joyce8/EMBER2024-capa huggingface dataset:
Function at 0x76c210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
je 0x76c227
add esi, esi
lea esi, [esi + esi*4]
mov eax, dword [0x7a6eb0]
mov eax, dword [eax]
add eax, esi
test eax, eax
jl 0x76c2f7
cmp eax, 0xf423f
jge 0x76c2f7
mov eax, dword [0x7a67d8]
cmp byte [eax], 0
je 0x76c2f7
mov eax, ebx
call fcn.00763d68
mov eax, dword [ebx + 0xafc]
mov edx, dword [eax + 0x1b0]
mov eax, dword [ebx + 0xc79]
call fcn.0071b804
mov edx, dword [0x7a6990]
mov edx, dword [edx]
mov eax, dword [0x7a6990]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
call fcn.00638a44
mov byte [ebx + 0xc73], 1
mov edx, dword [0x7a6eb0]
mov edx, dword [edx]
add edx, esi
mov eax, ebx
call fcn.00756898
mov byte [ebx + 0xc73], 0
mov eax, dword [0x7a6eb0]
mov eax, dword [eax]
mov dword [ebx + 0xc3e], eax
mov eax, dword [0x7a6990]
mov eax, dword [eax]
call fcn.00448044
mov edx, dword [0x7a6eb0]
mov edx, dword [edx]
mov dword [eax + 0x11], edx
mov edx, dword [0x7a6990]
mov edx, dword [edx]
mov eax, dword [0x7a6990]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
call fcn.00638a44
mov eax, dword [ebx + 0xafc]
mov edx, dword [eax]
call dword [edx + 0xa8]
mov eax, ebx
call fcn.0074d574
pop esi
pop ebx
ret
Function at 0x76c2fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
je 0x76c31e
add esi, esi
lea esi, [esi + esi*4]
add edi, edi
lea edi, [edi + edi*4]
mov eax, dword [ebx + 0x6f8]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
mov dword [esp], esi
fild dword [esp]
faddp st(1)
fstp xword [esp + 4]
wait
mov eax, dword [ebx + 0x6fc]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
fld xword [esp + 4]
fcompp
wait
fnstsw ax
sahf
jb 0x76c4e8
mov eax, dword [ebx + 0x6f8]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
mov dword [esp + 0x10], esi
fild dword [esp + 0x10]
faddp st(1)
fcomp dword [0x76c4f8]
wait
fnstsw ax
sahf
jae 0x76c4e8
mov eax, dword [ebx + 0x6fc]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
mov dword [esp + 0x14], edi
fild dword [esp + 0x14]
faddp st(1)
fcomp dword [0x76c4fc]
wait
fnstsw ax
sahf
jb 0x76c4e8
mov eax, dword [ebx + 0x6fc]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
mov dword [esp + 0x18], edi
fild dword [esp + 0x18]
faddp st(1)
fstp xword [esp + 0x1c]
wait
mov eax, dword [ebx + 0x6f8]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
fld xword [esp + 0x1c]
fcompp
wait
fnstsw ax
sahf
ja 0x76c4e8
mov eax, dword [ebx + 0xafc]
mov edx, dword [eax + 0x1b0]
mov eax, dword [ebx + 0xc79]
call fcn.0071b804
mov byte [ebx + 0xc73], 1
mov eax, dword [ebx + 0x6f8]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
mov dword [esp], esi
fild dword [esp]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, ebx
call fcn.00756940
mov eax, dword [ebx + 0x6fc]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
mov dword [esp], edi
fild dword [esp]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, ebx
call fcn.00756918
mov byte [ebx + 0xc73], 0
mov eax, dword [ebx + 0x6f8]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
fstp qword [ebx + 0xc56]
wait
mov eax, dword [ebx + 0x6fc]
call fcn.0061f630
fmul dword [0x76c4f0]
fmul dword [0x76c4f4]
fstp qword [ebx + 0xc4e]
wait
mov eax, dword [ebx + 0xafc]
mov edx, dword [eax]
call dword [edx + 0xa8]
mov eax, ebx
call fcn.0074dad0
add esp, 0x28
pop edi
pop esi
pop ebx
ret
Function at 0x76c500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
je 0x76c51f
add esi, esi
lea esi, [esi + esi*4]
add edi, edi
lea edi, [edi + edi*4]
mov eax, dword [ebx + 0x700]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, 0
jne 0x76c554
cmp eax, 0
jb 0x76c6b5
jmp 0x76c55a
jl 0x76c6b5
mov eax, dword [ebx + 0x700]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, 0
jne 0x76c591
cmp eax, 0xf423f
jae 0x76c6b5
jmp 0x76c597
jge 0x76c6b5
mov eax, dword [ebx + 0x704]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
push edx
push eax
mov eax, edi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, 0
jne 0x76c5cc
cmp eax, 0
jb 0x76c6b5
jmp 0x76c5d2
jl 0x76c6b5
mov eax, dword [ebx + 0x704]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
push edx
push eax
mov eax, edi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp edx, 0
jne 0x76c609
cmp eax, 0xf423f
jae 0x76c6b5
jmp 0x76c60f
jge 0x76c6b5
mov eax, dword [ebx + 0xafc]
mov edx, dword [eax + 0x1b0]
mov eax, dword [ebx + 0xc79]
call fcn.0071b804
mov byte [ebx + 0xc73], 1
mov eax, dword [ebx + 0x700]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
mov edx, eax
add edx, esi
mov eax, ebx
call fcn.007568c8
mov eax, dword [ebx + 0x704]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
mov edx, eax
add edx, edi
mov eax, ebx
call fcn.007568f0
mov byte [ebx + 0xc73], 0
mov eax, dword [ebx + 0x700]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
mov dword [ebx + 0xc42], eax
mov eax, dword [ebx + 0x704]
call fcn.0061f630
fmul dword [0x76c6bc]
call fcn.00404d4c
mov dword [ebx + 0xc46], eax
mov eax, ebx
call fcn.0074dbc4
pop edi
pop esi
pop ebx
ret
Function at 0x77aa54
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
push esi
add esp, 0xffffffec
push esp
call sub.user32.dll_GetCursorPos
push 0x258
push 0x258
call sub.user32.dll_SetCursorPos
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetCursorPos
fild dword [esp + 8]
fdivr dword [0x77aadc]
fmul dword [0x77aae0]
call fcn.00404d4c
mov ebx, eax
mov eax, dword [esp]
imul ebx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fdiv dword [0x77aae0]
call fcn.00404d4c
mov dword [esp], eax
mov eax, dword [esp + 4]
imul ebx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fdiv dword [0x77aae0]
call fcn.00404d4c
mov esi, eax
mov dword [esp + 4], esi
push esi
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_SetCursorPos
mov eax, ebx
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x77caa8
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
add esp, 0xfffffff0
mov esi, ecx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, edx
mov edx, esp
call fcn.006431f4
fstp qword [esp + 8]
wait
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
je 0x77cadf
fld qword [esp + 8]
call fcn.00404d4c
imul eax, eax, 0x3e8
jmp 0x77cafb
fld qword [esp + 8]
fdiv dword [0x77cb10]
call fcn.00404d4c
mov edx, eax
shl eax, 4
sub eax, edx
imul eax, eax, 0x3e8
cmp eax, 0x57e40
jl 0x77cb07
sub eax, 0x57e40
add esp, 0x10
pop edi
pop esi
ret

Function at 0x77e010
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov ebx, eax
mov esi, dword [0x7a671c]
mov ecx, esp
mov edx, esi
mov eax, dword [ebx + 0xafc]
call fcn.00493734
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
lea eax, [esp + 8]
push eax
mov edx, esi
xor ecx, ecx
mov eax, ebx
call fcn.007553cc
lea eax, [esp + 8]
mov edx, esp
call fcn.0062094c
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x77e0b9
fild dword [esi]
mov eax, dword [0x7a7064]
fdiv qword [eax]
call fcn.00404d4c
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
mov eax, dword [0x7a7064]
fmul qword [eax]
call fcn.00404d4c
mov dword [esi], eax
fild dword [esi + 4]
mov eax, dword [0x7a7064]
fdiv qword [eax]
call fcn.00404d4c
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
mov eax, dword [0x7a7064]
fmul qword [eax]
call fcn.00404d4c
mov dword [esi + 4], eax
mov eax, dword [esi]
mov edx, dword [0x7a6ae8]
cmp eax, dword [edx]
jne 0x77e0d3
mov eax, dword [esi + 4]
mov edx, dword [0x7a6ae8]
cmp eax, dword [edx + 4]
je 0x77e110
mov eax, ebx
call fcn.00748cb4
mov eax, dword [0x7a6ae8]
mov edx, dword [esi]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov dl, 1
mov eax, ebx
call fcn.00754990
xor edx, edx
mov eax, ebx
call fcn.00754990
mov eax, dword [ebx + 0xafc]
mov edx, dword [eax]
call dword [edx + 0xa0]
mov eax, ebx
call fcn.0076c9e4
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x781aa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, edx
mov esi, eax
mov edx, edi
xor ecx, ecx
mov eax, esi
call fcn.00781cec
mov ebx, eax
test bl, bl
jne 0x781ae9
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x781ae9
mov edx, esp
mov eax, edi
call fcn.0063881c
mov eax, dword [esp]
mov dword [edi], eax
mov eax, dword [esp + 4]
mov dword [edi + 4], eax
mov edx, edi
xor ecx, ecx
mov eax, esi
call fcn.00781cec
mov ebx, eax
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x1005e42
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp byte [0x10133ac], al
push eax
lea eax, [ebp + 8]
mov byte [ebp - 8], 0xef
mov byte [ebp - 7], 0xbb
mov byte [ebp - 6], 0xbf
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], 0xfe
push eax
jne 0x1005e73
push 3
lea eax, [ebp - 8]
jmp 0x1005e78
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1005e93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010074ad
pop ecx
leave
ret 4

Function at 0x10072a5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013238]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
push edi
xor edi, edi
push edi
push 1
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x210], eax
push edi
push 0x1300
call esi
test eax, eax
je 0x10072e6
xor eax, eax
inc eax
jmp 0x1007362
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x10016f0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
je 0x100735f
cmp eax, ebx
jae 0x100735f
push 2
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
je 0x100735f
push ebx
push dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x21c]
push eax
call fcn.010049e8
push edi
push 1
push dword [ebp - 0x210]
push edi
push dword [ebp + 8]
push ebx
push 0xb00
call esi
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x100735a
call fcn.010071a4
xor eax, eax
inc eax
jmp 0x1007361
call fcn.010071a4
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100e9b7
leave
ret 8
Function at 0x1007721
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x1010425
call fcn.0100e9cc
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x1007826
cmp word [eax], bx
je 0x1007826
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1007746
mov edi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x10077ae
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x10077ae
cmp esi, ebx
jle 0x1007826
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x1007826
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1007828
and eax, 0xffff
or eax, 0x80070000
jmp 0x1007828
cmp byte [0x10133ac], bl
jne 0x100782e
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x24]
push eax
push 0xfde9
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.0100f910
cmp eax, ebx
jge 0x10077e5
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.01008960
mov eax, esi
jmp 0x1007828
mov eax, dword [ebp - 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10077eb
push ebx
lea ecx, [ebp - 0x10]
push ecx
sub eax, edx
push eax
push dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100781e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10077d7
and eax, 0xffff
or eax, 0x80070000
jmp 0x10077d7
lea ecx, [ebp - 0x24]
call fcn.01008960
xor eax, eax
call fcn.0100eab8
ret
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + esi]
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100778c
Function at 0x100e869
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1011a10
call fcn.0100eda4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1013720
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100e67e
cmp eax, esi
jne 0x100e671
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100e681
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100e658
xor esi, esi
inc esi
mov eax, dword [0x101371c]
cmp eax, esi
jne 0x100e694
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100e6cf
mov eax, dword [0x101371c]
test eax, eax
jne 0x100e6c9
mov dword [0x101371c], esi
push 0x10011ec
push 0x10011e0
call fcn.0100e5d5
pop ecx
pop ecx
test eax, eax
je 0x100e6cf
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100e799
mov dword [0x10133dc], esi
mov eax, dword [0x101371c]
cmp eax, esi
jne 0x100e6f3
push 0x10011dc
push 0x10011d4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101371c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100e700
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x101372c], ebx
je 0x100e721
push 0x101372c
call fcn.0100ed19
pop ecx
test eax, eax
je 0x100e721
push ebx
push 2
push ebx
call dword [0x101372c]
push dword [0x10133c4]
push dword [0x10133c8]
push dword [0x10133c0]
call fcn.01005d2a
add esp, 0xc
mov dword [0x10133d8], eax
cmp dword [0x10133cc], ebx
jne 0x100e77f
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10133dc], ebx
jne 0x100e78d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10133d8]
call fcn.0100ede9
ret
call fcn.0100eef1
jmp 0x100e636
Function at 0x1005099
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x100e374], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x10050df
call ebx
test eax, eax
jns 0x10050d5
push 0x10015ac
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x10015a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x100e370], eax
mov dword [0x100e374], 1
mov eax, dword [0x100e370]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10050fb
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x100512b
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x1005121
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x1005116
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x100511b
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x100512a
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x1005557
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp dword [0x100e358], esi
jne 0x1005621
push 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x100559b
mov ebx, 0x8007000e
jmp 0x1005621
push edi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push 0x1001640
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
je 0x10055d3
jle 0x10055d1
and eax, edi
or eax, esi
mov ecx, eax
mov ebx, ecx
test ecx, ecx
jl 0x100561e
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1001630
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
je 0x1005609
jle 0x1005607
and eax, edi
or eax, esi
mov ecx, eax
mov ebx, ecx
test ecx, ecx
jl 0x100561e
push dword [ebp - 4]
push 0x100e358
call fcn.01005415
mov ebx, eax
xor esi, esi
pop edi
cmp ebx, esi
jge 0x1005638
push 0x10015fc
push 0x100e358
call fcn.01005415
mov ebx, eax
jmp 0x1005621
cmp dword [ebp - 4], esi
je 0x100564e
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 8], esi
je 0x100565c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1005667
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e34c]
push ebx
xor ebx, ebx
dec eax
mov dword [ebp - 4], ebx
je 0x100568f
dec eax
je 0x1005686
inc ebx
jmp 0x10057a9
mov dword [ebp - 8], 0x1001680
jmp 0x1005696
mov dword [ebp - 8], 0x1001670
push esi
push edi
cmp dword [ebp + 8], ebx
je 0x1005733
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [0x100e314]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
mov edi, 0xffff
mov esi, 0x80070000
cmp eax, ebx
je 0x10056d4
jle 0x10056d2
and eax, edi
or eax, esi
mov ecx, eax
mov ebx, ecx
test ecx, ecx
jl 0x1005798
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 8]
mov dword [ebp + 8], 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
je 0x100570c
jle 0x100570a
and eax, edi
or eax, esi
mov ecx, eax
mov ebx, ecx
test ecx, ecx
jl 0x1005798
cmp dword [ebp + 8], 0x10
jne 0x100572e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
cmp ecx, dword [eax]
jl 0x100572e
mov ecx, dword [eax + 0xc]
cmp ecx, dword [eax + 4]
jge 0x1005798
xor ebx, ebx
inc ebx
jmp 0x1005798
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [0x100e314]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor ecx, ecx
mov edi, 0xffff
mov esi, 0x80070000
cmp eax, ebx
je 0x100576d
jle 0x100576b
and eax, edi
or eax, esi
mov ecx, eax
mov ebx, ecx
test ecx, ecx
jl 0x1005798
push 0x10
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
je 0x1005796
jle 0x1005794
and eax, edi
or eax, esi
mov ecx, eax
mov ebx, ecx
cmp dword [ebp - 4], 0
pop edi
pop esi
je 0x10057a9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x1005ddf
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x800
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x10016c0
mov dword [ebp - 0x18], 0x400
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x1005e2f
mov dword [ebp - 4], 0x8007000e
jmp 0x1005ea2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
push eax
push 0x1005d6e
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x24], ebx
jne 0x1005e51
mov dword [ebp - 4], 1
jmp 0x1005e8c
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 0x44
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
push edi
call esi
push 0x13
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x24]
call esi
pop esi
cmp dword [ebp - 0x1c], ebx
je 0x1005ea2
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 4

Function at 0x10068e8
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x800
push ebx
mov dword [ebp - 0x1c], 0x100183c
mov dword [ebp - 0x18], 0x1001830
mov dword [ebp - 0x14], 0x1001824
mov dword [ebp - 0x10], 0x1001818
mov dword [ebp - 0xc], 0x100180c
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
jne 0x100693c
mov dword [ebp - 8], 0x8007000e
jmp 0x10069b6
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x400
push edi
call fcn.010065dd
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x10069a7
push esi
mov esi, edi
cmp word [edi], bx
je 0x1006977
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
mov word [esi], ax
inc esi
inc esi
pop ecx
cmp word [esi], bx
jne 0x1006962
xor esi, esi
push edi
push dword [ebp + esi*4 - 0x1c]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x100698d
inc dword [ebp - 4]
inc esi
cmp esi, 5
jb 0x1006979
cmp dword [ebp - 4], ebx
pop esi
jle 0x10069a7
push dword [ebp - 4]
push 0x3bc
push ebx
call sub.ntdll.dll_WinSqmIncrementDWORD
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret