joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10207e0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
cmp esi, edi
je 0x10207c5
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x10019a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10207c5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x100198c
push dword [ebp + 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10207bc
test byte [ebp - 4], bl
je 0x10207bc
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01024ca9
test eax, eax
jne 0x10207ea
mov eax, 0x1001968
cmp esi, edi
jne 0x10207dc
mov eax, 0x100194c
push dword [ebp + 0x14]
push esi
push esi
push eax
push dword [ebp + 0xc]
call fcn.010200ce
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.010200ce
cmp esi, edi
je 0x102080f
push 0xd
push ebx
push esi
push 0x100192c
push dword [ebp + 0xc]
call fcn.010200ce
push dword [ebp - 8]
push esi
call fcn.01020468
cmp esi, edi
pop edi
pop esi
pop ebx
jne 0x1020824
call fcn.01020216
leave
ret 0x10

Function at 0x1020914
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
cmp dword [ebp + 8], ebx
je 0x1020871
call fcn.0101fbc2
call fcn.0101f9f6
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x102086b
call fcn.01025006
call fcn.01024ffa
call dword [sym.imp.SHELL32.dll_SHFlushSFCache]
mov eax, 0x1001af4
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x1020929
call fcn.0101f956
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push 2
push 8
lea eax, [ebp - 0x120]
push eax
push 0xb
push 0x1001adc
push 0x1001a88
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0x114
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.01023ea2
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x102091d
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x1020918
jne 0x10208f7
cmp dword [ebp - 0x110], 1
jae 0x1020918
cmp eax, 6
jb 0x1020903
mov edi, 0x1001a5c
jmp 0x102091d
cmp eax, 5
jne 0x102091d
cmp dword [ebp - 0x110], 2
jne 0x102091d
mov edi, 0x1001a34
jmp 0x102091d
mov edi, 0x1001a04
push ebx
push edi
push 0x10019ec
push dword [ebp + 8]
jmp 0x1020931
push ebx
push eax
push 0x10019ec
push ebx
call fcn.01020756
cmp dword [ebp + 8], ebx
pop edi
pop ebx
je 0x1020942
call fcn.0101fb0f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01023ead
leave
ret 4
Function at 0x1020ecd
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x1020ee1
push esi
call fcn.01022a27
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x1020f0c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x1020eff
and eax, 0xfffffff9
jmp 0x1020f02
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1020f47
cmp dword [ebp + 0x10], 0
je 0x1020f27
push dword [ebp + 8]
push 0x1002070
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1020f47
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x1002070
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
pop ebp
ret 0xc

Function at 0x10214c4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 2
push esi
push esi
push esi
push 0x1002370
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10214d7
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x10023c8
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x10228c1
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x1002600
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov byte [eax], 0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [ebx]
xor esi, esi
push esi
push 0x7fff
push 1
push esi
push eax
push ebx
mov dword [ebp - 0x14], eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, esi
jl 0x1022904
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push 1
push ebx
push dword [ebp - 0x14]
call fcn.01022699
mov esi, eax
cmp esi, 0xffffffff
je 0x1022900
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1c]
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x40], ?terminate@@YAXXZ
mov dword [ebp - 0x3c], 0x400
call dword [eax + 0x10]
mov edi, eax
test edi, edi
jl 0x10228ff
mov eax, dword [ebp - 0x18]
mov byte [eax], 1
inc esi
test esi, esi
jge 0x10228af
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 8

Function at 0x1023f6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebp
push edx
push eax
push ecx
push ecx
push 0x1023fa8
push dword fs:[0]
mov eax, dword [0x1028058]
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx]
mov esi, dword [eax + 0xc]
cmp esi, 0xfffffffe
je 0x1023f9a
mov edx, dword [esp + 0x34]
cmp edx, 0xfffffffe
je 0x1023f6c
cmp esi, edx
jbe 0x1023f9a
lea esi, [esi + esi*2]
lea ebx, [ebx + esi*4 + 0x10]
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
cmp dword [ebx + 4], 0
jne 0x1023f4a
push 0x101
mov eax, dword [ebx + 8]
call fcn.010246f1
mov ecx, 1
mov eax, dword [ebx + 8]
call fcn.01024710
jmp 0x1023f4a
pop dword fs:[0]
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x10240c2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebx + 8]
xor esi, dword [eax]
push edi
mov eax, dword [esi]
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 1
lea edi, [ebx + 0x10]
cmp eax, 0xfffffffe
je 0x10240a6
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add ecx, edi
xor ecx, dword [edx + edi]
call dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test byte [eax + 4], 0x66
jne 0x10241d3
lea ecx, [ebp - 0x18]
mov dword [ebx - 4], ecx
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
cmp ebx, 0xfffffffe
je 0x1024138
jmp 0x10240e0
lea edx, [ebx + ebx*2]
mov ecx, dword [esi + edx*4 + 0x14]
lea eax, [esi + edx*4 + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x102410b
mov edx, edi
call fcn.0102400a
mov byte [ebp - 1], 1
test eax, eax
jl 0x1024142
jg 0x102414b
mov eax, dword [ebp - 8]
mov ebx, eax
cmp eax, 0xfffffffe
jne 0x10240e0
cmp byte [ebp - 1], 0
je 0x1024138
mov eax, dword [esi]
cmp eax, 0xfffffffe
je 0x102412a
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add ecx, edi
xor ecx, dword [edx + edi]
call dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xc], 0
jmp 0x1024118
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0xe06d7363
jne 0x102417f
cmp dword [0x102870c], 0
je 0x102417f
push 0x102870c
call fcn.010242e9
add esp, 4
test eax, eax
je 0x102417f
mov ecx, dword [ebp + 0x10]
push 1
push ecx
call dword [0x102870c]
add esp, 8
mov ecx, dword [ebp + 0x14]
call fcn.0102403a
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0xc], ebx
je 0x10241a0
mov edx, dword [ebp + 8]
push edx
push edi
mov edx, ebx
mov ecx, eax
call fcn.01024054
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov eax, dword [esi]
cmp eax, 0xfffffffe
je 0x10241b8
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add ecx, edi
xor ecx, dword [edx + edi]
call dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, edi
call fcn.01024021
mov edx, 0xfffffffe
cmp dword [ebx + 0xc], edx
je 0x1024138
mov ecx, dword [ebp + 8]
push ecx
push edi
mov ecx, ebx
call fcn.01024054
jmp 0x1024118
Function at 0x10241af
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebx + 8]
xor esi, dword [eax]
push edi
mov eax, dword [esi]
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 1
lea edi, [ebx + 0x10]
cmp eax, 0xfffffffe
je 0x10240a6
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add ecx, edi
xor ecx, dword [edx + edi]
call dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test byte [eax + 4], 0x66
jne 0x10241d3
lea ecx, [ebp - 0x18]
mov dword [ebx - 4], ecx
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
cmp ebx, 0xfffffffe
je 0x1024138
jmp 0x10240e0
lea edx, [ebx + ebx*2]
mov ecx, dword [esi + edx*4 + 0x14]
lea eax, [esi + edx*4 + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x102410b
mov edx, edi
call fcn.0102400a
mov byte [ebp - 1], 1
test eax, eax
jl 0x1024142
jg 0x102414b
mov eax, dword [ebp - 8]
mov ebx, eax
cmp eax, 0xfffffffe
jne 0x10240e0
cmp byte [ebp - 1], 0
je 0x1024138
mov eax, dword [esi]
cmp eax, 0xfffffffe
je 0x102412a
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add ecx, edi
xor ecx, dword [edx + edi]
call dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xc], 0
jmp 0x1024118
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0xe06d7363
jne 0x102417f
cmp dword [0x102870c], 0
je 0x102417f
push 0x102870c
call fcn.010242e9
add esp, 4
test eax, eax
je 0x102417f
mov ecx, dword [ebp + 0x10]
push 1
push ecx
call dword [0x102870c]
add esp, 8
mov ecx, dword [ebp + 0x14]
call fcn.0102403a
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0xc], ebx
je 0x10241a0
mov edx, dword [ebp + 8]
push edx
push edi
mov edx, ebx
mov ecx, eax
call fcn.01024054
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov eax, dword [esi]
cmp eax, 0xfffffffe
je 0x10241b8
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call dword [ebp + 0xc]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add ecx, edi
xor ecx, dword [edx + edi]
call dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, edi
call fcn.01024021
mov edx, 0xfffffffe
cmp dword [ebx + 0xc], edx
je 0x1024138
mov ecx, dword [ebp + 8]
push ecx
push edi
mov ecx, ebx
call fcn.01024054
jmp 0x1024118

Function at 0x1024269
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x1024276
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1024272
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
Function at 0x10245da
Capabilities:
Get common file path
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10284c8], eax
mov dword [0x10284c4], ecx
mov dword [0x10284c0], edx
mov dword [0x10284bc], ebx
mov dword [0x10284b8], esi
mov dword [0x10284b4], edi
mov word [0x10284e0], ss
mov word [0x10284d4], cs
mov word [0x10284b0], ds
mov word [0x10284ac], es
mov word [0x10284a8], fs
mov word [0x10284a4], gs
pushfd
pop dword [0x10284d8]
mov eax, dword [ebp]
mov dword [0x10284cc], eax
mov eax, dword [ebp + 4]
mov dword [0x10284d0], eax
lea eax, [ebp + 8]
mov dword [0x10284dc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1028418], 0x10001
mov eax, dword [0x10284d0]
mov dword [0x10283d4], eax
mov dword [0x10283c8], 0xc0000409
mov dword [0x10283cc], 1
mov eax, dword [0x1028058]
mov dword [ebp - 0x328], eax
mov eax, dword [0x102805c]
mov dword [ebp - 0x324], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x1002768
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x102498c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x218]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002840
push 0x80000002
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10249eb
push edi
push 4
pop edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
mov esi, 0x1002800
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10249de
push esi
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x10249de
lea eax, [ebp - 0x20c]
push eax
call fcn.01024850
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x10249de
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov esi, 0x1002818
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10249de
push esi
push dword [ebp - 0x224]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x10249de
lea eax, [ebp - 0x20c]
push eax
call fcn.01024850
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 4
Function at 0x10249f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x218]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002840
push 0x80000002
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10249eb
push edi
push 4
pop edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
mov esi, 0x1002800
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10249de
push esi
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x10249de
lea eax, [ebp - 0x20c]
push eax
call fcn.01024850
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x10249de
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov esi, 0x1002818
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10249de
push esi
push dword [ebp - 0x224]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x10249de
lea eax, [ebp - 0x20c]
push eax
call fcn.01024850
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 4

Function at 0x1024d12
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1028374], 2
jne 0x1024d5f
and dword [0x1028374], 0
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x310], 2
jne 0x1024d5f
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x1002914
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024d75
cmp dword [ebp - 0x31c], 5
pop esi
jae 0x1024d55
call fcn.01024a06
test eax, eax
jne 0x1024d55
push 0x7550005
push 0x50083
lea eax, [ebp - 0x20c]
push eax
call fcn.01024816
test eax, eax
je 0x1024d5f
lea eax, [ebp - 0x20c]
push eax
call fcn.01024bad
test eax, eax
jne 0x1024d5f
mov dword [0x1028374], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1028374]
xor ecx, ebp
call fcn.01023ead
leave
ret
Function at 0x42b404
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x438e80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042b399
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004164a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42b453
cmp dword [ebp - 0x1c], 5
jb 0x42b46b
jmp 0x42b467
cmp dword [ebp - 0x10], 1
jne 0x42b46b
cmp dword [ebp - 0x1c], 4
ja 0x42b467
jne 0x42b46b
cmp dword [ebp - 0x18], 0
jbe 0x42b46b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x432844
call fcn.0042b26d
test eax, eax
jge 0x42b48c
mov byte [0x43a368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416243
add ebp, 0x78
leave
ret
Function at 0x401c0b
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00404340
mov dword [esp], eax
mov eax, dword [0x40c6a0]
push eax
push eax
call fcn.00407093
lea eax, [esp + 8]
push eax
call fcn.00408a10
push dword [esp]
push 0
push 0x40b00d
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, dword [0x40c6a0]
push eax
push eax
push dword [esp + 8]
call fcn.004043d0
push 0x40c388
call fcn.00408a10
push dword [esp]
call fcn.004043b0
push dword [0x40c388]
call fcn.00407081
push dword [0x40c388]
call fcn.004070f4
mov eax, dword [0x40c6a0]
push eax
push eax
call fcn.00406fb6
push 0x40c380
call fcn.00408a10
mov eax, dword [esp + 0x14]
call fcn.00404420
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401d11
mov ebx, dword [esp + 0x18]
inc ebx
mov eax, ebx
call fcn.00404420
mov ebx, eax
cmp ebx, 1
jne 0x401cec
push dword [0x40c380]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x40c6a0]
mov edx, str.__
call fcn.00408ac0
mov edx, dword [0x40c380]
call fcn.00408ac0
push 0x40c384
call fcn.00408a10
mov edx, dword [0x40c388]
push dword [0x40c6a0]
call fcn.00408ac0
push 0x40c380
call fcn.00408a10
mov dword [esp + 0xc], 2
jmp 0x401d23
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401d23
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00404420
mov dword [0x40c378], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00404420
mov dword [0x40c37c], eax
mov eax, 1
jmp 0x401d56
push dword [esp + 4]
call fcn.00408b20
add esp, 0xc
pop ebx
ret 4
Function at 0x40643c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.DLL_GetPropA]
mov dword [ebp - 4], eax
je 0x4064c7
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 9
call esi
test al, al
jns 0x4064b9
push 0x11
call esi
test al, al
js 0x4064b9
push 0x10
call esi
test al, al
js 0x4064b9
push 0x12
call esi
test al, al
js 0x4064b9
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4064b9
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
je 0x4064e7
push str.PB_Hotkey
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4064e7
push str.PB_WindowID
push dword [ebp + 8]
call edi
test eax, eax
je 0x4064e7
dec eax
push eax
push dword [0x40c71c]
call fcn.004075e1
mov eax, dword [eax + 8]
jmp 0x4064e9
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x40677c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x40c674], eax
je 0x4067af
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40c678], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x40c670], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4067ed
cmp dword [ebp - 0xc], 1
je 0x4067fe
cmp dword [ebp - 0xc], 2
jne 0x4067ed
cmp dword [ebp - 0x18], 5
jb 0x4067fe
jne 0x4067ed
cmp dword [ebp - 0x14], edi
jne 0x4067ed
mov dword [0x40c670], edi
cmp dword [0x40c670], edi
je 0x406804
call fcn.004066c3
test eax, eax
jne 0x406804
mov dword [0x40c670], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x4070f4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x407167
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x407149
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x407147
cmp dl, 0x5c
je 0x407147
cmp dl, 0x2f
jne 0x407153
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x407133
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x407169
xor eax, eax
leave
ret 4

Function at 0x407170
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4071a5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4