joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1039f7d
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
test byte [0x10b1104], 1
push edi
mov edi, ecx
je 0x1050378
mov eax, dword [0x10b1100]
test eax, eax
jne 0x1056570
pop edi
ret
or dword [0x10b1104], 1
push 0
push 0
push 0
push 0x10503ac
push 0x100f280
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
mov dword [0x10b1100], eax
jmp 0x1039f92
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1039f9a
push 0
push 0x1002cd0
push 3
push 0x1068f6c
call fcn.01009311
mov ecx, edi
pop edi
jmp fcn.0105153c

Function at 0x103b0e6
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc10]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x103b109
push ebx
push ebx
push 0x438
push eax
call edi
push ebx
push ebx
push 0x1f
push dword [esi + 4]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push ebx
push 1
push 0x43f
push dword [esi + 0xc10]
call edi
pop edi
lea ecx, [esi + 0xaf8]
pop esi
pop ebx
jmp fcn.0103998e

Function at 0x103e044
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
cmp ecx, dword [esi + 0x5c]
jb 0x103e0c9
push 0
push 0xff
mov ecx, esi
call fcn.01014f45
jmp 0x103e118
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
lea eax, [ebp - 0x28]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edi, [esi + 0x4c]
mov eax, dword [edi]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi]
mov dword [ebp - 0xc], eax
cmp eax, ecx
jne 0x103e119
push ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x50]
jne 0x103e118
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
push 0
sbb dword [ebp - 0x14], eax
push 0x3e8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0100e7e5
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edx
push eax
call fcn.0103dfdb
mov ecx, eax
cmp ecx, dword [esi + 0x60]
jae 0x103e023
mov ebx, dword [esi + 0x5c]
cmp ecx, ebx
jae 0x103e13a
mov eax, ecx
imul eax, eax, 0xff
xor edx, edx
div ebx
mov byte [ebp - 8], al
cmp ecx, dword [esi + 0x60]
jae 0x103e134
mov ebx, dword [esi + 0x60]
mov eax, ebx
sub eax, ecx
imul eax, eax, 0xff
xor edx, edx
div ebx
mov byte [ebp - 4], al
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.01014f45
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi]
cmp dword [ebp - 0xc], eax
je 0x103e07d
pop ebx
mov eax, dword [edi]
cmp dword [ebp - 0xc], eax
jne 0x103e130
mov esi, dword [esi + 0x50]
cmp dword [ebp - 0x10], esi
jne 0x103e130
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
leave
ret
mov byte [ebp - 4], 0
jmp 0x103e0f8
mov byte [ebp - 8], 0
jmp 0x103e0df
Function at 0x103e705
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push 2
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_GetAncestor]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov ebx, eax
call edi
test ax, ax
jl 0x105fc80
xor eax, eax
neg eax
sbb eax, eax
and eax, 0x103e7b8
push eax
push 0x100
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_Ordinal_571]
mov ebx, eax
test ebx, ebx
jl 0x103e7ab
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
and dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x100e
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
lea eax, [ebp - 0x10]
push eax
push 0
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x1c]
push eax
push 0xcc
push dword [esi + 0x44]
call fcn.0103c26a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
cmp ebx, 0x800704c7
je 0x103e758
jmp 0x103e7a2
push 0x11
call edi
test ax, ax
jge 0x103e732
xor eax, eax
inc eax
jmp 0x103e734
Function at 0x103fbb3
Capabilities:
Create process on windows

Disassembly:
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push edi
mov ecx, esi
call fcn.0104003f
push dword [0x10b10ec]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x103fbef
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push edi
mov ecx, esi
call fcn.0107116d
jmp 0x103fbef
push 0
push 0x1f7
call fcn.0103700a
jmp 0x103fbef
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x30002
push 0x127
lea edi, [esi + 0xc04]
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi]
mov ecx, esi
call fcn.01039f5f
jmp 0x103fbef
push 0x1032284
push dword [esi + 4]
call fcn.010409b1
test eax, eax
jne 0x103fbef
push 0x10689bc
push 0x1030a00
push dword [esi + 4]
call fcn.0106f82a
jmp 0x103fbef
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x103fbef
push eax
push 0xa085
mov ecx, esi
jmp 0x103f9a8
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x103fbef
push eax
push 0xa086
jmp 0x103fa33
push ebx
mov ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebx
je 0x103fa6a
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
cmp edi, 0x1fb
sete al
push 0
lea eax, [eax + eax - 1]
push eax
push 0x43d
push dword [esi + 0xc10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebx
jmp 0x103fbef
push 5
xor edi, edi
push edi
push 0x103fba0
push 0x103fb88
push edi
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x103fbef
push 1
push 0
push 0x10b39ec
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x103fbef
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push 1
mov ecx, esi
call fcn.01071649
jmp 0x103fbef
xor edi, edi
cmp dword [0x10b10f8], edi
jne 0x103fbef
push 2
push dword [esi + 4]
push edi
push 1
call dword [sym.imp.dwmapi.dll_Ordinal_113]
jmp 0x103fbef
call fcn.0106fe74
jmp 0x103fbef
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, dword [esi + 0xe04]
je 0x103fbf6
lea eax, [edi - 0x1f4]
mov dword [esi + 0xe04], edi
cmp eax, 0x41
ja case.0x103fbe3.514
movzx eax, byte [eax + 0x103fb44]
jmp dword [eax*4 + 0x103fb08]
call fcn.0103ff19
or dword [esi + 0xe04], 0xffffffff
pop edi
pop esi
pop ebp
ret 8
push 2
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.dwmapi.dll_Ordinal_113]
xor eax, eax
cmp dword [0x10b10f8], edi
push 1
sete al
mov ecx, esi
push eax
call fcn.01009aab
push 1
call fcn.010407ef
jmp 0x103fbef
push dword [ebp + 0xc]
push edi
call fcn.0107148e
jmp 0x103fbef
Function at 0x103fdb5
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp + 0x1c], 4
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x614], edi
mov word [ebp - 0x20c], ax
cmp dword [ebp + 0xc], ebx
jne 0x105636b
mov dword [ebp - 0x610], ebx
cmp esi, ebx
je 0x105639c
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x105639c
cmp word [ebp - 0x20c], bx
je 0x103fe49
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x103fe49
push eax
call dword [sym.imp.SHELL32.dll_DriveType]
cmp eax, 2
je 0x1056387
cmp eax, 5
je 0x1056387
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x105639c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
cmp dword [ebp + 0x14], ebx
je 0x103fe87
push edi
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0x14]
push dword [0x10b10b4]
call esi
lea ebx, [ebp - 0x40c]
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x10563b2
push dword [ebp + 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x614]
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001feb
leave
ret 0x18
movzx eax, word [ebp + 0xc]
push eax
push dword [0x10b10b4]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x610], eax
jmp 0x103fdf7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x103fe49
push ebx
push 0x10
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x103fe5e
push edi
lea eax, [ebp - 0x60c]
push eax
push dword [ebp + 0x18]
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0x60c]
jmp 0x103fe92
Function at 0x1043efd
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
call esi
mov edi, dword [ebp + 8]
test ax, ax
jl 0x105cda8
push 0x11
call esi
test ax, ax
jl 0x105cdb3
pop edi
pop esi
pop ebp
ret 4
or dword [edi], 0x10000000
jmp 0x1043f1a
or dword [edi], 0x40000000
jmp 0x1043f27

Function at 0x1047e9f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x338]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1047eef
cmp dword [ebp + 8], 0
jne 0x104803d
mov edx, dword [eax + 0x29c]
mov ecx, edx
and ecx, 0xf
test dl, 0x20
jne 0x10595e7
add eax, 0x18
push eax
push ecx
push 0x421
push dword [esi + 0x20]
call edi
mov eax, dword [esi + 0x338]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x1047f25
test byte [eax + 0x29c], 0x10
jne 0x1047f25
call ebx
sub eax, dword [ebp + 0xc]
cmp eax, 0x1388
jb 0x1047f25
call ebx
push 2
push 0x1048060
mov dword [ebp - 4], eax
call fcn.0103740c
mov ecx, esi
call fcn.01047899
mov ecx, 0x10b1460
call fcn.0100dbeb
push 0x2c
lea eax, [ebp - 0x30]
push 0
push eax
mov dword [ebp - 0x34], 0x30
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x338]
add esp, 0xc
test ecx, ecx
je 0x1047f79
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x439
push dword [esi + 0x20]
add ecx, 0x98
mov dword [ebp - 0x10], ecx
call edi
cmp dword [esi + 0x338], 0
mov dword [esi + 0x340], 1
je 0x1048033
and dword [esi + 0x390], 0
push 0x21b
push 0x1048050
call fcn.01034b2d
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0x2016
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1047fd4
mov eax, dword [ebp + 8]
imul eax, eax, 0x3e8
mov dword [ebp + 8], eax
cmp eax, 0x2328
jae 0x10595ef
mov eax, 0xbb8
add eax, 0x3e8
push eax
push 7
mov ecx, esi
call fcn.0104808b
test eax, eax
je 0x1048033
and dword [esi + 0x90], 0
call ebx
push 0x3e8
push 4
mov ebx, 0x403
push ebx
push dword [esi + 0x20]
mov dword [esi + 0x8c], eax
call edi
push 0x1388
push 5
push ebx
push dword [esi + 0x20]
call edi
push 0
push 0
add ebx, 0xe
push ebx
push dword [esi + 0x20]
call edi
lea eax, [ebp - 0x34]
push eax
push 1
push ebx
push dword [esi + 0x20]
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
add eax, 0x18
push eax
push dword [ebp + 8]
jmp 0x1047ee5
add ecx, 3
jmp 0x1047ee0
add eax, 0xffffe890
jmp 0x1047fd9
Function at 0x104873e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10b1110], 0
push esi
je 0x104f6cc
mov eax, dword [0x10b1110]
cmp eax, 1
je 0x105c957
push eax
call dword [0x10b1118]
test eax, eax
je 0x105c96e
pop esi
ret
call fcn.0104f6e3
test eax, eax
jne 0x104874c
jmp 0x105c985
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x105c985
pop esi
ret
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x105c989
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x10b1110]
call dword [0x10b1118]
mov edi, eax
test edi, edi
je 0x105c9ae
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x105c9ca
mov edi, esi
add esi, 0xff0
push edi
push dword [0x10b1110]
call dword [0x10b1114]
add edi, 0x10
cmp edi, esi
jb 0x105c9b6
mov eax, edi
pop edi
jmp 0x1048769
Function at 0x104c0a1
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
and dword [esi], 0
push edi
push 0x104c108
call fcn.0104c13d
lea eax, [ebp + 0xc]
push eax
push 0x104c128
call fcn.0104bc39
mov edi, eax
test edi, edi
jl 0x104c0f5
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push esi
movzx eax, ax
push 0x104bb24
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x104c118
call fcn.0104c13d
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x104de87
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, ecx
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x20]
and dword [edi + 0x60], 0
and dword [edi + 0x5c], 0
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x24]
and eax, 0xe0000000
mov dword [ebp + 8], eax
jne 0x104ded2
push 0xffffffffffffffec
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_GetWindowLongW]
shl eax, 7
not eax
and eax, 0x20000000
or eax, 0x40000000
mov dword [ebp + 8], eax
mov ecx, edi
call fcn.0103d227
lea ebx, [edi + 0x6c]
mov eax, dword [ebx]
test eax, eax
jne 0x105e7cb
push ebx
call fcn.01015b1d
mov eax, dword [edi + 0x58]
and dword [ebp - 4], 0
cmp eax, dword [edi + 0x1e0]
je 0x105e7db
push dword [esi + 0xc]
mov ecx, edi
call fcn.0104db87
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.0104dc3e
xor ebx, ebx
cmp eax, ebx
jl 0x104df83
mov eax, dword [esi + 0x24]
or eax, dword [ebp + 8]
mov ecx, dword [edi + 0x6c]
push eax
add esi, 0x10
push esi
call fcn.0104df91
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ebx
jne 0x105e82f
cmp dword [0x10b24cc], ebx
je 0x104df6e
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x104df7d
mov ecx, dword [0x10b24b8]
mov edx, dword [0x10b24bc]
mov eax, 0x10000
mov esi, 0x80000000
and ecx, eax
and edx, esi
or ecx, edx
jne 0x105e899
cmp dword [ebp + 8], 0
jl 0x104df83
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
test al, al
je 0x104df4c
jmp 0x104df6e
mov ecx, edi
call fcn.0104d4c6
jmp 0x104df74
mov eax, dword [eax + 4]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x24]
jmp 0x104dee6
lea ebx, [edi + 0x68]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
test eax, eax
je 0x105e7fe
push dword [esi + 0xc]
push dword [eax + 0xc]
call fcn.0107f9b8
test eax, eax
je 0x105e7fe
xor eax, eax
jmp 0x105e823
push ebx
call fcn.01015b1d
push dword [esi + 0xc]
mov ecx, edi
call fcn.0104db87
push ebx
push dword [edi + 0x38]
push edi
push dword [esi + 0xc]
call fcn.0104dc3e
test eax, eax
jl 0x104df83
mov ebx, dword [ebx]
mov dword [edi + 0x6c], ebx
inc dword [ebx]
jmp 0x104df16
cmp dword [0x10b24cc], ebx
je 0x104df6e
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x105e84c
test al, al
jne 0x104df6e
mov ecx, dword [0x10b24b8]
mov edx, dword [0x10b24bc]
mov eax, 0x10000
mov esi, 0x80080000
and ecx, eax
and edx, esi
or ecx, edx
je 0x104df6e
mov ecx, dword [0x10b24c0]
mov ebx, dword [0x10b24c4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0x104df6e
cmp eax, ebx
jne 0x104df6e
push 0x10426a8
jmp 0x105e8c2
mov ecx, dword [0x10b24c0]
mov ebx, dword [0x10b24c4]
mov edx, ecx
and edx, eax
mov eax, ebx
and eax, esi
cmp edx, ecx
jne 0x104df6e
cmp eax, ebx
jne 0x104df6e
push 0x105e8d8
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
jmp 0x104df6e
Function at 0x104ed13
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push 0xcd
mov dword [ebp - 0x104], ebx
call fcn.0104ec67
mov esi, eax
mov dword [ebp - 0x100], esi
test esi, esi
je 0x104ee61
cmp dword [ebp + 8], 0
push edi
je 0x10577c8
cmp dword [ebx + 0x3c8], 0
jne 0x10577b5
cmp dword [ebx + 0xc7c], 0
jne 0x10577e1
mov eax, dword [ebx + 0xd28]
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push eax
mov esi, 0x1a8
push esi
push dword [ebp - 0x100]
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea eax, [ebp - 0x11c]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
call fcn.01035409
test eax, eax
jne 0x104ee71
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x118]
je 0x104ee71
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
push eax
push esi
push dword [ebp - 0x100]
call edi
cmp dword [ebx + 0xc70], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, dword [sym.imp.USER32.dll_ModifyMenuW]
jne 0x1057808
push 0
push 0x1a0
push dword [ebp - 0x100]
call dword [sym.imp.USER32.dll_DeleteMenu]
cmp dword [0x10b10f8], 0
jne 0x105788d
mov ecx, dword [ebp - 0x104]
call fcn.0104ebca
test eax, eax
je 0x10578c0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0x10
push 0x104eb4c
push 0x104ee80
push 0x80000001
mov dword [ebp - 0x10c], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x10578f2
mov eax, dword [ebp - 0x100]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001feb
leave
ret 4
push 3
pop eax
jmp 0x104edc5
push 0x400
push 1
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x104ed64
push 2
pop edi
push 0x400
push edi
push esi
call dword [sym.imp.USER32.dll_DeleteMenu]
dec edi
js 0x104ed64
jmp 0x10577cb
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x1a8
push esi
call edi
cmp dword [ebp + 8], 0
jne 0x104edd5
push 1
push 0x19d
push esi
jmp 0x104edd3
mov eax, dword [ebp - 0x104]
cmp dword [eax + 0xcd4], 0
je 0x104edee
cmp dword [0x10b10f8], 0
jne 0x104edee
push 0x1e
lea eax, [ebp - 0x7c]
push eax
push 0x216
push dword [0x10b10b4]
call esi
push 0x1e
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax + 0xcd4]
push dword [eax]
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xfc]
push 0x40
push eax
call fcn.010343ca
add esp, 0x10
lea eax, [ebp - 0xfc]
push eax
mov eax, 0x1a0
push eax
push 0
push eax
push dword [ebp - 0x100]
call ebx
jmp 0x104ee01
push 0x40
lea eax, [ebp - 0xfc]
push eax
push 0x352
push dword [0x10b10b4]
call esi
lea eax, [ebp - 0xfc]
push eax
mov eax, 0x197
push eax
push 0
push eax
push dword [ebp - 0x100]
call ebx
jmp 0x104ee0e
push 3
push 0x193
push dword [ebp - 0x100]
call edi
push 3
push 0x194
push dword [ebp - 0x100]
call edi
push 3
push 0x195
push dword [ebp - 0x100]
call edi
jmp 0x104ee21
cmp dword [ebp - 0x108], eax
je 0x104ee5a
push 3
push 0x1a4
push dword [ebp - 0x100]
call edi
jmp 0x104ee5a
Function at 0x106d060
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 0x106d0e0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010343ca
add esp, 0x10
test eax, eax
jl 0x106d0cf
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0
push 0x10002
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
neg eax
sbb eax, eax
inc eax
jmp 0x106d0d1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01001feb
leave
ret 0xc
Function at 0x106d6a9
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
mov dword [ebp - 0x40], 0x3c
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1030a20
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 0x2000100
mov dword [ebp - 0x34], 0x10689bc
call sub.SHELL32.dll_SHGetKnownFolderIDList
test eax, eax
jl 0x106d6fd
mov eax, dword [ebp - 4]
or dword [ebp - 0x3c], 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_ILFree]
leave
ret
Function at 0x106ea75
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1f4
xor edi, edi
lea eax, [ebp - 0x1f8]
push edi
push eax
mov dword [ebp - 0x1fc], 0x1f8
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x1fc]
push eax
push 0x1f8
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x106eb11
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp cx, 4
jne 0x106eaf8
shr ax, 0xa
cmp ax, 1
je 0x106eaec
cmp ax, 2
jne 0x106eaf8
mov dword [ebp - 0x1d4], 0x190
jmp 0x106eb02
mov dword [ebp - 0x1d4], 0x2bc
lea eax, [ebp - 0x1e4]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.01001feb
leave
ret

Function at 0x106f342
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov cx, word [ebp + 8]
shr cx, 8
sub esp, 0xc
xor eax, eax
test cl, 4
je 0x106f35a
inc eax
test cl, 2
je 0x106f362
or eax, 2
test cl, 1
je 0x106f36a
or eax, 4
movzx cx, byte [ebp + 8]
and dword [ebp - 4], 0
shl eax, 8
add ax, cx
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x106f2e9
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x106f82a
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push dword [ebp + 0xc]
call sub.SHELL32.dll_SHGetKnownFolderIDList
test eax, eax
jl 0x106f890
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x10000c
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_ILFree]
leave
ret 0xc