword [ecx + 0x101b0d4]
lea edi, [esi - 4]
mov dword [ebx + 0x28], ecx
cmp dword [edi], 0
mov dword [ebp - 0xc], eax
je 0x1016bed
push dword [ebp - 4]
mov ecx, ebx
call fcn.01018e69
test eax, eax
je 0x1018df5
test byte [ebx + 0x28], 8
je 0x1018d96
push 0x20000
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x1025de6
push dword [ebp - 0xc]
call fcn.01018e16
test eax, eax
jne 0x1016c09
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1016c09
mov eax, dword [edi]
test eax, eax
je 0x100e38c
push dword [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_ILIsEqual]
test eax, eax
je 0x100e38c
cmp dword [esi], 0
jne 0x100e38c
cmp dword [esi + 4], 0
je 0x100e38c
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_ILFree]
inc dword [ebp - 4]
add esi, 0x1c
cmp dword [ebp - 4], 6
jb 0x1018d4b
pop edi
pop esi
mov dword [ebx + 0xf4], 1
xor eax, eax
pop ebx
leave
ret
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
jmp 0x1018d1f
or dword [ebx + 0x28], 1
jmp 0x1018d96
Function at 0x101ec9f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
or dword [ebp + 0x1c], 4
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov word [ebp - 0x208], bx
jne 0x1022252
mov dword [ebp + 0xc], ebx
cmp dword [ebp + 0x10], ebx
je 0x1022280
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1022280
cmp word [ebp - 0x208], bx
je 0x101ed19
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x101ed19
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x102226b
cmp eax, 5
je 0x102226b
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1022280
cmp dword [ebp + 0x14], ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
jne 0x1022298
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x10222b6
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
pop edi
pop esi
pop ebx
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x103f654]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp + 0xc], eax
jmp 0x101ecc4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x101ed19
push ebx
push 0x10
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x101ed2e
push edi
lea eax, [ebp - 0x608]
push eax
push dword [ebp + 0x14]
push dword [0x103f654]
call esi
lea ebx, [ebp - 0x608]
jmp 0x101ed42
push edi
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 0x18]
push dword [0x103f654]
call esi
lea eax, [ebp - 0x408]
jmp 0x101ed4d
Function at 0x101efc2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
je 0x10255a0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
push ecx
setne bl
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
call esi
cmp eax, ebx
jne 0x101f052
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call ebx
test eax, eax
jne 0x101f032
cmp dword [ebp + 0x10], 0xffffffff
je 0x101f059
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x101efed
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x20], 0x20
je 0x10255b0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x101f00b
pop esi
pop ebx
pop edi
leave
ret 0x10
mov ecx, dword [ebp - 4]
jmp 0x101efed
or eax, 0xffffffff
cmp ecx, eax
je 0x101f054
jmp 0x101efe5
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x101f00b

Function at 0x101f18d
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
lea ecx, [esi + 0x38]
cmp eax, dword [ecx]
jne 0x10215ec
push ebx
xor ebx, ebx
cmp word [esp + 0xc], bx
push edi
jne 0x101f1e1
movzx eax, word [esp + 0x14]
push eax
call fcn.01005926
push 0x11
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
jl 0x1021634
push 1
push ebx
push edi
call fcn.01002054
cmp dword [eax], ebx
je 0x101f1e7
push ebx
push eax
push edi
mov ecx, esi
call fcn.0101f1f5
pop edi
pop ebx
pop esi
ret 0xc
cmp dword [esi + 0xa8], 0xffffffff
jne 0x101f1e1
jmp 0x1021640
movzx eax, word [esp + 8]
sub eax, 0xf020
je 0x1021624
sub eax, 0x40
jne 0x101f1e3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov eax, ecx
push eax
push 0
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_EndTask]
jmp 0x101f1e3
push 0xb
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x101f1e3
push ebx
push edi
call fcn.01002d9c
jmp 0x101f1e1
push ebx
push edi
mov ecx, esi
call fcn.01002d9c
push edi
mov ecx, esi
call fcn.0102a95e
jmp 0x101f1e1
Function at 0x101fae0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x28c], ebx
call fcn.0101fa45
push dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.0101fb96
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
jne 0x1024cfc
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x445
push dword [esi + 0x14]
mov dword [ebp - 0x10], ecx
call edi
cmp dword [ebp - 8], ebx
mov dword [ebp - 4], eax
jne 0x1024d12
lea ecx, [esi + 0x23c]
push dword [ecx + 4]
push 1
push dword [ebp - 4]
call fcn.010067a6
mov edi, eax
cmp edi, ebx
je 0x101fb92
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1024da0
cmp dword [ebp - 8], ebx
jne 0x1024d26
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.01017f48
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x101fb41
jmp 0x101fb14
xor eax, eax
jmp 0x101fb81
push ebx
push dword [esi + 0x2dc]
push 0x419
push dword [esi + 0x14]
call edi
jmp 0x101fb88
push eax
push dword [esi + 0x14]
call fcn.01034639
mov dword [esi + 0x2dc], eax
jmp 0x101fb41
push dword [edi]
call fcn.010343f4
mov eax, dword [esi + 0x2bc]
cmp eax, ebx
je 0x1024d7c
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x1024d7c
mov ecx, dword [eax + 4]
cmp ecx, dword [edi + 4]
jne 0x1024d7c
cmp dword [ebp + 8], 0x204
je 0x1024d5f
cmp dword [ebp + 8], 0x206
je 0x1024d5f
mov dword [esi + 0x314], ebx
jmp 0x1024d69
mov dword [esi + 0x314], 1
push 0x405
push ebx
push ebx
push dword [eax + 4]
mov ecx, esi
push dword [eax]
call fcn.01017df7
push 3
push edi
push dword [ebp - 4]
mov ecx, esi
call fcn.01008152
push ebx
mov ecx, esi
mov dword [esi + 0x2c8], 1
call fcn.01017f6f
jmp 0x101fb73
push 1
push ebx
push dword [ebp - 4]
mov ecx, esi
call fcn.01007e9d
jmp 0x101fb7e
Function at 0x1027e47
Capabilities:
Create process on windows
Create process suspended
Create thread
Resume thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1027f77
push ebx
push eax
call fcn.01027dc4
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
je 0x1027f71
lea ecx, [ebp - 0x24]
push ecx
push 4
push eax
push 0x1027e0e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1027f6c
push edi
xor eax, eax
mov dword [ebp - 0x20], esi
push 0x10
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
pop ecx
push dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x400
xor eax, eax
mov dword [ebp - 0x68], esi
lea edi, [ebp - 0x64]
push 0x1039ad8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x478]
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, [ebp - 0x478]
push eax
push esi
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1027f5b
push dword [ebp - 0x20]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x1027f41
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 8], 1
call edi
push dword [ebp - 4]
call edi
cmp dword [ebp + 0xc], esi
je 0x1027f4c
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 4]
push esi
call fcn.0101efc2
jmp 0x1027f4c
push 5
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x20]
call ebx
push dword [ebp - 0x1c]
call ebx
cmp dword [ebp - 8], esi
jne 0x1027f66
push 5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 4]
call ebx
pop edi
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0xc]
call ebx
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret 8
Function at 0x1028045
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xafc
push ebx
push esi
push edi
push 0x1d
mov edi, 0x1030
mov ebx, 0x21a
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x102806b
add edi, 4
inc ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0xf4]
push eax
push 0x20c
push dword [0x103f654]
call esi
push 0x400
lea eax, [ebp - 0xafc]
push eax
push ebx
push dword [0x103f654]
call esi
push edi
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xafc]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x102810d
push 0x104
lea eax, [ebp - 0x2fc]
push eax
push 0x1039b60
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x54], esi
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102810d
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10281a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push esi
push 0x200
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
test byte [ebp - 0x28], 0x40
je 0x102820a
call fcn.01028121
cmp eax, 2
jb 0x1028210
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x1039bcc
push dword [0x1040498]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x493e0
sbb esi, esi
neg esi
jne 0x1028210
push 1
jmp 0x102820b
push esi
call fcn.01028152
mov eax, esi
pop esi
leave
ret

Function at 0x1028215
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 7
lea eax, [ebp - 0x10]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x102824f
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 2
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x30]
jmp 0x1028252
xor eax, eax
inc eax
leave
ret 4
Function at 0x1028df0
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
and dword [ebp - 4], edi
push edi
push 0x101d408
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [ebp + 8]
jne 0x1028e59
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push 0x1039c10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1028e4c
cmp dword [ebp - 8], 1
jne 0x1028e4c
cmp word [ebx], ax
je 0x1028e4c
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1028e72
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test edi, edi
je 0x1028e72
push 1
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x102b5e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0x101b5ec
push 0x101b3a8
push 0x80000001
mov dword [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
leave
ret

Function at 0x102c6dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
inc ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x102c733
push ebx
push esi
lea eax, [ebp - 0x208]
push 0x1039e08
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x102c6f9
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x102c795
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
test esi, esi
je 0x102c795
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x410]
push eax
call edi
and word [esi], 0
lea eax, [ebp - 0x410]
push eax
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push 0x1039df8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x102c755
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x102c865
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
sub eax, 0x55c
push esi
mov esi, ecx
je 0x102c899
dec eax
jne 0x102c895
xor eax, eax
cmp dword [esp + 0xc], eax
je 0x102c895
push eax
push eax
push dword [esi + 0x40]
call dword [sym.imp.SHLWAPI.dll_Ordinal_479]
push dword [0x103f068]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret 0xc
xor eax, eax
cmp dword [esp + 0xc], eax
je 0x102c87e
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x10002
push 0x128
push dword [esi + 4]
call edi
push dword [esi + 4]
push 1
push 0x459
push dword [0x103f068]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
pop edi
mov ecx, esi
jge 0x102c8f0
push dword [esi + 0x3a8]
call fcn.0100b478
jmp 0x102c895
push dword [esi + 0x38]
jmp 0x102c8e9

Function at 0x102ccd2
Capabilities:
Enumerate gui resources

Disassembly:
push esi
push edi
mov edi, 0x103f0e0
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x47c]
test eax, eax
je 0x102ccfc
mov eax, dword [eax + 4]
test eax, eax
je 0x102cd23
push eax
call dword [0x103b8b8]
jmp 0x102cd23
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi + 0x47c], eax
je 0x102cd23
push 4
push 0x34
call dword [fcn.0101d2c8]
mov ecx, dword [esi + 0x47c]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x47c]
test eax, eax
je 0x102cd3f
mov ecx, dword [esp + 0xc]
push esi
push 0x102cc69
mov dword [eax], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
ret 4

Function at 0x102cdbd
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
push ebx
xor ebx, ebx
push ebx
push 0x16
lea eax, [ebp - 0x4c8]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x102ce7d
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0x2c0]
je 0x102cdf4
push 0x1039ea8
jmp 0x102cdf9
push 0x1039e88
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
call esi
push 0x1039e84
lea eax, [ebp - 0x2c0]
push eax
call esi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
inc eax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], ax
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c0]
push eax
push ebx
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102ce7b
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret 4