joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d3ff
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000d454
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000d43e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1000d452
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000d452
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1000d480
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x5fc3
push 0x4dd6
push 0
push 0x2009
push 0x2f43
push 0x4cfc
call fcn.1000cb4b
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x1000d4e5
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1000d57a
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000d558
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
and dword [ecx + eax], 0
jmp 0x1000d578
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1000d578
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000d5b7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x38]
push 0x1c04
push 0
push 0x368
push 0x1fbd
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.1000d5bb
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x1001444e
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100144d1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014484
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x100144cf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100144b2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100144cf
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000fa89
mov dword [eax], 0x77e8
jmp 0x100144a7
jmp 0x100144e5
push 0
push 0x51e6
push 0x237a
call fcn.100147b4
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10017db5
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10017e16
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10017de3
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10017e14
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10017e14
push 0x2a1b
push 0x85e
push 0
push 1
push 0x32e6
call fcn.10017f29
add esp, 0x14
jmp 0x10017e73
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10017e5e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10017e5c
push 0x59f2
push 0
push 0x263a
call fcn.1001ee40
add esp, 0xc
jmp 0x10017e73
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 9
mov esp, ebp
pop ebp
ret

Function at 0x10017fc1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017fe8
push 0
push 0x2360
push 0x30ea
call fcn.1001922a
add esp, 0xc
jmp 0x10018073
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10018057
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10018038
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10018055
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000fa89
mov dword [eax], 0xe5f36f6d
jmp 0x1001802d
jmp 0x10018073
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10018073
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x10019355
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072b7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100193c6
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10019399
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x100193c1
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100193c1
push 0x1308
push 0
push 0x2027
push 0xf50
push 0x224e
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x100194e8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x3a9d
mov dword [ebp - 0x3c], 0x10007d18
cmp dword [ebp - 0x28], 0x3ab6
jle 0x10019497
and dword [ebp - 0x18], 0
jmp 0x100193fa
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2d3e
jge 0x10019497
and dword [ebp - 0x1c], 0
jmp 0x10019414
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5755
jge 0x10019492
and dword [ebp - 0x20], 0
jmp 0x1001942a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xec9
jge 0x1001948d
and dword [ebp - 0x24], 0
jmp 0x10019440
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3eb8
jge 0x1001948b
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
or eax, ecx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.1000b06a
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000f793
push eax
call fcn.100598a3
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.1000f789
jmp 0x10019439
jmp 0x10019423
jmp 0x1001940d
jmp 0x100193f3
push 0
push dword [ebp - 0x34]
push 0x3f4d
push dword [ebp - 0x38]
call fcn.100145ae
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x3740
jge 0x100194c2
push dword [ebp - 0x3c]
call fcn.100598a3
pop ecx
jmp 0x100194de
or dword [ebp - 4], 0xffffffff
jmp 0x100194e8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100196c7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100196f4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0x3ec
push dword [ebp - 8]
push 1
push 0xe4e
call fcn.10019754
add esp, 0x10
jmp 0x10019750
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10019739
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10019737
push 0
push 0x11e7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10019750
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001ea53
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072ccc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001eb1a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001eb0e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.100141fc
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x30]
call fcn.1001f677
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x83c
push 1
push dword [ebp - 0x10]
push 0x6ea3
push 0x1aa7
lea eax, [ebp - 0x30]
push eax
push 0x7ace
push 1
call fcn.1001e8b5
add esp, 0x24
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.1001f728
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1001f723
jmp 0x1001eb22
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1001eb22
push 1
call fcn.10014830
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10024e6a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10024ebb
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x25da
push dword [ebp - 0xc]
push 1
push 0x1004
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.10024ef8
add esp, 0x20
jmp 0x10024ef4
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10024edd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10024ef4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x10024f2e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10024f7e
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10024f6b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10024f7c
push 0
push 0x11e7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10024fba
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
push 0x7996
call fcn.100235a8
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x10025c9c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10025d16
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10025cf8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.1000fa89
mov dword [eax], esi
jmp 0x10025d14
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10025d14
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10025d33
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0x196f
push 0x7874
push 0
push dword [ebp - 0x2c]
call fcn.10022a80
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10025d54
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10025d90
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025d7c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10025d8e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10025d8e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10025db1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x10]
push 0x5a43
call fcn.10026120
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10026074
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100260ee
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100260d8
mov byte [ebp - 1], 0
push 1
push 0x3b7d
push 0x2189
push 0
push 1
push 0x23ec
push 0x64ad
push 0x2d6f
push 0x31dd
push 0x535d
lea eax, [ebp - 1]
push eax
push 0x1fb
call fcn.100259b4
add esp, 0x30
jmp 0x100260ec
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x1002611c
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10026108
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1002611c
push 0x2011
push 0
push 0
push 0x10b8
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov esp, ebp
pop ebp
ret
Function at 0x1002916f
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100291a5
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0x6e58
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 0x47bc
call fcn.100291e7
add esp, 0x14
jmp 0x100291e3
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100291cf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100291cd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
jmp 0x100291e3
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x100291e3
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esp, ebp
pop ebp
ret
Function at 0x1003bef5
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003bf52
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003bf34
push 0
push 0
push 0x3dc
push 0x2311
push 0x1b35
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1003bf50
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003bf50
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1003bf85
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push 0x680d
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.10038786
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x10041552
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100415c8
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004158a
push 0x22cf
push 0
push 0
push 0
push 0
push 0x179e
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100415c6
push 0
push 0x841
push 0x20c0
push 0
push 0x6fb
push 0x67d
push 0x4e1
push 0x2cb
push 0x17a1
push 0xbd2
push 0x1b75
push 0x1889
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x100415ed
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1003db8a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10041ecc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10041efc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push 1
push 0x1579
push dword [ebp - 8]
push 0x5c7d
call fcn.10041f86
add esp, 0x10
jmp 0x10041f82
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10041f42
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10041f40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10041f82
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0
push 0x3cf6
mov eax, dword [ebp - 0x2c]
push dword [eax]
mov eax, dword [ebp - 0x30]
push dword [eax]
call fcn.1003e1bc
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1004200c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10042076
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10042056
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10042054
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x10042074
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10042074
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10042097
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push 0x75d3
call fcn.100464e0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10043589
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100435e7
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100435d3
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100435d1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x100435e5
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1004360d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 1
push 0x2865
push 0x3310
push dword [ebp - 0x18]
call fcn.1003d820
add esp, 0x14
mov esp, ebp
pop ebp
ret