joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d16bc
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x10239088]
mov ecx, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov ebx, 0x3e8
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x101d16e2
or eax, 0xffffffff
jmp 0x101d1786
push edi
xor edi, edi
push edi
lea eax, [esp + 0x1c]
push eax
push 0x3e7
push esi
jmp 0x101d172c
cmp dword [esp + 0x18], 0
je 0x101d174d
add edi, dword [esp + 0x18]
lea eax, [ebx - 1]
cmp edi, eax
jne 0x101d171b
mov ecx, dword [0x10239088]
mov eax, dword [ecx]
add ebx, ebx
push ebx
push esi
push ecx
call dword [eax + 0x10]
test eax, eax
je 0x101d173c
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, ebx
sub eax, edi
dec eax
push eax
lea eax, [edi + esi]
push eax
push dword [esp + 0x24]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x101d1751
jmp 0x101d16f3
mov eax, dword [0x10239088]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
or eax, 0xffffffff
jmp 0x101d1785
test eax, eax
jne 0x101d177c
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
call ebx
cmp eax, 0x6d
je 0x101d177c
mov eax, dword [0x10239088]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
call ebx
test eax, eax
jle 0x101d1785
and eax, 0xffff
or eax, 0x80070000
jmp 0x101d1785
mov byte [edi + esi], 0
mov dword [ebp], esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x101dd9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ebp, [ebx + 0x24]
push ebp
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, ebp
lea edi, [esp + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x101ddab8
mov esi, ebp
lea edi, [esp + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x68], 8
sub dword [esp + 0x70], 8
sub dword [esp + 0x74], 5
dec eax
add eax, dword [0x10244c68]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x1205
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x38]
or eax, 0x40
push eax
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ebp, dword [esp + 0x70]
sub ebp, dword [esp + 0x68]
xor eax, eax
inc eax
xor edi, edi
mov dword [esp + 0x3c], eax
mov dword [ebx + 0x20], eax
mov dword [esp + 0x10], ebp
xor esi, esi
cmp esi, 2
jne 0x101dda7e
mov eax, ebp
sub eax, edi
dec eax
jmp 0x101dda95
fld dword [ebx + esi*4 + 0x3c]
fild dword [esp + 0x10]
fstp dword [esp + 0x14]
fmul dword [esp + 0x14]
call fcn.1001d0b0
add edi, eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push eax
push esi
push 0x1204
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
inc esi
cmp esi, 3
jb 0x101dda72
xor esi, esi
mov dword [ebx + 0x20], esi
cmp dword [ebx + 0x14], 0
mov ebp, dword [sym.imp.USER32.dll_MoveWindow]
je 0x101ddaff
mov ecx, dword [esp + 0x6c]
cmp dword [ebx + 8], esi
je 0x101ddad7
add ecx, dword [0x10244c6c]
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x74]
push 1
sub eax, ecx
push eax
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push eax
push ecx
push dword [esp + 0x78]
push dword [ebx + 0x14]
call ebp
push 1
push esi
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebx + 0x18], esi
je 0x101ddb56
lea esi, [ebx + 0x24]
lea edi, [esp + 0x78]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xfffffffffffffffe
movsd dword es:[edi], dword [esi]
push 0xfffffffffffffffb
lea eax, [esp + 0x80]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
inc eax
push eax
mov eax, dword [esp + 0x88]
sub eax, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x88]
sub eax, dword [esp + 0x80]
push eax
push dword [esp + 0x88]
push dword [esp + 0x88]
push dword [ebx + 0x18]
call ebp
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x7c
ret
Function at 0x101df4a7
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x58]
test edi, edi
sete al
mov esi, ecx
mov ecx, dword [esp + 0x54]
mov ebp, dword [esi + ecx*4 + 0x14]
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x34], eax
je 0x101df694
inc dword [esi + 0x164]
push ebx
xor ebx, ebx
mov dword [esp + 0x14], 1
test ecx, ecx
jne 0x101df5e0
test edi, edi
je 0x101df50e
cmp dword [esi + 0x1a8], ebx
je 0x101df50e
push 3
mov ecx, esi
call fcn.1015692e
mov dword [esi + 0x1a8], ebx
mov eax, dword [esi + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
push eax
push dword [esi + 0xa4]
mov dword [esi + 0xa0], edi
mov eax, dword [0x102390a8]
mov dword [esp + 0x20], ebx
call dword [eax + 0x40]
test edi, edi
je 0x101df541
mov eax, dword [esi + 0x10c]
add eax, 6
jmp 0x101df555
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0x30]
sub ecx, dword [eax + 0x28]
push 0xfffffffffffffffa
pop eax
mov dword [esi + 0x10c], ecx
sub eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xa4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x102390a8]
push 0x15
mov dword [esp + 0x2c], ebx
call dword [eax + 0x5c]
test edi, edi
je 0x101df5b7
lea eax, [esp + 0x40]
push eax
push dword [esi + 0xa4]
mov eax, dword [0x102390a8]
call dword [eax + 0x40]
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
sub eax, dword [esp + 0x44]
add eax, dword [esp + 0x4c]
cmp eax, ebx
jge 0x101df5bb
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 0x30]
sub eax, dword [ecx + 0x28]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x101df5bb
mov ebx, dword [esp + 0x10]
push dword [esi + 0xa0]
mov ecx, dword [esi + 0x24]
call fcn.10220126
mov ecx, dword [esi + 0x24]
add ecx, 4
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 0x118], 1
jmp 0x101df5f4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
push 0xfffffffffffffff0
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0x10000000
mov dword [esp + 0x2c], eax
je 0x101df61f
push 0
push 0
push 0xb
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
je 0x101df63f
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push dword [esp + 0x20]
call fcn.1021ed05
push 5
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x101df657
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
call fcn.1021e9d0
cmp dword [esp + 0x2c], 0
pop ebx
je 0x101df681
push 0
push 1
push 0xb
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x34], eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.101deaa1
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10001e57
add esp, 0x44
ret 8
Function at 0x101e43eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax + 0x14]
call fcn.1001c9e1
mov ebp, eax
test ebp, ebp
js 0x101e456a
mov ebx, dword [esp + 0x1c]
and dword [edi + 0x74], 0
movzx ecx, word [ebx + 0x28]
mov eax, dword [ebx + 0x78]
push 0
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x60]
push ecx
lea ecx, [edi + 0x60]
mov dword [esp + 0x20], ebx
call dword [eax]
mov ebp, eax
test ebp, ebp
js 0x101e456a
mov esi, dword [ebx + 0x3c]
and dword [esp + 0x14], 0
jmp 0x101e4553
cmp esi, dword [ebx + 0xc]
jbe 0x101e4450
xor ebx, ebx
jmp 0x101e4455
mov ebx, dword [ebx + 8]
add ebx, esi
mov ecx, ebx
call fcn.100dd101
mov cl, byte [ebx + 1]
and cl, 7
mov edx, eax
mov dword [esp + 0x20], edx
cmp cl, 1
je 0x101e4479
cmp word [ebx + 0x30], 0xffff
je 0x101e4479
xor eax, eax
inc eax
jmp 0x101e44b5
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x101e44b3
lea eax, [esp + 0x10]
push eax
push 1
push edx
call fcn.100c6d98
mov ebp, eax
test ebp, ebp
js 0x101e456a
mov ebx, dword [esp + 0x18]
cmp esi, dword [ebx + 0xc]
jbe 0x101e44a4
xor ebx, ebx
jmp 0x101e44a9
mov ebx, dword [ebx + 8]
add ebx, esi
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
jmp 0x101e44b9
xor eax, eax
mov dword [esp + 0x10], eax
test eax, eax
jne 0x101e4548
mov ecx, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x24]
push eax
push edx
call fcn.1001b5c5
mov ebp, eax
test ebp, ebp
js 0x101e456a
cmp dword [esp + 0x30], 0
je 0x101e450e
mov ecx, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
lea eax, [eax + ecx*4]
push eax
mov ecx, ebx
call fcn.100488ba
push eax
mov ecx, ebx
call fcn.1007b724
push eax
push dword [edi + 0x20]
call fcn.1015692e
mov ebp, eax
test ebp, ebp
js 0x101e456a
mov ecx, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
lea ecx, [eax + ecx*4]
call fcn.1001b5e9
mov ebp, eax
test ebp, ebp
js 0x101e456a
mov esi, dword [edi + 0x74]
push dword [esp + 0x14]
lea eax, [esi + 1]
mov ecx, ebx
mov dword [edi + 0x74], eax
call fcn.1007b724
push eax
push 0
push 1
push 1
call fcn.1015692e
mov ecx, dword [edi + 0x70]
mov dword [ecx + esi*4], eax
mov esi, dword [ebx + 4]
inc dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp esi, 0xffffffff
jne 0x101e4447
lea ecx, [edi + 0x60]
mov eax, dword [ecx]
push 0
call dword [eax + 0x18]
test ebp, ebp
jns 0x101e4576
and dword [edi + 0x74], 0
lea ecx, [edi + 0x60]
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x101e4974
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ecx
push ecx
and dword [esp + 4], 0
and dword [esp], 0
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ebx + 0x3c], 0xffffffff
push esi
sete al
push edi
sub ecx, eax
cmp ecx, 0xffffffff
jne 0x101e49a9
push dword [ebx + 0x20]
call fcn.1015692e
mov edi, eax
jmp 0x101e4ae3
mov eax, dword [ebx + 0x70]
mov esi, ecx
push ebp
mov ebp, dword [eax + esi*4]
call fcn.100f0cb7
mov ecx, eax
call fcn.1006c141
test ebp, 0x8000000
je 0x101e4a9f
cmp dword [ebx + 0x3c], 0xffffffff
je 0x101e4a4a
mov ecx, dword [ebx + 0x78]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x3c]
call fcn.101c77cf
mov edi, eax
test edi, edi
js 0x101e4ae2
cmp dword [esp + 0x10], 0
mov eax, dword [ebx + 0x6c]
je 0x101e4a2f
lea ecx, [esp + 0x14]
push ecx
push dword [eax + esi*4]
push dword [esp + 0x18]
call fcn.101cdfe2
mov edi, eax
test edi, edi
js 0x101e4ae2
push ebp
call fcn.101e5054
push eax
push dword [esp + 0x18]
push dword [ebx + 0x20]
call sym.VBE7.dll_VarPtr
push eax
call fcn.1015692e
mov edi, eax
jmp 0x101e4ad7
push dword [eax + esi*4]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x101e4a0f
mov edi, 0x8007000e
jmp 0x101e4ae2
mov eax, dword [ebx + 0x20]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax + 0x14]
and ebp, 0x7ffffff
call fcn.1001c9e1
mov edi, eax
test edi, edi
js 0x101e4ae2
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x3c]
xor esi, esi
jmp 0x101e4a87
cmp eax, dword [edx + 0xc]
jbe 0x101e4a7a
xor ecx, ecx
jmp 0x101e4a7f
mov ecx, dword [edx + 8]
add ecx, eax
cmp esi, ebp
je 0x101e4a8c
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xffffffff
jne 0x101e4a71
push eax
push dword [ebx + 0x20]
call sym.VBE7.dll_VarPtr
push eax
call fcn.1015692e
mov edi, eax
jmp 0x101e4ae2
mov ecx, dword [ebx + 0x78]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x3c]
call fcn.101c77cf
mov edi, eax
test edi, edi
js 0x101e4ae2
mov eax, dword [ebx + 0x6c]
push 1
push 0
push 0
push 1
push dword [eax + esi*4]
push dword [esp + 0x24]
push dword [ebx + 0x20]
call sym.VBE7.dll_VarPtr
push eax
call fcn.101cd2e3
mov edi, eax
or eax, 0x800a0000
neg edi
sbb edi, edi
and edi, eax
pop ebp
push dword [esp + 0x10]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [esp + 0xc]
call esi
test edi, edi
jns 0x101e4b0c
mov ecx, ebx
call fcn.100c214f
push edi
call fcn.1000b028
push eax
call fcn.101a7afd
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x101e4d9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov edi, ecx
mov esi, ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
sub eax, ebp
je 0x101e4ecf
dec eax
jne 0x101e4f11
or ebx, 0xffffffff
push 1
cmp dword [edi + 0x3c], ebx
jne 0x101e4e6a
call fcn.101e468d
lea ecx, [eax - 1]
cmp ecx, ebx
je 0x101e4f0a
mov eax, dword [edi + 0x70]
mov eax, dword [eax + ecx*4]
lea edx, [esp + 0x10]
push edx
push ebp
push ebp
and eax, 0x7ffffff
push ebp
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x30]
mov esi, eax
test esi, esi
js 0x101e4f3f
cmp dword [esp + 0x10], ebp
je 0x101e4f11
mov eax, dword [edi + 0x20]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [eax + 0x14]
call fcn.1001c9e1
mov esi, eax
test esi, esi
js 0x101e4f3f
mov ebp, dword [esp + 0x18]
mov ecx, dword [ebp + 0x3c]
xor edx, edx
jmp 0x101e4e54
cmp ecx, dword [ebp + 0xc]
jbe 0x101e4e45
xor eax, eax
jmp 0x101e4e4a
mov eax, dword [ebp + 8]
add eax, ecx
cmp edx, dword [esp + 0x1c]
je 0x101e4e5e
mov ecx, dword [eax + 4]
inc edx
cmp ecx, ebx
je 0x101e4f0a
jmp 0x101e4e3c
mov eax, dword [eax + 0xc]
mov dword [esp + 0x24], eax
jmp 0x101e4f0a
call fcn.101e468d
mov ecx, dword [edi + 0x70]
mov ebx, dword [ecx + eax*4]
mov ecx, dword [edi + 0x78]
lea eax, [esp + 0x14]
push eax
push dword [edi + 0x3c]
call fcn.10060005
mov esi, eax
test esi, esi
js 0x101e4f3f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
and ebx, 0x7ffffff
push ebx
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
js 0x101e4f3f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov esi, dword [edx]
push edx
push eax
call dword [ecx + 0x50]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push esi
jmp 0x101e4efa
or ebx, 0xffffffff
cmp dword [edi + 0x3c], ebx
je 0x101e4f11
mov ecx, dword [edi + 0x78]
lea eax, [esp + 0x14]
push eax
push dword [edi + 0x3c]
call fcn.10060005
mov esi, eax
test esi, esi
js 0x101e4f3f
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov esi, eax
test esi, esi
js 0x101e4f3f
cmp dword [esp + 0x10], 0
jne 0x101e4f28
mov eax, dword [0x102390a8]
call dword [eax + 0x90]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], 0x1ec316
mov ecx, edi
call fcn.100c214f
push dword [esp + 0x24]
mov eax, dword [0x102390a8]
push dword [esp + 0x14]
call dword [eax + 0x74]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x101e4f4d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call fcn.1000b028
push eax
call fcn.101a7afd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x101ee937
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xb
push dword [esi + 0xc]
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_CallWindowProcA]
pop esi
ret
Function at 0x101fb46c
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
jne 0x101fb479
xor eax, eax
jmp 0x101fb4c1
mov edx, dword [esp + 4]
cmp eax, dword [edx + 4]
jbe 0x101fb486
xor edx, edx
jmp 0x101fb48a
mov edx, dword [edx]
add edx, eax
mov edx, dword [edx + 0x1c]
push esi
jmp 0x101fb4ba
movzx ecx, byte [edx + 0x14]
inc ecx
imul ecx, ecx, 0xc
add ecx, edx
lea esi, [edx + 0x18]
jmp 0x101fb4b3
movzx eax, word [ecx + 6]
cmp eax, dword [esp + 0x10]
jne 0x101fb4b0
cmp word [ecx + 8], 2
ja 0x101fb4c4
sub ecx, 0xc
cmp ecx, esi
jae 0x101fb49f
mov edx, dword [edx + 4]
test edx, edx
jne 0x101fb490
xor eax, eax
pop esi
ret 0xc
xor eax, eax
inc eax
jmp 0x101fb4c0

Function at 0x101fc28b
Capabilities:
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [0x1023a234], 0
push ebx
mov ebx, dword [esp + 0x134]
push ebp
mov ebp, dword [esp + 0x124]
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x13c]
je 0x101fc405
and dword [esp + 0x10], 0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x10]
jne 0x101fc2d6
sub ecx, edx
push 1
sar ecx, 1
lea eax, [ecx + 1]
xor edx, edx
push edx
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x24], eax
add eax, eax
push eax
push edx
push 0x78
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], eax
call fcn.1015692e
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
test eax, eax
je 0x101fc3b4
xor ecx, ecx
push ecx
push ecx
push dword [esp + 0x18]
push eax
push dword [esp + 0x28]
push esi
push ecx
push ecx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, dword [esp + 0x138]
test esi, esi
je 0x101fc3ff
cmp esi, 2
jbe 0x101fc34e
cmp esi, 7
jne 0x101fc3ff
test ebx, ebx
jne 0x101fc36d
xor eax, eax
push eax
push edi
push esi
push dword [esp + 0x140]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x101fc3b7
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov eax, ebx
shr eax, 1
push eax
push edi
push ecx
push ecx
mov dword [esp + 0x38], eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push 1
xor ecx, ecx
push ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0xb4]
push eax
push ebx
push ecx
push 0x78
lea ecx, [esp + 0x34]
call fcn.1015692e
mov ebx, dword [esp + 0x20]
test ebx, ebx
jne 0x101fc3c4
lea ecx, [esp + 0x1c]
call fcn.1000cead
push 0xe
pop esi
lea ecx, [esp + 0x28]
call fcn.1000cead
mov eax, esi
jmp 0x101fc41d
xor eax, eax
push eax
push eax
push dword [esp + 0x18]
push ebx
push dword [esp + 0x28]
push edi
push eax
push eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push dword [esp + 0x10]
push ebx
push esi
push dword [esp + 0x140]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.1000cead
jmp 0x101fc3b7
push ebx
jmp 0x101fc355
push ebx
push edi
push dword [esp + 0x140]
push dword [esp + 0x140]
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x118
ret 0x18
Function at 0x101fc81c
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x84], eax
cmp dword [0x1023a234], 0
push esi
mov esi, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0x94]
je 0x101fc8b8
push ebx
mov ecx, esi
push ebp
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x101fc852
push 1
sub ecx, edx
push ebx
sar ecx, 1
lea eax, [esp + 0x24]
push eax
lea ebp, [ecx*2 + 2]
push ebp
push ebx
push 0x78
lea ecx, [esp + 0x28]
call fcn.1015692e
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x101fc89a
xor eax, eax
push eax
push eax
push ebp
push ebx
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
jne 0x101fc89f
push 0xe
pop esi
jmp 0x101fc8a9
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.1000cead
pop ebp
mov eax, esi
pop ebx
jmp 0x101fc8c0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor ecx, esp
call fcn.10001e57
add esp, 0x88
ret 8
Function at 0x1021c9bd
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x50]
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
push edi
mov esi, ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
and dword [esp + 0x10], 0
push ebp
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_SetCapture]
and dword [esi + 8], 0
mov eax, dword [esp + 0x5c]
mov edi, dword [0x1023f5d4]
mov edx, eax
sub edx, edi
jns 0x1021ca11
xor edx, edx
mov ebx, dword [esp + 0x58]
mov ecx, ebx
sub ecx, edi
jns 0x1021ca1d
xor ecx, ecx
add eax, edi
push eax
lea eax, [ebx + edi]
push eax
push edx
push ecx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
cmp dword [esi + 8], 0
jne 0x1021cae4
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, ebp
jne 0x1021cae4
push 0
push 0x20d
push 0x200
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
jne 0x1021ca83
push eax
push 0x108
push 0x100
push eax
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
je 0x1021cac3
cmp dword [esp + 0x24], 0x202
je 0x1021cae4
cmp dword [esp + 0x24], 0x204
je 0x1021cae4
cmp dword [esp + 0x24], 0x100
jne 0x1021caa8
cmp dword [esp + 0x28], 0x1b
je 0x1021cae4
push dword [esp + 0x38]
lea eax, [esp + 0x40]
push dword [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, ebx
cmp eax, dword [0x1023f5d8]
jbe 0x1021cada
mov dword [esi + 8], 1
cmp dword [esi + 8], 0
je 0x1021ca45
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp dword [esi + 8], 0
je 0x1021cb1b
cmp dword [0x10243f64], 0
je 0x1021cb00
push 1
call fcn.101ce2b5
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x68]
push esi
push dword [esp + 0x20]
call dword [sym.imp.ole32.dll_DoDragDrop]
and dword [0x10243f64], 0
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 8]
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x40
ret 0x18