joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6a1
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xafc
push ebx
push esi
push edi
push 0x1d
mov edi, 0x1030
mov ebx, 0x21a
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x100a6c7
add edi, 4
inc ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0xf4]
push eax
push 0x20c
push dword [0x103d768]
call esi
push 0x400
lea eax, [ebp - 0xafc]
push eax
push ebx
push dword [0x103d768]
call esi
push edi
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xafc]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x100a769
push 0x104
lea eax, [ebp - 0x2fc]
push eax
push 0x1002158
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x54], esi
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100a769
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100a790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0100a76e
test eax, eax
je 0x100a7f0
mov eax, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push 7
mov dword [ebp - 0x20], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
lea edi, [ebp - 0x1c]
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov dword [ebp - 0x28], eax
cmp word [eax], si
je 0x100a7e4
mov word [eax - 2], si
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100a95f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push esi
push 0x200
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
test byte [ebp - 0x28], 0x40
je 0x100a9c5
call fcn.0100a8dc
cmp eax, 2
jb 0x100a9cb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x1002200
push dword [0x103d784]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x493e0
sbb esi, esi
neg esi
jne 0x100a9cb
push 1
jmp 0x100a9c6
push esi
call fcn.0100a90d
mov eax, esi
pop esi
leave
ret
Function at 0x100aafa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 7
lea eax, [ebp - 0x10]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x100ab34
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 2
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x30]
jmp 0x100ab37
xor eax, eax
inc eax
leave
ret 4

Function at 0x100ac98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x42c
push ebx
xor ebx, ebx
push 0x1d
mov dword [ebp + 0x74], ebx
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x100ad93
push esi
push edi
mov ecx, 0xd2
lea edi, [ebp - 0x3b4]
rep stosd dword es:[edi], eax
xor edi, edi
inc edi
push edi
push ebx
push 0x10024c4
push 0x1002428
mov dword [ebp - 0x3b4], 0x348
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
test eax, eax
je 0x100ad91
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x43
call esi
test eax, eax
jne 0x100ad91
push 0x1000
call esi
test eax, eax
jne 0x100ad91
mov esi, dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
push ebx
lea eax, [ebp - 0x3b4]
push eax
mov dword [ebp + 0x74], edi
mov dword [ebp + 0x70], ebx
push ebx
jmp 0x100ad8a
test byte [ebp - 0x270], 8
jne 0x100ad7c
push 0x36
pop ecx
xor eax, eax
mov word [ebp - 0x6c], bx
lea edi, [ebp - 0x6a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x6c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3b0]
push eax
mov word [ebp - 0x28], 0xdc
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
test eax, eax
je 0x100ad7c
test byte [ebp - 0x24], 0x20
je 0x100ad7c
mov eax, 0x258
cmp dword [ebp + 0x40], eax
jb 0x100ad7c
cmp dword [ebp + 0x44], eax
jb 0x100ad7c
cmp dword [ebp + 0x3c], 0xf
jb 0x100ad7c
mov dword [ebp + 0x74], ebx
inc dword [ebp + 0x70]
push ebx
lea eax, [ebp - 0x3b4]
push eax
push dword [ebp + 0x70]
push ebx
call esi
test eax, eax
jne 0x100ad27
pop edi
pop esi
mov eax, dword [ebp + 0x74]
pop ebx
add ebp, 0x78
leave
ret
Function at 0x100affa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
lea eax, [ebp - 4]
push eax
mov esi, 0xf003f
push esi
push 0
push 0x1002770
push SysReAllocString
call ebx
test eax, eax
jne 0x100b0df
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push 0
mov edi, 0x1002758
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x100b0cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0
mov ebx, 0x1002754
push ebx
push 0
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call edi
test eax, eax
jne 0x100b0d5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
xor eax, eax
push eax
push esi
push eax
push ebx
push eax
push 0x1002724
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x100b0c7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push esi
push eax
push ebx
push eax
push 0x1002704
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x100b0be
push 4
push 0x1002698
push 1
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
jmp 0x100b0cf
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100b0e3
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10027e8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100b153
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100b153
push 0x10027cc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
push 0
push 0x100278c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
leave
ret
Function at 0x100c555
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push 0x1002df8
mov edi, 0x1002d80
push edi
mov esi, SysReAllocString
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
cmp eax, 2
jae 0x100c64f
sub eax, ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
je 0x100c5a8
dec eax
je 0x100c611
jmp 0x100c61f
push 0x1002d60
push 0x1002ac0
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1002d4c
lea eax, [ebp - 0x21c]
push eax
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100c611
cmp word [ebp - 0x424], ax
je 0x100c611
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0x1002d2c
push edi
push esi
mov dword [ebp - 8], 1
call ebx
xor eax, eax
cmp dword [ebp - 4], eax
sete al
push eax
call fcn.0102cd38
push 0
push 1
push 0x1002d0c
push 0x1002cf0
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
test eax, eax
jne 0x100c64f
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0x1002df8
push edi
push esi
mov dword [ebp - 8], 2
call ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c654
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
and dword [ebp - 4], edi
push edi
push 0x1002ac0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, dword [ebp + 8]
jne 0x100c6bd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push edi
push 0x1002e14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c6b0
cmp dword [ebp - 8], 1
jne 0x100c6b0
cmp word [ebx], ax
je 0x100c6b0
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100c6d6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test edi, edi
je 0x100c6d6
push 1
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x100d9da
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 2
push 1
push 0
push 0
push 0x1003304
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100da35
mov ecx, dword [esi + 0x64]
call fcn.0101772b
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x10032e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x100daa9
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, eax
and cx, 0x3ff
cmp cx, 4
jne 0x100dad0
shr ax, 0xa
cmp ax, 1
je 0x100dacc
cmp ax, 2
jne 0x100dad0
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x100dd28
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
push esi
mov esi, ecx
push 2
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push dword [esi + 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100dd6f
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x4c]
call fcn.0100dce1
test eax, eax
jne 0x100dd6f
mov eax, dword [ebp - 0xc]
jmp 0x100dd84
lea eax, [ebp - 0x10]
push eax
push fcn.0100dce1
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x4c], eax
pop esi
leave
ret 4

Function at 0x100e0ce
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x40000056
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x100e12a
push 1
push eax
push 0x100339c
mov esi, 0x1002d80
push esi
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
test eax, eax
mov dword [edi + 0x30], eax
je 0x100e12e
and dword [ebp - 4], 0
push 4
pop eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
add edi, 0x34
push edi
push 0
push 0x1003378
push esi
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
jmp 0x100e12e
and dword [edi + 0x30], 0
pop edi
pop esi
leave
ret

Function at 0x100e24d
Capabilities:
Capture webcam image

Disassembly:
push 0
push dword [esp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x100e7fb
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x100e822
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esi + 8]
cmp ecx, 0xdbba00
jbe 0x100e822
mov dword [esi + 8], eax
mov ecx, esi
pop esi
jmp fcn.0100d40a
pop esi
ret
Function at 0x100f1ad
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
jne 0x100f1cd
mov eax, dword [ebx + 0x2c]
mov dword [ebp + 0xc], eax
mov esi, eax
mov eax, dword [ebx + 0xc]
and dword [ebp + 8], 0
dec eax
je 0x100f323
sub eax, 0x10000
je 0x100f24f
dec eax
jne 0x100f32a
cmp dword [esi], 0
jne 0x100f234
push dword [ebx + 0x24]
lea ecx, [edi + 0x38]
call fcn.0100e24d
mov ecx, dword [ebx + 0x1c]
lea esi, [ebx + 0x54]
cmp ecx, dword [esi]
jl 0x100f234
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
sub ecx, dword [ebx + 0x6c]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 4]
push 0
push eax
call fcn.0100eb24
mov ecx, dword [ebp - 4]
push eax
push dword [ebx + 0x10]
call fcn.0100dad3
mov edi, dword [ebp - 4]
test byte [ebx + 0x28], 8
je 0x100f32a
push dword [edi + 0x68]
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x100f32a
test byte [ebx + 0x28], 8
je 0x100f276
call fcn.0100daa9
test eax, eax
jne 0x100f276
mov eax, dword [edi + 0x7c]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [edi + 0x68], eax
mov dword [ebp + 8], 0x12
test byte [esi + 4], 1
je 0x100f2de
mov eax, dword [edi + 0x80]
test eax, eax
je 0x100f2ab
push 0
lea ecx, [ebx + 0x14]
push ecx
mov ecx, dword [ebx]
xor edx, edx
cmp ecx, dword [edi + 0x38]
push 0
setne dl
inc edx
inc edx
push edx
push dword [ebx + 0x10]
push eax
call dword [sym.imp.UxTheme.dll_DrawThemeBackground]
or byte [ebp + 0xa], 0x40
jmp 0x100f2de
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call esi
push 0xd
mov dword [ebx + 0x50], eax
call esi
push 0xe
mov dword [ebx + 0x48], eax
call esi
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x28]
test al, 0x40
jne 0x100f2d7
or eax, 0x40
or byte [ebp + 0xa], 1
mov dword [ebx + 0x28], eax
or byte [ebp + 0xa], 2
mov esi, dword [ebp + 0xc]
test byte [esi + 4], 0x20
je 0x100f2eb
mov dword [ebp + 8], 4
cmp dword [esi], 0
jne 0x100f32a
push dword [ebx + 0x24]
or dword [ebp + 8], 0x10
lea ecx, [edi + 0x38]
call fcn.0100e24d
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
mov ecx, edi
call fcn.0100eb24
push eax
push dword [ebx + 0x10]
mov ecx, edi
call fcn.0100dad3
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ebx + 0x6c], eax
jmp 0x100f32a
mov dword [ebp + 8], 0x20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1012698
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
cmp eax, 0xffffffea
mov esi, ecx
ja 0x10127f5
je 0x10127e9
cmp eax, 0xfffffd33
je 0x10127dc
cmp eax, 0xfffffd37
je 0x10127ac
cmp eax, 0xfffffd3a
je 0x1012747
cmp eax, 0xfffffdee
jne 0x10128c0
push dword [edi + 4]
lea ecx, [esi + 0x38]
call fcn.0100e24d
push 1
xor ebx, ebx
push ebx
push eax
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.0100e849
test eax, eax
je 0x101272b
cmp dword [eax], ebx
jne 0x101272b
push dword [ebp + 8]
mov ecx, esi
lea ebx, [edi + 0x10]
call fcn.0100eb24
push eax
push 0x1003530
push 0x50
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0
push 0x50
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*2 + 0x10]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0100ecce
jmp 0x10128c0
push dword [edi + 0xc]
lea ecx, [esi + 0x38]
call fcn.0100e24d
mov ecx, esi
mov edi, eax
call fcn.0100ee4a
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esi + 0x44], eax
je 0x101277e
push eax
mov ecx, esi
call fcn.0100eb7c
cmp eax, edi
jne 0x101277e
push 0x11
call ebx
test ax, ax
jge 0x1012788
push 0
push edi
mov ecx, esi
call fcn.0100ee7d
push 0x11
call ebx
test ax, ax
jl 0x10128c0
push 0
push edi
mov ecx, esi
call fcn.0100ee7d
push edi
mov ecx, esi
call fcn.010107e8
jmp 0x10128c0
cmp dword [esi + 0x60], 0
je 0x10127ba
xor eax, eax
inc eax
jmp 0x10128c2
test byte [edi + 0x14], 2
je 0x10128c0
push dword [edi + 0x10]
lea ecx, [esi + 0x38]
call fcn.0100e24d
push eax
mov ecx, esi
call fcn.0100f6dc
jmp 0x10128c0
push edi
mov ecx, esi
call fcn.01012639
jmp 0x10128c0
mov ecx, esi
call fcn.0100fb0a
jmp 0x10128c0
cmp eax, 0xffffffec
je 0x1012896
cmp eax, 0xfffffff1
je 0x101281b
cmp eax, 0xfffffff4
jne 0x10128c0
push 0
push edi
mov ecx, esi
call fcn.0100f1ad
jmp 0x10128c2
mov edi, dword [edi + 0xc]
cmp edi, 0xd
je 0x101282c
cmp edi, 0x20
jne 0x10128c0
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x447
push dword [esi + 0x38]
call edi
mov ebx, eax
test ebx, ebx
jl 0x10127b2
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x43f
push dword [esi + 0x38]
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], reloc.SHELL32.dll_SHChangeNotifyDeregister
call edi
xor byte [ebp - 0x10], 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x440
push dword [esi + 0x38]
call edi
push 1
push 0
push ebx
mov ecx, esi
call fcn.0100e849
push 0
push eax
push ebx
mov ecx, esi
call fcn.010125a1
jmp 0x10127b2
push dword [edi + 0xc]
lea ecx, [esi + 0x38]
call fcn.0100e24d
push 1
push 0
push eax
mov ecx, esi
call fcn.0100e849
test eax, eax
je 0x10128c0
cmp dword [eax], 0
je 0x10128c0
mov ecx, esi
call fcn.0100ee4a
mov dword [esi + 0x44], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1012ee1
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
lea ecx, [esi + 0x38]
cmp eax, dword [ecx]
je 0x1012f31
movzx eax, word [esp + 8]
sub eax, 0xf020
je 0x1012f24
sub eax, 0x40
jne 0x1012f96
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov eax, ecx
push eax
push 0
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_EndTask]
jmp 0x1012f96
push 0xb
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1012f96
push ebx
xor ebx, ebx
cmp word [esp + 0xc], bx
push edi
jne 0x1012f94
movzx eax, word [esp + 0x14]
push eax
call fcn.0100e24d
push 0x11
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
jge 0x1012f61
push ebx
push edi
call fcn.0100ee7d
jmp 0x1012f94
push 1
push ebx
push edi
call fcn.0100e849
cmp dword [eax], ebx
je 0x1012f7a
push ebx
push eax
push edi
mov ecx, esi
call fcn.010125a1
jmp 0x1012f94
cmp dword [esi + 0xa8], 0xffffffff
jne 0x1012f94
push ebx
push edi
mov ecx, esi
call fcn.0100ee7d
push edi
mov ecx, esi
call fcn.010107e8
pop edi
pop ebx
pop esi
ret 0xc
Function at 0x1013630
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xac
push ebx
push esi
push edi
push 0x1003598
mov esi, ecx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [esi + 0xbc], eax
lea eax, [esi + 8]
push eax
push dword [esi + 0x20]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
xor ebx, ebx
push ebx
push ecx
mov eax, esp
push ebx
push 0x52009344
push ebx
push ecx
mov dword [eax], ebx
mov eax, esp
mov dword [eax], ebx
push dword [esi + 0x20]
lea edi, [esi + 0x38]
mov ecx, edi
call fcn.0100fda4
mov eax, dword [edi]
cmp eax, ebx
je 0x10137c2
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x353
push dword [0x103d768]
push 0x44d
push eax
call ebx
mov ecx, esi
call fcn.01011a43
mov eax, dword [esi + 0x74]
not eax
test al, 1
mov eax, 0x1002fec
jne 0x10136bc
mov eax, 0x1003000
push eax
push 0
push 0x200b
push dword [edi]
call ebx
push 0
push 0
push 0x100db92
push dword [edi]
call fcn.01029e4f
push 0
push 0x14
push 0x41e
push dword [edi]
call ebx
xor ecx, ecx
push ecx
xor eax, eax
push eax
mov ecx, edi
call fcn.0100e1a9
push 0x3c0
push 0
push 0x454
push dword [edi]
call ebx
push 0
push 6
push 0x2007
push dword [edi]
call ebx
mov ecx, esi
call fcn.0100f893
lea eax, [ebp + 0x6c]
push eax
mov ecx, edi
call fcn.0100fdca
mov eax, dword [eax]
xor ebx, ebx
cmp eax, ebx
je 0x1013736
push 3
push 3
push 0xfffffffffffffff0
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_165]
push 0x1003584
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 3
push dword [esi + 0x20]
mov dword [esi + 0x3c], eax
call dword [sym.imp.SHELL32.dll_Ordinal_181]
push 1
push ebx
push ebx
mov ecx, esi
call fcn.010133e2
push esi
push 0x10128c9
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp + 0x70]
push eax
push 1
push 0x43a
push 0xc008000
push 0x8002
push dword [esi + 0x20]
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x70], ebx
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [esi + 0xb8], eax
push 0x50
lea eax, [ebp - 0x34]
push eax
push 0x252
push dword [0x103d768]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x34]
push eax
push dword [esi + 0x20]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
call esi
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call esi
xor eax, eax
jmp 0x10137c5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret

Function at 0x1014209
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0x1003714
push 0x1002d80
push SysReAllocString
mov dword [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
leave
ret
Function at 0x10144d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
push esi
xor esi, esi
push esi
lea ecx, [ebp - 0x1f4]
mov eax, 0x1f4
push ecx
push eax
push 0x29
mov dword [ebp - 0x1f4], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1014544
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, eax
and cx, 0x3ff
cmp cx, 4
jne 0x101452b
shr ax, 0xa
cmp ax, 1
je 0x101451f
cmp ax, 2
jne 0x101452b
mov dword [ebp - 0x1cc], 0x190
jmp 0x1014535
mov dword [ebp - 0x1cc], 0x2bc
lea eax, [ebp - 0x1dc]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov esi, eax
mov eax, esi
pop esi
leave
ret 4