joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100799a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.10008238
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.1007405c
test ebx, ebx
jne 0x100799fb
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.1007983c
mov ebx, eax
test ebx, ebx
je 0x10079ae6
cmp esi, ebx
je 0x10079a24
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x10079a39
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x10079a71
add eax, 0xffffff5f
sub eax, 2
jb 0x10079a89
dec eax
sub eax, 2
jb 0x10079a9d
dec eax
sub eax, 2
jb 0x10079a93
jmp 0x10079aa7
add eax, 0xfffffdff
sub eax, 2
jb 0x10079a89
dec eax
sub eax, 2
jb 0x10079a9d
dec eax
sub eax, 2
jb 0x10079a93
jmp 0x10079aa7
mov byte [esp + 0x120], 0
jmp 0x10079aaf
mov byte [esp + 0x120], 2
jmp 0x10079aaf
mov byte [esp + 0x120], 1
jmp 0x10079aaf
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.10089cf0
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.10075804
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x10079ae8
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x100897f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x10089815
test edi, 0x40000
je 0x1008982f
test bl, bl
jne 0x100898b0
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x100898b0
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x10089862
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x10089877
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x10089886
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x10089897
cmp byte [esp + 2], 0
je 0x100898b0
cmp byte [esp + 2], 0
je 0x100898a8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x100898b0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x10089b5c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x10089b82
mov eax, esp
push eax
push 0x10089b24
call sub.user32.dll_EnumWindows
jmp 0x10089b95
mov eax, esp
push eax
push 0x10089b04
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x10089c58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x10089cac]
test si, 4
je 0x10089c6d
or bl, 1
test si, 8
je 0x10089c77
or bl, 4
test si, 1
je 0x10089c81
or bl, 8
test si, 2
je 0x10089c8b
or bl, 0x10
test si, 0x10
je 0x10089c95
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x10089ca4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x10089cb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x10089cec]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x10089cca
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x10089cd9
or bl, 4
test esi, 0x20000000
je 0x10089ce4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x10092114
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x10092126
add esp, 0xfffffff0
call fcn.10004170
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.100236c4
mov eax, dword [0x100aa214]
mov dword [eax + 4], ebx
mov dword [eax], 0x10092528
mov eax, dword [0x100aa220]
mov dword [eax + 4], ebx
mov dword [eax], 0x10092534
mov eax, ebx
call fcn.10092540
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x1008d474
push eax
push 0
push 0
mov eax, dword [0x100aa430]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x1003e574]
call fcn.1003fff4
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x1003e574]
call fcn.1003fff4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x1003e574]
call fcn.1003fff4
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x1003e574]
call fcn.1003fff4
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.10092a38
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x10092910
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x10092910
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x10092910
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x10092910
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x10092279
call fcn.100041c8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100926b0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1009285d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x1009283e
mov dl, 1
mov eax, dword [0x1001a150]
call fcn.1001e9f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.10005940
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x1009282d
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.10082524
test al, al
je 0x10092820
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x1009286c
lea eax, [ebp - 0x394]
call fcn.1000c970
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x10092820
xor eax, eax
push ebp
push 0x10092819
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x100928dc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x10092802
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.10005b28
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x10092802
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.10005b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10092820
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x10092723
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.1001e7e0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10092864
lea eax, [ebp - 0x3a0]
call fcn.10005930
ret

Function at 0x1009324c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x100b1948]
cmp byte [eax + 0xa9], 0
jne 0x100932be
cmp dword [0x100b1960], 0
jne 0x1009327e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x100aa028]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x100b1960], eax
cmp dword [0x100b195c], 0
jne 0x10093299
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x100b195c], eax
cmp dword [0x100b1964], 0
jne 0x100932be
push esp
push 0
push 0
mov eax, dword [0x100aa024]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x100b1964], eax
pop edx
ret
Function at 0x100934d4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x100934eb
add esp, 0xfffffff0
call fcn.10004170
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.100236c4
mov eax, dword [0x100aa0d8]
cmp byte [eax], 0
jne 0x10093518
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x100aa40c]
cmp word [eax + 2], 0
jne 0x10093532
mov eax, dword [0x100aa40c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.10095194
mov eax, dword [0x100aa510]
cmp word [eax + 2], 0
jne 0x1009354c
mov eax, dword [0x100aa510]
mov dword [eax + 4], ebx
mov dword [eax], fcn.100953a4
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x1003e574]
call fcn.1003fff4
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x10095828
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x1003edcc]
call fcn.10045a58
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x10093728
mov eax, dword [0x100aa2b0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.10045e5c
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x10095ad8
mov dl, 1
mov eax, dword [0x10019cd8]
call fcn.10003d08
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x100aa2b0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.1000c768
test eax, eax
je 0x1009365a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.1000c568
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.1000c750
test eax, eax
je 0x10093672
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.10005b28
push ebx
push 0x10094e04
call fcn.10089c3c
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x100aa0d8]
cmp byte [eax], 0
jne 0x100936c3
mov eax, ebx
call fcn.1009389c
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.10095d00
mov eax, ebx
call fcn.100968c4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x10093720
call fcn.100041c8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10093b70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x10093c12
cmp dword [ebx + 0x90], 0
jne 0x10093c0c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x10093abc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x10093c0c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x10093bd2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x10093c0c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.1001c31c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x10093be1
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x10093e30
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x100b1948]
cmp dword [eax + 0x170], 0
je 0x10093f95
test bl, bl
jne 0x10093ee3
cmp dword [esi + 0x98], 0
jne 0x10093ed8
mov eax, esi
call fcn.10096714
push eax
push 0x10093d3c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x10093ea9
mov eax, dword [0x100b1948]
cmp byte [eax + 0xcf], 0
je 0x10093ea9
mov eax, dword [esi + 0xd4]
call fcn.10006b30
mov edi, eax
cmp edi, 0
jl 0x10093ea9
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x10093e92
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x10093ed8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.1001c31c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x10093eb8
inc dword [esi + 0x98]
jmp 0x10093f95
cmp dword [esi + 0x98], 0
jle 0x10093f95
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x10093f95
cmp dword [esi + 0x40], 0
je 0x10093f40
mov eax, dword [0x100b1948]
cmp byte [eax + 0xcf], 0
je 0x10093f40
mov eax, dword [esi + 0xd4]
call fcn.10006b30
mov edi, eax
cmp edi, 0
jl 0x10093f40
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x10093f29
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x10093f6f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.1001c31c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x10093f4f
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x10089644]
call fcn.10006cf0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x10094b50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x10094bbb
cmp byte [ebx + 0xcf], 0
jne 0x10094bbb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.10005a7c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x10094ba8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x10094bc8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.10005940
jmp 0x10094bc8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.10005940
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x10095ed4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x10095f42
mov eax, esi
call fcn.1007cfc4
test al, al
je 0x10095f42
mov eax, dword [ebx + 0x80]
call fcn.1007ccbc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x10095f42
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x10095f36
push 0
mov eax, dword [ebx + 0x80]
call fcn.1007ccbc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.1007443c
jmp 0x10095f42
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.10095d20
pop esi
pop ebx
ret
Function at 0x10097db4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
push 0
mov eax, ebx
mov ecx, 1
mov edx, dword [0x100094a8]
call fcn.10006cf0
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.100059cc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x10097e78
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.100059cc
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
cmp dword [ebp - 0xc], 0
je 0x10097e6f
mov eax, dword [ebp - 0xc]
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x100094a8]
call fcn.10006cf0
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x10097e6f
push 0
mov eax, ebx
mov ecx, 1
mov edx, dword [0x100094a8]
call fcn.10006cf0
add esp, 4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10097e84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x10097ef3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.10005b28
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.10012910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10097efa
lea eax, [ebp - 0x210]
call fcn.10005930
ret
Function at 0x10097f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.10005940
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.100059cc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x10097fbf
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.100059cc
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
cmp dword [ebp - 0xc], 0
je 0x10097fb6
mov eax, dword [ebp - 0xc]
call fcn.10002f9c
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x10097faf
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x10097f98
sub eax, 4
jne 0x10097fa3
mov eax, ebx
mov edx, esi
call fcn.10005aec
jmp 0x10097faf
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call fcn.10005a7c
mov eax, esi
call fcn.10002fd0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009ba9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x1009bb4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x104
mov eax, esi
call fcn.10002fb4
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
cmp dword [0x100b1998], 0
jne 0x1009bae5
mov dl, 1
mov eax, dword [0x1001a150]
call fcn.1001e9f4
mov dword [0x100b1998], eax
mov eax, dword [0x100b1998]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.10005aec
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x1009bb6c
call fcn.10005dfc
push 0x100b1998
push 1
mov ecx, 0x1009bbb4
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.1009b4e8
mov eax, dword [0x100b1998]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
mov eax, ebx
call fcn.10002fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1009bb54
lea eax, [ebp - 8]
mov edx, 2
call fcn.10005938
ret
Function at 0x1009bbc0
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x1009bdd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x104
mov eax, ebx
call fcn.10002fb4
mov dword [ebp - 0x14], eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
cmp dword [0x100b19a4], 0
jne 0x1009bc27
mov dl, 1
mov eax, dword [0x1001a150]
call fcn.1001e9f4
mov dword [0x100b19a4], eax
mov eax, dword [0x100b19a4]
mov edx, dword [eax]
call dword [edx + 0x44]
cmp dword [0x100b19b0], 0
jne 0x1009bc4b
mov dl, 1
mov eax, dword [0x1001a150]
call fcn.1001e9f4
mov dword [0x100b19b0], eax
mov eax, dword [0x100b19b0]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x230]
mov edx, dword [ebp - 0x14]
movzx edx, word [edx]
call fcn.10005aac
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 4]
mov ecx, 0x1009bdf0
call fcn.10005dfc
push 0x100b19a4
push 1
mov ecx, 0x1009be1c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.1009b4e8
push 0x1009be28
call sub.kernel32.dll_LoadLibraryW
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], 0
je 0x1009bcb9
push 0x1009be44
mov eax, dword [ebp - 0x18]
push eax
call fcn.100085d0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x104
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x1c], 0
je 0x1009bd84
mov eax, dword [0x100b19a4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x1009bd84
inc esi
xor ebx, ebx
cmp dword [ebp - 0x10], 0
je 0x1009bcf9
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x1009bd84
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x100b19a4]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.10005994
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.100059cc
push eax
call dword [ebp - 0x1c]
test eax, eax
je 0x1009bd4a
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.10005b28
jmp 0x1009bd6f
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x234]
call fcn.1000b774
mov eax, dword [ebp - 0x234]
call fcn.100059cc
push eax
call sub.kernel32.dll_OutputDebugStringW
mov edx, dword [ebp - 0xc]
mov eax, dword [0x100b19b0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec esi
jne 0x1009bce7
cmp dword [ebp - 0x18], 0
je 0x1009bd93
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [0x100b19a4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
mov eax, dword [ebp - 0x14]
call fcn.10002fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1009bdd9
lea eax, [ebp - 0x234]
mov edx, 2
call fcn.10005938
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.10005938
ret