joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b57420
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
test edi, edi
lea esi, [esp + 0x1c]
jne 0x10b5743d
push edi
push 0xfffffed3
jmp 0x10b575b2
mov ax, word [edi + 2]
test ax, ax
jl 0x10b575ab
cmp ax, 0x1c
jg 0x10b575ab
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
cmp word [esp + 0x20], 0
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], ecx
mov dx, word [eax + 0xc]
mov word [esp + 0x28], dx
jne 0x10b574d1
mov ebp, 0xa
cmp word [esp + 0x1e], bp
jle 0x10b574d1
mov eax, dword [esp + 0x1e]
lea ecx, [esp + 0x1c]
add eax, 0xfffffffc
lea edx, [esp + 0xc]
push eax
push ecx
push edx
call fcn.10bca580
add esp, 0xc
test ax, ax
jne 0x10b574cf
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov dx, word [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
test ax, ax
mov dword [esp + 0x20], eax
mov word [esp + 0x28], dx
je 0x10b57480
jmp 0x10b574d1
mov esi, edi
xor eax, eax
xor ecx, ecx
mov ax, word [esi + 6]
mov cx, word [esi + 4]
shl eax, 0x10
or eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
fild qword [esp + 0xc]
fcom qword [0x10dbeb90]
fnstsw ax
test ah, 1
je 0x10b57505
fadd qword [0x10df4998]
mov ebp, dword [esi + 8]
test ebp, ebp
je 0x10b57548
xor edx, edx
xor eax, eax
mov dx, word [esi + 0xa]
mov ax, word [esi + 8]
shl edx, 0x10
or edx, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
fild qword [esp + 0xc]
fcom qword [0x10dbeb90]
fnstsw ax
test ah, 1
je 0x10b57540
fadd qword [0x10df4998]
fmul qword [0x10df4998]
faddp st(1)
mov di, word [esi + 0xc]
test di, di
je 0x10b57564
movsx ecx, di
mov dword [esp + 0x30], ecx
fild dword [esp + 0x30]
fmul qword [0x10df49a8]
faddp st(1)
mov cx, word [esi + 2]
cmp cx, 0x19
jl 0x10b57587
movsx edx, cx
mov eax, 0x51eb851f
mul edx
shr edx, 3
fmul qword [0x10dbebb8]
sub ecx, 0x19
dec edx
jne 0x10b5757b
movsx eax, cx
fdiv qword [eax*8 + 0x10df48d0]
test byte [esi], 1
je 0x10b575c1
mov ecx, dword [esi + 4]
movsx edx, di
or ecx, ebp
or ecx, edx
je 0x10b575c1
fchs
pop edi
pop esi
pop ebp
add esp, 0x20
ret
push 0
push 0xfffffed1
call dword [0x10df47d8]
fld qword [0x10dbeb90]
add esp, 8
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x10b81830
Capabilities:
Read .ini file

Disassembly:
push 0
push 0x104
push 0x10e2bd90
call sym.PBVM90.dll_UtilIniFile
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0x14
Function at 0x10b82490
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x108
mov byte [0x10e2bc88], 0
push ebx
push ebp
push esi
push edi
call fcn.10bd19f0
test eax, eax
je 0x10b824bf
lea eax, [esp + 0x18]
push 0x10df2040
push eax
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b824e5
mov edi, str.SoftwareSybase_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10bd19f0
mov ebp, dword [sym.imp.MSVCRT.dll__mbscat]
test eax, eax
je 0x10b82508
mov ebx, dword [esp + 0x120]
lea ecx, [esp + 0x18]
push ebx
push ecx
call ebp
add esp, 8
jmp 0x10b8253a
mov ebx, dword [esp + 0x120]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10bd19f0
test eax, eax
je 0x10b82554
lea eax, [esp + 0x18]
push 0x10df2068
push eax
call ebp
add esp, 8
jmp 0x10b82571
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [0x10df2074]
repne scasb al, byte es:[edi]
mov ecx, dword [str.9.0]
dec edi
mov dword [edi], ecx
mov byte [edi + 4], dl
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x10e2beac
lea edx, [esp + 0x30]
push 0
push edx
push reloc.oledlg.dll_OleUIAddVerbMenuA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10b82607
mov edx, dword [esp + 0x11c]
cmp byte [edx], 0
je 0x10b825cd
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push 0x10df2078
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10b825dd
mov ecx, dword [esp + 0x10]
push str.InitPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x11c]
cmp byte [eax], 0
je 0x10b8262b
push eax
push 0x10df2090
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
push 0
push str.InitPath90
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x10b83d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x80
push ebx
mov ebx, dword [esp + 0x88]
push ebp
mov ebp, ecx
cmp dword [ebx], 0x28
je 0x10b83db3
xor eax, eax
pop ebp
pop ebx
add esp, 0x80
ret 4
push edi
push esi
mov ecx, 0xa
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebp + 4]
mov dword [ebp + 0x14], 0
test al, 1
jne 0x10b83de3
mov eax, dword [ebp + 0xc]
mov ecx, eax
shr ecx, 0x10
je 0x10b83de3
push eax
mov ecx, ebp
call fcn.10b83f60
mov dword [ebp + 0xc], eax
test byte [ebp + 4], 4
je 0x10b83dfe
mov eax, dword [ebp + 0x10]
mov edx, eax
shr edx, 0x10
je 0x10b83dfe
push eax
mov ecx, ebp
call fcn.10b83f60
mov dword [ebp + 0x10], eax
test byte [ebp + 4], 8
je 0x10b83e3b
mov eax, dword [ebx + 0x14]
mov ecx, eax
shr ecx, 0x10
jne 0x10b83e30
mov ecx, dword [ebx + 8]
xor eax, eax
mov ax, word [ebx + 0x14]
lea edx, [esp + 0x10]
push 0x80
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x10]
push edx
jmp 0x10b83e31
push eax
mov ecx, ebp
call fcn.10b83f60
mov dword [ebp + 0x14], eax
test byte [ebp + 4], 1
je 0x10b83e4e
mov eax, dword [ebp + 0xc]
mov ecx, ebp
push eax
call fcn.10b83cf0
jmp 0x10b83e89
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 5
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10b83e89
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10b83e89
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, ebp
call fcn.10b83cf0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test byte [ebp + 4], 0x40
je 0x10b83e94
mov eax, dword [ebp + 0x24]
inc dword [eax]
pop esi
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0x80
ret 4
Function at 0x10b841e0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x100
push ebx
push ebp
push esi
push edi
push 5
mov ebp, ecx
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x10b843be
mov ecx, dword [esp + 0x124]
push ecx
push edi
mov ecx, ebp
call fcn.10b84120
test ah, 0x21
je 0x10b8430c
lea edx, [esp + 0x10]
push 0x100
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.10bd19f0
test eax, eax
push 0x26
je 0x10b8424c
mov ebx, dword [sym.imp.MSVCRT.dll__mbschr]
lea eax, [esp + 0x14]
push eax
call ebx
add esp, 8
mov esi, eax
jmp 0x10b84262
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
mov ebx, dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
mov esi, eax
test esi, esi
je 0x10b8430c
cmp byte [esi + 1], 0x26
jne 0x10b84296
call fcn.10bd19f0
test eax, eax
push 0x26
je 0x10b84283
add esi, 2
push esi
call ebx
jmp 0x10b8428d
add esi, 2
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10b8426a
test esi, esi
je 0x10b8430c
xor edx, edx
mov dl, byte [esi + 1]
mov esi, dword [sym.imp.MSVCRT.dll_toupper]
push edx
call esi
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x120]
push eax
call esi
add esp, 4
cmp ebx, eax
jne 0x10b8430c
mov ecx, dword [esp + 0x124]
push ecx
push edi
mov ecx, ebp
call fcn.10b84120
mov ebx, eax
test bh, 1
je 0x10b842f2
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edx, dword [esp + 0x124]
mov edi, eax
push edx
push edi
mov ecx, ebp
call fcn.10b84120
mov ebx, eax
test edi, edi
je 0x10b8430c
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10b8430c
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10b8432c
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x10b84203
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0x14
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
test bl, 8
je 0x10b84350
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push eax
push 0
push 0xb1
push edi
call esi
test bl, 0x30
je 0x10b8436f
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x11c]
xor ecx, ecx
cmp edx, eax
sete cl
push ecx
push edi
push eax
jmp 0x10b8437d
mov eax, dword [ebp + 0x54]
mov ecx, dword [esp + 0x118]
push 0
push eax
push ecx
mov edx, dword [esp + 0x120]
mov ecx, ebp
push edx
call fcn.10b84140
test bh, 0x20
je 0x10b843ac
push reloc.oledlg.dll_OleUIAddVerbMenuA
push 0x20
push 0x100
push edi
call esi
push 1
push 0x20
push 0x101
push edi
call esi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 0x14
Function at 0x10b86400
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x10b86433
mov ecx, dword [esi]
push 0
push 0
push 0x1303
push 0x3eb
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x10b86450
mov edx, dword [esi + 0x4c]
dec eax
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + eax*4]
call fcn.10b83f30
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x10b8643a
pop esi
ret

Function at 0x10b868f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov esi, ecx
push edi
push 0x3ee
mov eax, dword [esi]
push eax
call ebx
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10b86917
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 5
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
mov ecx, dword [esi]
push 0
push 0x3ed
push ecx
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x10b89e90
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword [0x10e2bfe0]
push ebx
push ebp
push esi
test eax, eax
push edi
je 0x10b89eb0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
call eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edi, dword [esp + 0x18]
cmp edi, 0xffffffff
jne 0x10b89ed0
mov eax, dword [esp + 0x14]
mov dword [eax + 0x34], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x34]
lea eax, [ecx - 1]
cmp edi, eax
jne 0x10b89eed
mov dword [esi + 0x34], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
test edi, edi
jl 0x10b89fa7
cmp edi, ecx
jge 0x10b89fa7
mov edx, dword [esi + 0x14]
mov dword [esi + 0x34], eax
inc edx
cmp edi, eax
mov dword [esi + 0x14], edx
jge 0x10b89f4c
mov ebp, dword [esi + 0x2c]
lea ebx, [edi + 1]
mov ecx, ebp
push 0xcc0020
imul ecx, ebx
push 0
push ecx
mov ecx, esi
call fcn.10b88ca0
imul edi, ebp
mov edx, dword [esi + 0x30]
push eax
push edx
push ebp
push 0
push edi
mov ecx, esi
call fcn.10b88ca0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x34]
mov edi, ebx
cmp edi, eax
jl 0x10b89f0b
mov edi, dword [esp + 0x18]
test byte [esi + 0x40], 1
je 0x10b89f94
cmp edi, dword [esi + 0x34]
jge 0x10b89f94
mov ebp, dword [esi + 0x2c]
lea ebx, [edi + 1]
mov eax, ebp
push 0xcc0020
imul eax, ebx
push 0
push eax
mov ecx, esi
call fcn.10b88cf0
imul edi, ebp
mov ecx, dword [esi + 0x30]
push eax
push ecx
push ebp
push 0
push edi
mov ecx, esi
call fcn.10b88cf0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x34]
mov edi, ebx
cmp edi, eax
jl 0x10b89f57
mov ecx, esi
call fcn.10b88c70
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x10b91250
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x10b912b1
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10b91274
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x20], 0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10b912b1
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
lea edx, [eax + eax*4]
mov eax, dword [esi + 0x30]
lea eax, [eax + edx*8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
push 0xfffffdf6
push eax
call fcn.10b91150
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0xc
ret
Function at 0x10b94450
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, ecx
call fcn.10b93cc0
mov ecx, ebx
call fcn.10b93d00
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x10b9452b
mov esi, dword [ebx + 0x74]
mov ecx, 0xa
lea edi, [esp + 0x18]
push eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x1c], 1
test ecx, ecx
je 0x10b944cf
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x74]
push 0
push eax
mov ecx, ebx
mov dword [ebx + 0x1c], 0
call fcn.10b92ff0
lea ecx, [esp + 0xc]
push 0xfffffe65
push ecx
mov ecx, ebx
mov dword [esp + 0x30], 0
call fcn.10b93ab0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x34
ret 4
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [eax + 1]
push edi
call sub.libjsybheap.dll_Ordinal_13
mov edx, dword [ebx + 0x1c]
add esp, 4
mov esi, eax
push edi
push esi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebx + 0x74]
push 0
push ecx
mov ecx, ebx
mov dword [ebx + 0x1c], 0
call fcn.10b92ff0
lea edx, [esp + 0xc]
push 0xfffffe65
push edx
mov ecx, ebx
mov dword [esp + 0x30], esi
call fcn.10b93ab0
push esi
call sub.libjsybheap.dll_Ordinal_16
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x34
ret 4
Function at 0x10b95bf0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x2c]
cmp cx, 0x3ea
jne 0x10b95d4e
cmp ax, 0x400
jne 0x10b95d2a
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov eax, dword [esi + 0x74]
test byte [eax + 8], 0x10
je 0x10b95c31
mov eax, dword [esi + 0x10]
jmp 0x10b95c34
mov eax, dword [esi + 0xc]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [esp + 0x10], eax
inc eax
push eax
mov dword [esp + 0x2c], eax
call sub.libjsybheap.dll_Ordinal_13
mov ecx, dword [esp + 0x2c]
add esp, 4
mov ebx, eax
push ecx
push ebx
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push ebx
call sub.libjsybheap.dll_Ordinal_16
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x18]
mov edi, dword [esi + 0x74]
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x88]
add ecx, 0x14
add eax, edx
mov dword [esp + 0x18], ecx
mov ebx, dword [edi + 0x40]
sub eax, ebx
cmp eax, ecx
jge 0x10b95cc0
mov dword [esp + 0x18], eax
mov ecx, dword [edi + 0x40]
mov ebx, dword [esi + 0x64]
sub ecx, edx
mov edx, dword [esp + 0x1c]
mov eax, ebx
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esi + 0x94]
imul edx, ebx
sar eax, 1
sub eax, edx
mov edx, dword [edi + 0x44]
mov ebx, dword [0x10e2cda0]
add eax, edx
mov edx, dword [esp + 0x18]
lea edi, [ecx + edx]
mov edx, dword [esp + 0x1c]
add edx, eax
test ebx, ebx
jne 0x10b95d04
sub eax, 4
add edx, 4
jmp 0x10b95d0a
sub eax, 2
add edx, 2
sub edx, eax
push 0x114
sub edi, ecx
push edx
push edi
push eax
push ecx
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
jmp 0x10b95d4e
cmp ax, 0x200
jne 0x10b95d4e
mov eax, dword [esi]
push 0
push 0
push 0x1116
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov ecx, dword [esi]
push ebp
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x10b9c7e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
push esi
mov ebp, ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, 5
jne 0x10b9c888
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10b9c880
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [esp + 0x10], 0x800
mov ecx, dword [esp + 0x10]
inc ecx
push ecx
call sub.libjsybheap.dll_Ordinal_13
add esp, 4
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov esi, eax
push edx
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
push esi
push 0
push ecx
call ebx
mov edi, eax
cmp edi, 0x7a
je 0x10b9c828
test edi, edi
jne 0x10b9c86a
mov edx, dword [esp + 0x14]
push esi
push edx
mov ecx, ebp
call fcn.10b9c7e0
push esi
call sub.libjsybheap.dll_Ordinal_16
add esp, 4
test edi, edi
je 0x10b9c820
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
pop ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
mov ecx, ebp
call fcn.10b9c500
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8

Function at 0x10b9dce0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [ecx]
test ecx, ecx
je 0x10b9dcfc
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push ecx
call dword [eax + 0x14]
mov ecx, dword [esp + 4]
jmp 0x10b9dd02
xor ecx, ecx
mov dword [esp + 4], ecx
mov al, byte [ecx]
test al, al
je 0x10b9dd23
mov edx, esi
and eax, 0xff
shl edx, 0xd
shr esi, 0x13
or edx, esi
xor edx, eax
mov al, byte [ecx + 1]
inc ecx
mov esi, edx
test al, al
jne 0x10b9dd08
mov eax, esi
pop esi
pop ecx
ret
Function at 0x10ba8160
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x10ba8176
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ebp, dword [esp + 0x1c]
mov ecx, 0x43
xor eax, eax
mov edi, ebx
mov esi, ebp
rep stosd dword es:[edi], eax
and esi, 0x100
mov word [ebx], 0x10c
jne 0x10ba81bb
test ebp, 0x1200
jne 0x10ba81bb
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x14]
lea edi, [ebx + 8]
push eax
push edi
push 0x104
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
jmp 0x10ba81d4
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
lea edi, [ebx + 8]
push edx
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, 0x104
jb 0x10ba81eb
mov word [ebx + 2], 0x6f
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
test eax, eax
jne 0x10ba8203
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov word [ebx + 2], ax
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
test esi, esi
jne 0x10ba82e0
test ebp, 0x4000
jne 0x10ba82e0
test ebp, 0x200
je 0x10ba8242
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10ba82e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov word [ebx + 2], ax
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, ebp
xor esi, esi
and eax, 0xf
sub eax, esi
je 0x10ba8261
dec eax
je 0x10ba825a
dec eax
jne 0x10ba8266
mov esi, 0xc0000000
jmp 0x10ba8266
mov esi, 0x40000000
jmp 0x10ba8266
mov esi, Ordinal_2
mov eax, ebp
xor ecx, ecx
and eax, 0xf0
cmp eax, 0x40
ja case.0x10ba827c.5
xor edx, edx
mov dl, byte [eax + 0x10ba8304]
jmp dword [edx*4 + 0x10ba82ec]
mov ecx, 3
jmp case.0x10ba827c.5
mov ecx, 2
jmp case.0x10ba827c.5
mov ecx, 1
jmp case.0x10ba827c.5
xor ecx, ecx
test ebp, 0x1000
je 0x10ba82af
or esi, 0x40000000
mov eax, 2
jmp 0x10ba82b4
mov eax, 3
push 0
push 0x80
push eax
push 0
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x10ba82e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov word [ebx + 2], ax
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x10bafb20
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x10e2c660]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x10bafb45
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
test eax, eax
mov dword [0x10e2c660], eax
je 0x10bafbe9
mov edi, dword [esp + 0x14]
cmp dword [edi + 4], eax
jne 0x10bafbe9
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call ebx
test ah, 0x80
je 0x10bafb68
mov esi, 8
push 1
call ebx
test ah, 0x80
je 0x10bafb74
or esi, 1
push 4
call ebx
test ah, 0x80
je 0x10bafb80
or esi, 0x10
push 2
call ebx
test ah, 0x80
je 0x10bafb8c
or esi, 2
push 0x10
call ebx
test ah, 0x80
je 0x10bafb98
or esi, 4
xor ebx, ebx
and esi, 0xffff
mov bx, word [edi + 8]
shl ebx, 0x10
or ebx, esi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
jmp 0x10bafbbd
mov edi, dword [esp + 0x14]
test esi, esi
je 0x10bafbdd
mov eax, dword [edi + 0xc]
push eax
push ebx
push 0x20a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov edi, eax
call ebp
test edi, edi
mov esi, eax
je 0x10bafbb9
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4