joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e2f0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10372b8]
and dword [ebp - 0x64], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x68], eax
mov eax, dword [0x1037360]
cmp dword [eax + 0x1c], 1
je 0x102e33b
push 0x10
lea eax, [ebp - 0x8c]
push eax
movzx eax, word [ebp + 8]
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x102e33f
xor eax, eax
jmp 0x102e378
push ebx
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
push 0x17
pop ecx
mov ebx, eax
xor eax, eax
push eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push eax
push 0x102e295
lea eax, [ebp - 0x60]
push eax
push ebx
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x64]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01034a90
leave
ret 8

Function at 0x102e46a
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10372b8]
and dword [ebp - 0x4c], 0
mov dword [ebp - 4], eax
mov eax, dword [0x1037360]
mov dword [ebp - 0x50], 0x20
cmp dword [eax + 0x1c], 1
jne 0x102e4d3
lea eax, [ebp - 0x4c]
push eax
push 0x1003fb0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x102e555
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x102e555
cmp dword [ebp - 0x50], 0x12
jne 0x102e555
jmp 0x102e540
cmp dword [eax + 0x10], 5
jb 0x102e4fc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
mov dword [ebp - 0x48], eax
jne 0x102e4f0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x48], eax
xor ecx, ecx
test ax, ax
sete cl
mov eax, ecx
jmp 0x102e551
lea eax, [ebp - 0x4c]
push eax
push 0x1003f74
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x102e555
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0x1003f64
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102e54e
cmp dword [ebp - 0x54], 1
jne 0x102e54e
cmp dword [ebp - 0x50], 0x12
jne 0x102e54e
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x48]
call fcn.0102e122
jmp 0x102e55e
xor eax, eax
inc eax
test eax, eax
je 0x102e55e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
call fcn.01016a81
test eax, eax
jne 0x102e571
mov dword [ebp - 0x48], 0x409
cmp dword [ebp - 0x4c], 0
je 0x102e580
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x48]
call fcn.01034a90
leave
ret
Function at 0x102e5ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [0x10373dc]
push ebx
push esi
push dword [ebp + 0x10]
call fcn.01015f6c
mov ebx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x102e605
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x102e609
xor eax, eax
jmp 0x102e646
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov dword [ebp + 0x10], eax
call edi
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push esi
push ebx
mov dword [ebp + 8], eax
call edi
mov esi, dword [ebp + 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x102fa37
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10372b8]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xf003f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.0102f362
cmp eax, esi
jne 0x102fad8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x102fa8f
lea eax, [ebp - 0x204]
push eax
call fcn.0102fa37
cmp eax, esi
jne 0x102fad7
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x208]
je 0x102fa7f
call fcn.0102f2ef
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.0102f2ef
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01034a90
leave
ret 4
Function at 0x103055b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0102ebdb
push 2
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x10305af
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x103059a
call esi
mov esi, eax
jmp 0x1030675
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1030675
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x10305d0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x10305f5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10305e3
call esi
jmp 0x103066a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x103066c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x1030634
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.01034ea0
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov byte [eax + ebx], 0
mov edi, esp
test edi, edi
jne 0x103063c
xor eax, eax
jmp 0x103065e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.01034ea0
mov eax, esp
push esi
push edi
push eax
call fcn.0102efa4
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.01030419
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1030de5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10372b8]
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
mov dword [ebp - 4], eax
jne 0x1030e8e
mov dword [edi + 8], 1
mov eax, dword [0x10376c4]
cmp dword [eax + 0x74], ebx
je 0x1030e8e
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 3
mov dword [ebp - 0x210], eax
jne 0x1030e48
cmp word [ebp - 0x208], 0x5c
jne 0x1030e48
mov word [ebp - 0x208], bx
mov ebx, 0x1004330
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x210]
lea eax, [eax + ecx + 1]
cmp eax, esi
jae 0x1030e80
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01007c70
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
mov edi, dword [edi]
test edi, edi
pop esi
je 0x1030e8e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01034a90
leave
ret
Function at 0x1031229
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
jne 0x1031291
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.SoftwareVoiceSpeechRecognitionEngine
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103127e
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
mov dword [esi + 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x1031291
mov dword [esi + 0x14], edi
pop edi
pop esi
leave
ret
Function at 0x103196e
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10372b8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], eax
je 0x1031994
xor eax, eax
inc eax
jmp 0x1031b48
cmp dword [esi + 0x14], ebx
je 0x10319a3
mov eax, 0x80040007
jmp 0x1031b48
push edi
mov ecx, esi
call fcn.0103111e
mov edi, eax
cmp edi, ebx
jl 0x1031ab1
mov ecx, dword [0x1037360]
push ebx
call fcn.01012026
cmp dword [0x1037cfc], ebx
jne 0x10319e3
call fcn.01033310
mov edi, eax
cmp edi, ebx
jl 0x1031ab1
mov ecx, dword [0x1037cfc]
call fcn.01031e36
cmp dword [ebp + 8], ebx
je 0x10319f3
mov ecx, dword [0x1037cfc]
call fcn.01032b16
cmp dword [0x1037690], ebx
jne 0x1031a0a
call fcn.01026d0f
mov edi, eax
cmp edi, ebx
jl 0x1031aa6
cmp dword [0x1037698], ebx
jne 0x1031a4a
call fcn.01029033
mov edi, eax
cmp edi, ebx
jl 0x1031ab1
mov ecx, dword [0x1037698]
call fcn.0102906a
mov edi, eax
cmp edi, ebx
jge 0x1031a4a
mov ecx, dword [0x1037cfc]
call fcn.01032e89
call fcn.01029152
mov dword [0x1037698], ebx
jmp 0x1031ab1
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
mov edi, 0x100
push eax
mov dword [ebp - 0x208], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1031a97
cmp dword [ebp - 0x208], 0x7fffffff
ja 0x1031a97
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
mov eax, dword [0x10376c4]
push edi
add eax, 0xb0
push eax
call fcn.01006ca1
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov edi, eax
cmp edi, ebx
jge 0x1031abf
mov ecx, dword [0x1037cfc]
call fcn.01032e89
mov dword [esi + 0x14], 1
mov eax, edi
jmp 0x1031b47
xor ebx, ebx
inc ebx
mov dword [esi + 8], ebx
mov eax, dword [0x10376c4]
mov eax, dword [eax + 0xac]
cmp eax, 0xffffffff
je 0x1031adf
mov esi, dword [esi + 4]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x20]
mov ecx, dword [0x1037400]
call fcn.01026c40
cmp dword [ebp + 0xc], 0
je 0x1031afb
mov ecx, dword [0x10373f8]
call fcn.0101e92a
mov ecx, dword [0x1037cfc]
call fcn.01032e89
mov ecx, dword [0x10376c0]
call fcn.01029981
test eax, eax
je 0x1031b45
push dword [eax + 4]
mov esi, dword [eax]
mov ecx, dword [0x10373f8]
push esi
call fcn.0101de89
mov ecx, dword [0x1037400]
push 0
mov edi, eax
push edi
push esi
call fcn.01026a24
mov ecx, dword [0x1037400]
push ebx
push edi
push esi
call fcn.01026a24
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01034a90
leave
ret 8
Function at 0x103295e
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [0x10376c0]
push edi
call fcn.01029981
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x10329ec
mov ecx, dword [0x10373f8]
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 4]
call fcn.0101f26f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
lea esi, [ecx + eax]
mov eax, dword [ebp + 8]
sar eax, 1
sar esi, 1
sub esi, eax
push 1
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
add edi, 8
call fcn.010295b4
mov eax, dword [ebp + 0xc]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
cmp ecx, eax
jle 0x10329c9
sub eax, dword [ebp + 0xc]
mov edi, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
lea edx, [esi + ecx]
cmp edx, eax
jle 0x10329da
sub eax, ecx
mov esi, eax
cmp edi, dword [ebp - 0x10]
jge 0x10329e2
mov edi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x14]
jge 0x1032a4d
mov esi, dword [ebp - 0x14]
jmp 0x1032a4d
push esi
push 0x10043e0
call dword [sym.imp.USER32.dll_FindWindowW]
push esi
push 0x10043c4
push esi
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.010295b4
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
sub esi, ecx
cmp esi, dword [ebp - 0x24]
jge 0x1032a30
mov esi, dword [ebp - 0x14]
jmp 0x1032a3f
mov eax, dword [ebp - 0x1c]
lea edx, [esi + ecx]
cmp edx, eax
jl 0x1032a3f
sub eax, ecx
dec eax
mov esi, eax
mov edi, dword [ebp - 0x10]
sub edi, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x20]
jge 0x1032a4d
mov edi, dword [ebp - 8]
call fcn.0102e651
test eax, eax
jne 0x1032a59
or eax, 0xffffffff
mov ebx, dword [ebp - 4]
push 0x50
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
push eax
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x10376c4]
cmp dword [eax + 0x70], 0
jne 0x1032a86
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1032a99
mov ecx, ebx
mov dword [ebx + 0x8c], esi
mov dword [ebx + 0x90], edi
call fcn.01032574
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8

Function at 0x1032aa8
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1032b0c
mov eax, dword [0x10376c4]
cmp dword [eax + 0x8c], 0
je 0x1032b0c
cmp dword [eax + 0x88], 0
je 0x1032b0c
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
je 0x1032b0c
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0103237c
test eax, eax
je 0x1032b0c
mov eax, dword [ebp - 4]
add eax, 6
push eax
mov eax, dword [ebp - 8]
add eax, 0xa
push eax
mov ecx, esi
call fcn.0103295e
pop esi
leave
ret 4
Function at 0x103384a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 8]
push edi
push 0x5c
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1033870
inc edi
inc edi
jmp 0x1033878
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [0x10376c4]
add eax, 0x2b0
push eax
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10338ea
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x10036d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10338ea
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x10035c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1037360]
push 0
push 0
push 0x7ffd
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
leave
ret
Function at 0x1034419
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x10372b8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
push 0x1004538
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x103455d
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xa0]
push eax
push esi
push esi
push esi
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1034550
cmp dword [ebp - 0xa0], esi
je 0x1034550
mov dword [ebp - 0x9c], esi
jbe 0x1034550
push ebx
mov ebx, 0x103
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x9c]
mov dword [ebp - 0xa4], 0x40
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
je 0x10344ca
cmp edi, ebx
jne 0x1034536
cmp dword [ebp - 0xa4], 0x3c
ja 0x1034536
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x1034536
lea eax, [ebp - 0xa8]
push eax
push 0x100157c
push 1
push esi
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1034536
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push esi
push 0x10342df
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0x1037d00], 0x63
jae 0x103454e
cmp edi, ebx
je 0x103454e
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xa0]
jb 0x1034492
pop edi
pop ebx
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
call fcn.01034a90
leave
ret

Function at 0x103456c
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push esi
push edi
mov esi, ecx
push dword [esi]
call ebx
test eax, eax
je 0x10345a9
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10345db
push 0x10045bc
push dword [esi + 0x10]
call fcn.0102f3fb
mov ecx, dword [esi + 0x18]
push 0x1004598
push dword [esi + 0x14]
call fcn.0102f3fb
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10345db
push 1
call fcn.0102b2db
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10345e9
push 1
call fcn.0103427c
push dword [esi]
call ebx
test eax, eax
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
je 0x10345fb
push dword [esi]
call edi
push dword [esi + 4]
call ebx
test eax, eax
je 0x1034609
push dword [esi + 4]
call edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x1034617
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1034a90
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10372b8]
jne 0x1034aa1
test ecx, 0xffff0000
jne 0x1034aa1
ret
jmp fcn.01034aab

Function at 0x1034b90
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1004648
call fcn.01034d88
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x1034bd9
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1034bd9
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1034bf2
cmp ecx, 0x20b
je 0x1034bdf
and dword [ebp - 0x1c], 0
jmp 0x1034c09
cmp dword [eax + 0x1000084], 0xe
jbe 0x1034bd9
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1034c03
cmp dword [eax + 0x1000074], 0xe
jbe 0x1034bd9
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x10381d4], edi
mov dword [0x10381d8], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10381c0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10381bc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10381dc], eax
call fcn.01034f1e
cmp dword [0x10372c0], 0
jne 0x1034c69
push fcn.01034f1e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01034f07
push 0x1001554
push 0x1001550
call sub.msvcrt.dll__initterm
mov eax, dword [0x10381b8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10381b4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x100154c
push 0x1001544
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov eax, dword [eax]
test eax, eax
jne 0x1034cce
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x1034d7d
mov dword [ebp - 0x20], eax
cmp word [eax], 0x22
jne 0x1034d0f
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1034cea
cmp cx, 0x22
jne 0x1034cd7
cmp word [eax], 0x22
jne 0x1034cf5
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1034d03
cmp cx, 0x20
jbe 0x1034cf0
test byte [ebp - 0x54], 1
je 0x1034d1c
movzx ecx, word [ebp - 0x50]
jmp 0x1034d1f
cmp word [eax], 0x20
jbe 0x1034cf5
add eax, esi
mov dword [ebp - 0x20], eax
jmp 0x1034d0f
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.01012dfd
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1034d3f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1034d7b
mov eax, esi
call fcn.01034dc3
ret
Function at 0x411178
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x45a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00430d9f
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00434c90
add esp, 0x18
mov dword [ebp - 0x44], esi
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x40], 0x440
jb 0x4111c7
mov eax, dword [edi]
jmp 0x4111c9
mov eax, edi
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x34], eax
jb 0x4111d6
mov eax, dword [ebx]
jmp 0x4111d8
mov eax, ebx
cmp dword [ebp - 8], 6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
jl 0x411213
cmp byte [ebp + 0x10], 0
je 0x411213
mov esi, dword [0x45a014]
mov ecx, esi
push 0x401660
call fcn.004114e4
push 0x40108c
mov ecx, esi
call fcn.004114e4
mov dword [ebp - 0x38], 0x4016a4
cmp dword [ebx + 0x14], 8
jb 0x41121b
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x411223
mov edi, dword [edi]
push ebx
push edi
push 0x4016b0
push dword [0x45a014]
call fcn.004107b1
add esp, 0x10
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x411266
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x401708
push dword [0x45a014]
call fcn.004107b1
add esp, 0xc
mov eax, esi
jmp 0x411282
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x411279
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433104
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4114e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x45a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx]
push esi
mov esi, dword [ebp + 8]
cmp edx, 0xffffffff
je 0x41152c
mov ecx, esi
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41150a
sub ecx, edi
lea eax, [ebp - 8]
push ebx
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00433104
mov esp, ebp
pop ebp
ret 4