joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103347b
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x28c], ebx
call fcn.010327a6
push dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.010327e8
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x10334c6
push ebx
push dword [esi + 0x2dc]
push 0x419
push dword [esi + 0x14]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x10334fe
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x445
push dword [esi + 0x14]
mov dword [ebp - 0x10], ecx
call edi
cmp dword [ebp - 8], ebx
mov dword [ebp - 4], eax
je 0x10334fe
push eax
push dword [esi + 0x14]
call fcn.01038ae9
mov dword [esi + 0x2dc], eax
push dword [ebp - 4]
lea ecx, [esi + 0x23c]
call fcn.01009407
mov edi, eax
cmp edi, ebx
je 0x10335bf
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10335ad
cmp dword [ebp - 8], ebx
je 0x10335a0
push dword [edi]
call fcn.01038759
mov eax, dword [esi + 0x2bc]
cmp eax, ebx
je 0x1033581
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x1033581
mov ecx, dword [eax + 4]
cmp ecx, dword [edi + 4]
jne 0x1033581
cmp dword [ebp + 8], 0x204
je 0x1033564
cmp dword [ebp + 8], 0x206
je 0x1033564
mov dword [esi + 0x314], ebx
jmp 0x103356e
mov dword [esi + 0x314], 1
push 0x405
push ebx
push ebx
push dword [eax + 4]
mov ecx, esi
push dword [eax]
call fcn.0101abf0
push 3
push edi
push dword [ebp - 4]
mov ecx, esi
call fcn.0100b371
push ebx
mov ecx, esi
mov dword [esi + 0x2c8], 1
call fcn.0101ad48
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.0101ad8a
jmp 0x10335ba
push 1
push ebx
push dword [ebp - 4]
mov ecx, esi
call fcn.0101c5c4
xor eax, eax
inc eax
jmp 0x10335c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10338ff
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x5de
push esi
mov esi, ecx
jne 0x1033924
cmp dword [ebp + 0xc], 6
je 0x10339f0
call fcn.010335cd
jmp 0x10339f0
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x10339ef
push ebx
push dword [esi + 0x14]
lea ecx, [esi + 0x23c]
push edi
push dword [ebp + 8]
call fcn.01009422
mov ebx, eax
cmp ebx, edi
je 0x10339ee
cmp dword [esi + 0x26c], edi
je 0x103396f
push edi
push dword [ebp + 8]
push 0x419
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, esi
call fcn.0103265a
push dword [ebx]
call fcn.01038759
cmp dword [ebx + 0x10], 3
jb 0x10339ac
xor eax, eax
cmp dword [esi + 0x26c], edi
mov ecx, esi
setne al
add eax, 0x400
push eax
push ebx
call fcn.0101ad8a
cmp dword [esi + 0x26c], edi
je 0x10339ee
cmp dword [esi + 0x270], edi
je 0x10339ee
push 0x401
jmp 0x10339e6
cmp dword [esi + 0x26c], edi
je 0x10339ee
push 0x201
push ebx
mov ecx, esi
call fcn.0101ad8a
mov edi, 0x202
push edi
push ebx
mov ecx, esi
call fcn.0101ad8a
cmp dword [esi + 0x270], 0
je 0x10339ee
push 0x203
push ebx
mov ecx, esi
call fcn.0101ad8a
push edi
mov ecx, esi
push ebx
call fcn.0101ad8a
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x10342fe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1046080]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edx, [ebp - 0x210]
push edx
mov edx, dword [ebp + 0x14]
or edx, 0x20019
push edx
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10343bf
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10343b3
cmp word [ebp - 0x20c], bx
je 0x10343b3
push ebx
push ebx
push 0x146
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
mov edi, eax
jmp 0x10343b0
push ebx
push edi
push 0x150
push dword [ebp - 0x214]
call esi
cmp eax, ebx
je 0x10343b0
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x10343d0
dec edi
jns 0x103438b
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001b2f
leave
ret 0x10
push ebx
push edi
push 0x14e
push dword [ebp - 0x214]
call esi
xor eax, eax
inc eax
jmp 0x10343c1

Function at 0x10343e9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1046080]
push esi
mov dword [ebp - 0x420], ecx
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp + 0x10]
or ecx, 0x20019
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor esi, esi
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034514
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1034507
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
inc dword [ebp - 0x41c]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call fcn.0103a947
test eax, eax
jl 0x10344e4
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
push 0x158
push dword [ebp - 0x420]
call esi
cmp eax, 0xffffffff
jne 0x10344e4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov ebx, eax
test ebx, ebx
je 0x10344e4
lea eax, [ebp - 0x414]
push eax
push 0
push 0x143
push dword [ebp - 0x420]
call esi
test eax, eax
push ebx
jl 0x10344de
push eax
push 0x151
push dword [ebp - 0x420]
call esi
jmp 0x10344e4
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1034461
pop ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.01001b2f
leave
ret 0xc
Function at 0x103467c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1046080]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xb
xor esi, esi
push esi
push 0x1034790
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034781
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1034731
jmp 0x1034739
dec dword [ebp - 0x210]
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x104
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1034739
cmp dword [ebp - 0x21c], 8
jbe 0x1034731
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x210], esi
jge 0x10346d7
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 2
push 8
lea eax, [ebp - 0x224]
push eax
push 3
push 0x10102f0
push 0x1011088
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0xffffffffffffffff
push 1
push 3
push 0x28
push 0x1008060
call fcn.01028367
mov ecx, dword [ebp - 4]
pop esi
call fcn.01001b2f
leave
ret

Function at 0x10349b9
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x463
cmp dword [esi + 8], eax
mov ebx, ecx
je 0x10349e6
push 0x10268d8
push 0xc
push 0
push dword [esi + 0xc]
call dword [sym.imp.SHELL32.dll_Ordinal_127]
jmp 0x1034a45
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x70
mov edi, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1034a0b
push 0
push 9
push 0x110a
jmp 0x1034a2d
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
pop edi
je 0x1034a45
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
push 0xc
push eax
push ecx
call dword [edx + 0x18]
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8
Function at 0x1034daf
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x1046080]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x428]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x1034e9e
and dword [ebp - 0x464], edi
push 0xe
pop ecx
xor eax, eax
push esi
lea edi, [ebp - 0x460]
rep stosd dword es:[edi], eax
push 0x1034ecc
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x464], 0x3c
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
push 0x10e
lea eax, [ebp - 0x220]
je 0x1034e50
push 0x1034ec4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x21a]
jmp 0x1034e62
push 0x1034eb0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x20e]
push 0
push 0xb
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x450], eax
mov eax, dword [0x104662c]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x464]
push eax
mov dword [ebp - 0x448], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01001b2f
leave
ret 4

Function at 0x1034eed
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 8]
push eax
push 8
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1034f70
push edi
push dword [ebp - 8]
call fcn.010385f3
mov esi, dword [sym.imp.SHELL32.dll_ILFree]
mov edi, eax
test edi, edi
je 0x1034f66
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push 0x60
push dword [ebp + 8]
push edi
call dword [eax + 0x10]
test eax, eax
jne 0x1034f60
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1034f57
cmp dword [ebp - 0xc], 1
jne 0x1034f57
push dword [ebp - 0x10]
call esi
inc ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
push dword [ebp - 8]
call esi
test ebx, ebx
pop edi
jne 0x1034fa6
xor esi, esi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push dword [esi + 0x10475ec]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034f9e
push dword [ebp - 0x10]
xor ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 4
cmp esi, 0x14
jb 0x1034f72
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
pop ebx
leave
ret 8
Function at 0x1034fc5
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHAddToRecentDocs]
xor edi, edi
lea esi, [edi + 0x10475ec]
push dword [esi]
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp + 8], 0
je 0x1034ffd
push dword [esi]
push 0
push 0x1a
call dword [sym.imp.SHLWAPI.dll_SHSendMessageBroadcastW]
add edi, 4
cmp edi, 0x14
jb 0x1034fd8
pop edi
pop esi
pop ebp
ret 4

Function at 0x1035138
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1046080]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 2
push 0x1035294
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x100e040
push eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x220], edi
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x1035215
lea eax, [ebp - 0x210]
push eax
push 0x10352a0
push 1
push esi
push 0x10352b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x103520f
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x21c]
push edx
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x1035203
push dword [ebp - 0x21c]
call fcn.01035070
push esi
xor eax, eax
push esi
mov dword [ebp - 0x228], esi
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
push dword [ebp - 0x224]
mov eax, dword [ebx]
push dword [ebp - 0x228]
push ebx
call dword [eax + 0x14]
push dword [ebp - 0x21c]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x28]
push dword [ebp - 0x21c]
call dword [0x1013234]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x104
mov dword [ebp - 0x210], esi
push esi
jmp 0x1035272
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
push eax
push dword [ebp - 0x214]
call fcn.010350ce
inc dword [ebp - 0x210]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
mov dword [ebp - 0x218], ebx
call edi
test eax, eax
je 0x103523b
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001b2f
leave
ret 8
Function at 0x10352c5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1046080]
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
push eax
xor esi, esi
push 0xb
push esi
mov dword [ebp - 0x218], esi
call edi
test eax, eax
mov ebx, 0x10086b0
jl 0x10353da
lea eax, [ebp - 0x214]
push eax
push 0x16
push esi
call edi
test eax, eax
jl 0x10353bd
lea eax, [ebp - 0x210]
push eax
push 0x1026ab8
push 1
push esi
push 0x10355a8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10353af
push dword [ebp - 0x21c]
call fcn.010385f3
mov edi, eax
cmp edi, esi
je 0x1035364
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push 0xff00
push dword [ebp - 0x21c]
push edi
push esi
push eax
call dword [ecx + 0x34]
mov eax, dword [edi]
push edi
call dword [eax + 8]
push dword [ebp - 0x214]
call fcn.010385f3
mov edi, eax
cmp edi, esi
je 0x1035390
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push esi
push dword [ebp - 0x214]
push edi
push esi
push eax
call dword [ecx + 0x34]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
lea edx, [ebp - 0x218]
push edx
push ebx
push eax
call dword [ecx]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x10353ce
push dword [ebp - 0x21c]
call fcn.010385f3
mov dword [ebp - 0x218], eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHELL32.dll_ILFree]
cmp dword [ebp - 0x218], esi
je 0x10354da
lea eax, [ebp - 0x210]
push eax
push 0x2001f
push esi
push 0x1035518
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10354ce
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call fcn.01035138
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push 5
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp dword [ebp - 0x214], esi
je 0x103547d
lea eax, [ebp - 0x220]
push eax
push ebx
push esi
push dword [ebp - 0x214]
push esi
call fcn.010086c5
test eax, eax
jl 0x1035471
push dword [ebp - 0x220]
push 0x10354fc
push dword [ebp - 0x210]
call fcn.01035091
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 2
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, 0x10354e8
mov edi, eax
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x10354c2
push dword [ebp - 0x218]
push esi
push edi
push dword [ebp - 0x210]
call fcn.010350ce
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01001b2f
leave
ret
Function at 0x10355bd
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
je 0x103567c
cmp dword [esi + 4], ebx
je 0x103567c
push edi
push esi
push 8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x10460d0
call fcn.01033ecd
xor eax, eax
cmp dword [ebp - 0x20], ebx
push 4
sete al
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 4
push 0x10269b4
push 0x100c568
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x463
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 4]
push ebx
push 0x1035690
push 0x80000002
push eax
mov dword [esi], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x110a
push dword [esi]
mov dword [ebp - 4], eax
call edi
push eax
push ebx
push 0x1114
push dword [esi]
call edi
push 0x465
push dword [ebp + 8]
call fcn.01034eed
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
setge al
jmp 0x1035688
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x1035c08
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, ecx
call fcn.01034166
xor edi, edi
cmp dword [ebx + 0x5c], edi
mov esi, eax
mov dword [ebp - 4], esi
jne 0x1035c3a
cmp esi, 0xffffffff
jne 0x1035c43
push edi
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1035cfe
cmp esi, 0xffffffff
je 0x1035cfe
lea eax, [ebp - 0x34]
push eax
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x100e
push dword [ebx + 0x44]
mov dword [ebp - 0x14], edi
call esi
push edi
push edi
push 0x101f
push dword [ebx + 0x44]
call esi
lea ecx, [ebp - 0x24]
push ecx
push 1
push 0x1207
push eax
call esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea edi, [ebx + 0x48]
push edi
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x1035ccc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1035cfe
push 5
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp - 4]
lea ecx, [ebx + 0x28]
call fcn.01035997
push dword [eax + 0x10]
push 0x14e
push dword [ebx + 0x40]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1036138
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
lea edi, [ecx + 0x64]
push edi
push 0x1026ad8
push 1
push 0
push 0x1026ac8
mov dword [ebp - 4], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x103626c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x463
push ebx
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
call fcn.01034a76
mov eax, dword [edi]
mov ecx, dword [eax]
xor edi, edi
push edi
push 0x1036278
push 0x80000002
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x110a
push dword [ebp + 8]
call edi
push eax
push 5
push 0x110b
push dword [ebp + 8]
call edi
push 0x13
call dword [sym.imp.SHLWAPI.dll_IsOS]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
inc eax
push eax
push 0x100cbe8
call fcn.010345b5
mov edi, dword [sym.imp.USER32.dll_CheckDlgButton]
push eax
push 0x51c
push ebx
call edi
mov ecx, dword [ebp - 4]
push 1
push 0x100e14c
call fcn.010345b5
push eax
push 0x51a
push ebx
call edi
mov ecx, dword [ebp - 4]
push 1
push 0x101031c
call fcn.010345b5
push eax
push 0x52e
push ebx
call edi
push 0x40000003
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x103625a
push 0
push 0x521
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x520
push ebx
call esi
push eax
call edi
push 0
push 0x51c
push ebx
call esi
push eax
call edi
push 0
push 0x51d
push ebx
call esi
push eax
call edi
push 0x51d
push ebx
call fcn.01034eed
xor eax, eax
pop esi
inc eax
pop ebx
jmp 0x103626e
xor eax, eax
pop edi
leave
ret 4

Function at 0x10362c5
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 0x4000005a
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
je 0x103633e
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x46c
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x46f
push dword [ebp + 8]
call esi
push eax
call edi
push 0
push 0x46b
push dword [ebp + 8]
call esi
push eax
call edi
push 1
push 0x46d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0xab
push 0x46e
push dword [ebp + 8]
call fcn.01035750
jmp 0x10363c4
and dword [ebp - 0x20], 0
push 7
pop ecx
xor eax, eax
push eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x200000
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
and eax, 2
shr eax, 1
push eax
push 0x46c
push edi
call esi
mov eax, dword [ebp - 4]
not eax
and eax, 2
shr eax, 1
push eax
push 0x46d
push edi
call esi
mov eax, dword [ebp - 4]
not eax
and eax, 2
or eax, 0x154
shr eax, 1
push eax
push 0x46e
push edi
call fcn.01035750
mov eax, dword [ebp - 4]
not eax
and eax, 2
or eax, 0x8d4
push 0
shr eax, 1
push eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
leave
ret 4