joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b6530
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x20]
add eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
mov eax, dword [esi + 0x2c]
add eax, dword [ebp - 0x10]
sub dword [ebp - 8], eax
push 0x2001f
push dword [0x1014e928]
mov dword [ebp - 0x20], 0
push SysReAllocString
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.10013210
test eax, eax
je 0x100b65b1
sub esp, 8
lea ecx, [ebp - 0x20]
push 0x2001f
sub esp, 8
push dword [0x1014e928]
push SysReAllocString
call fcn.100380f0
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 0x10
push eax
push 3
push 0
push str.CEditCustomItemDlg
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x100b65d5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100d4906
mov esp, ebp
pop ebp
ret
Function at 0x100b9350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x58], esi
push dword [esi + 0x4c]
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x3eb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
push 0x10000
push 0x10000
push 0x1036
push esi
call edi
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0
push 0x31
mov ebx, eax
push esi
mov dword [ebp - 0x54], ebx
call edi
push eax
push ebx
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
call ebx
mov edi, eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
push edi
mov edi, dword [ebp - 0x54]
push edi
call ebx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xc
call edi
mov ecx, dword [ebp - 0x50]
add ecx, 7
add eax, ecx
movzx ebx, ax
push 0xb
shl ebx, 0x10
call edi
mov ecx, dword [ebp - 0x50]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add ecx, 7
add eax, ecx
movzx eax, ax
or eax, ebx
push eax
push 0
push 0x1035
push esi
call edi
call dword [sym.imp.UxTheme.dll_IsAppThemed]
test eax, eax
je 0x100b9430
push 0
push str.Explorer
push esi
call dword [sym.imp.UxTheme.dll_SetWindowTheme]
mov ebx, dword [ebp - 0x58]
mov ecx, ebx
mov eax, dword [ebx + 0x50]
push dword [eax]
call fcn.100b9b70
push ecx
mov ecx, ebx
call fcn.100be4a0
push 0x3e9
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
call dword [sym.imp.SHLWAPI.dll_SHAutoComplete]
push 0x2001f
push dword [0x1014e928]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push SysReAllocString
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
call fcn.10013210
mov esi, dword [ebp - 0x64]
test eax, eax
jne 0x100b94f5
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push str.CBrowseForIconDlg
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b94f5
cmp dword [ebp - 0x58], 3
jne 0x100b94f5
cmp dword [ebp - 0x54], 0x10
jne 0x100b94f5
mov eax, dword [ebx + 0x2c]
add eax, dword [ebp - 8]
push 0x104
push eax
mov eax, dword [ebx + 0x28]
add eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0x402
push dword [ebx + 4]
call edi
test esi, esi
je 0x100b9500
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100b97e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x20]
add eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
mov eax, dword [esi + 0x2c]
add eax, dword [ebp - 0x10]
sub dword [ebp - 8], eax
push 0x2001f
push dword [0x1014e928]
mov dword [ebp - 0x20], 0
push SysReAllocString
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.10013210
test eax, eax
je 0x100b9861
sub esp, 8
lea ecx, [ebp - 0x20]
push 0x2001f
sub esp, 8
push dword [0x1014e928]
push SysReAllocString
call fcn.100380f0
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 0x10
push eax
push 3
push 0
push str.CBrowseForIconDlg
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x100b9885
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100d4906
mov esp, ebp
pop ebp
ret
Function at 0x100b9ed0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ffcb0
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x1013c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x80], 0x10122564
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100ba0a4
mov eax, dword [ecx]
call dword [eax + 0xc]
push 2
add eax, 0x10
mov byte [ebp - 0x38], 0
push esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_GetAncestor]
mov ecx, 0xfa2
mov esi, eax
call fcn.100aef60
mov edi, eax
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x100b9fa9
call fcn.100d35ee
mov dword [ebp - 0x6c], eax
test eax, eax
jne 0x100b9fa9
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100b9ffd
push 0
push 0
push eax
call fcn.100d36f0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x10149514
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1014952c]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x78]
push 0x10149514
mov dword [0x1014952c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x1009ada0
push esi
push edi
push dword [0x1014a878]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push 1
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x7c], 0
mov dword [ebp - 0x3c], esi
je 0x100ba063
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x100ba063
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x100ba05d
lea eax, [ebp - 0x28]
push eax
call edi
lea eax, [ebp - 0x28]
push eax
call ebx
cmp dword [ebp - 0x7c], 0
jne 0x100ba030
mov esi, dword [ebp - 0x2c]
mov bl, byte [ebp - 0x38]
add esi, 0xfffffff0
mov dword [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100ba088
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x80]
call fcn.10086ac0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10013970
int3
Function at 0x100babf0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
xor eax, eax
xor esi, esi
mov ebx, ecx
cmp byte [ebp + 0xc], al
mov word [edi], ax
mov eax, dword [sym.imp.USER32.dll_MapVirtualKeyW]
jne 0x100bac23
test ebx, 0x200
je 0x100bac5b
push 0x64
lea ecx, [ebp - 0xcc]
push ecx
push 0
push 0x11
call eax
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0xcc]
push eax
push 0x101224ac
push dword [ebp + 8]
push edi
call fcn.100a4830
mov esi, eax
add esp, 0x10
mov eax, dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0x10], 0
jne 0x100bac69
test ebx, 0x400
je 0x100baca2
push 0x64
lea ecx, [ebp - 0xcc]
push ecx
push 0
push 0x12
call eax
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push 0x101224ac
push eax
lea eax, [edi + esi*2]
push eax
call fcn.100a4830
add esp, 0x10
add esi, eax
cmp byte [ebp + 0x14], 0
jne 0x100bacb0
test ebx, 0x100
je 0x100baced
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp + 8]
sub eax, esi
push 0x101224ac
push eax
lea eax, [edi + esi*2]
push eax
call fcn.100a4830
add esp, 0x10
add esi, eax
test ebx, ebx
je 0x100bad2f
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x100bad42
push 0x64
lea ecx, [ebp - 0xcc]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x100bad42
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xcc]
push eax
sub edx, esi
lea ecx, [edi + esi*2]
call fcn.100a4780
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [edi], ax
xor ecx, ebp
pop edi
pop esi
xor al, al
pop ebx
call fcn.100d4906
mov esp, ebp
pop ebp
ret
Function at 0x100bee00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fff20
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1013c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef47
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 1
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef51
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x10], eax
mov dword [ebp - 4], 2
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef5b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 3
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef65
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x18], eax
mov dword [ebp - 4], 4
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef6f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [ebp - 4], 5
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef79
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 6
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100bef83
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10013970
push 0x80004005
call fcn.10013970
push 0x80004005
call fcn.10013970
push 0x80004005
call fcn.10013970
push 0x80004005
call fcn.10013970
push 0x80004005
call fcn.10013970
push 0x80004005
call fcn.10013970
int3
Function at 0x100c4270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101003e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
call fcn.100215d0
mov ecx, eax
test ecx, ecx
je 0x100c4429
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x14], eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov edi, dword [ebp + 8]
mov ecx, edi
push dword [ebp + 0xc]
sar ecx, 4
inc ecx
mov dword [ebp - 4], 1
movzx eax, cx
push eax
push 6
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x100c4329
add esi, 0xfffffff0
mov ecx, esi
call fcn.10021e50
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100c4315
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100c4350
mov ecx, dword [ebp - 0x14]
call fcn.10021e50
add eax, 0x10
add esi, 0xfffffff0
mov dword [ebx], eax
mov dword [ebp - 4], 3
jmp 0x100c4300
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x100c437c
mov ecx, dword [ebp - 0x14]
call fcn.10021e50
mov edi, dword [ebp - 0x1c]
add eax, 0x10
add esi, 0xfffffff0
mov dword [edi], eax
mov dword [ebp - 4], 4
jmp 0x100c43f6
and edi, 0xf
jbe 0x100c438f
movzx eax, word [ebx]
lea ebx, [ebx + eax*2]
add ebx, 2
sub edi, 1
jne 0x100c4381
movzx edi, word [ebx]
add ebx, 2
mov dword [ebp - 0x14], edi
test edi, edi
je 0x100c43dd
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x100c43b9
push edi
lea ecx, [ebp - 0x18]
call fcn.10021230
mov esi, dword [ebp - 0x18]
add edi, edi
push edi
push ebx
push esi
call fcn.100d7080
xor eax, eax
add esp, 0xc
mov word [edi + esi], ax
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi - 8]
jg 0x100c441f
mov dword [esi - 0xc], eax
xor eax, eax
mov word [edi + esi], ax
add esi, 0xfffffff0
mov ecx, esi
call fcn.10021e50
mov edi, dword [ebp - 0x1c]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 5
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100c440b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10013970
push 0x80004005
call fcn.10013970
int3
Function at 0x100edef9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100edd6f

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10002880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov edx, 0x4b
push esi
push edi
mov esi, 0x10067b20
xor edi, edi
mov ecx, edi
mov eax, edi
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebp + edi*4 - 0x400], eax
inc edi
cmp edi, 0x100
jl 0x10002897
or eax, 0xffffffff
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebp + ecx*4 - 0x400]
sub edx, 1
jne 0x10002934
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10002c40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push edi
mov edi, ecx
mov dword [ebp - 0x4c], 0x30
push 0x7f00
push edi
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x10002da0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x100ce244
call esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
test ax, ax
jne 0x10002ce5
push 0x100ce268
push 0x100ce290
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push 0
push 0
push 0xc8
push 0x12c
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x100ce2d0
push 0x100ce244
push 0
mov dword [0x100c471c], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x10002d3f
push eax
push 0x100ce268
push 0x100ce2f8
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x1c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x10002d8d
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x10002d71
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002f30
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x278
push esi
push edi
push 0x64
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
push eax
push dword [0x100c4700]
call esi
push 0x64
lea eax, [ebp - 0x288]
push eax
push dword [0x100c46dc]
call esi
lea eax, [ebp - 0x1c0]
push eax
call fcn.1004c333
add esp, 4
lea eax, [ebp - 0x288]
fstp qword [ebp - 0x18]
push eax
call fcn.1004c333
fstp qword [ebp - 0x48]
movsd xmm0, qword [ebp - 0x48]
lea ecx, [ebp - 0x90]
mulsd xmm0, qword [ebp - 0x18]
add esp, 4
mov dword [ebp - 0xf8], 0x100ce724
mov dword [ebp - 0xe8], 0x100ce9c4
movsd qword [ebp - 0x28], xmm0
call fcn.10008710
push ecx
lea eax, [ebp - 0xe0]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x14], 1
call fcn.10008660
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf8], 0x100ce0ec
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xfc], eax
lea ecx, [ebp - 0xe0]
call fcn.10009130
mov dword [ebp - 0xe0], 0x100cea08
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xe8]
movsd xmm1, qword [ebp - 0x28]
call fcn.10006c80
mov byte [ebp - 4], 3
xor eax, eax
mov edx, dword [ebp - 0xa4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x40], ax
mov edi, 7
mov eax, edx
mov dword [ebp - 0x30], 0
and al, 0x22
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], 5
movq qword [ebp - 0x28], xmm0
cmp al, 2
je 0x100030d5
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax]
test ecx, ecx
je 0x100030d5
cmp ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xd0]
cmovb ecx, dword [ebp - 0xa8]
mov edx, dword [eax]
sub ecx, edx
sar ecx, 1
jmp 0x10003106
test dl, 4
jne 0x10003100
mov eax, dword [ebp - 0xc4]
mov esi, dword [eax]
test esi, esi
je 0x10003100
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
add ecx, ecx
sub ecx, edx
add ecx, esi
sar ecx, 1
jmp 0x10003106
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x10003117
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.10009370
mov edi, dword [ebp - 0x2c]
cmp edi, 7
lea eax, [ebp - 0x40]
cmova eax, dword [ebp - 0x40]
push eax
push dword [0x100c46e8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x10003164
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000315a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003182
push ecx
push edx
call fcn.1003ecdd
add esp, 8
lea ecx, [ebp - 0xf8]
call fcn.10003190
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1004dded
int3