joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a7534
Capabilities:
Initialize iwebbrowser2
Log keystrokes

Disassembly:
push 0x64
mov eax, 0x10188c84
call fcn.10145d80
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 0x101c0c58
push 0x15
push ebx
push 0x101c0c18
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x100a767e
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x100a767e
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100a7609
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
call esi
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call edi
push dword [ebp - 0x1c]
call esi
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call edi
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov word [ebp - 0x30], bx
call fcn.10014b08
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x70]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x50]
push eax
call esi
lea eax, [ebp - 0x40]
push eax
call esi
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x50]
push edx
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0x70]
push edx
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 6
call dword [ecx + 0xd0]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x40]
push eax
call esi
lea eax, [ebp - 0x50]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x70]
push eax
call esi
lea eax, [ebp - 0x30]
push eax
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x100a7694
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp + 8]
call fcn.10003b75
call fcn.10145e58
ret 4

Function at 0x100a8048
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
push dword [esi + 4]
mov ecx, 0x101f8c68
push 0
call fcn.10016a0b
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x100a807e
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100a807e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x100ab787
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x100ab38e
push 0
push 0
call fcn.10147cdf
mov edi, eax
add esp, 0x18
test edi, edi
je 0x100ab7c9
push 0x4000
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret
Function at 0x100afca3
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 4
mov eax, 0x101898f9
call fcn.10145d80
push 0
push 2
mov edi, ecx
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x100afd0c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x230
leave
ret
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007b11
and dword [ebp - 4], 0
test ebx, ebx
je 0x100afd7e
lea ebx, [edi + 0x4c]
lea ecx, [ebp - 0x10]
call fcn.10004076
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.100afa2e
cmp eax, 0xffffffff
jne 0x100afd82
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000425b
push dword [ebp - 0x10]
push str.ExeName:_s_n
push 0xe
call fcn.10104e0d
add esp, 0xc
test edi, edi
jne 0x100afd2f
xor edi, edi
jmp 0x100afd85
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov eax, edi
jmp 0x100afce9
Function at 0x100b0a32
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x10189af8
call fcn.10145d80
push 0x1019f188
lea ecx, [ebp - 0x20]
call fcn.10007b11
and dword [ebp - 4], 0
push eax
push str.exePath
mov edi, str.SOFTWAREBaiduBaiduPinyin
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.10120490
add esp, 0x14
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.10003b75
push str._baidupinyin.exe
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10007b6e
push dword [ebp - 0x18]
mov byte [ebp - 4], 3
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b0ac6
push 0x101af2f4
call fcn.100afeca
test eax, eax
pop ecx
je 0x100b0ac6
xor esi, esi
inc esi
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
mov eax, esi
call fcn.10145e58
ret
push str.1970_01_01_00:00:00
lea ecx, [ebp - 0x20]
call fcn.10007b11
lea eax, [ebp - 0x20]
push eax
push str.LastInstallTime
push edi
lea eax, [ebp - 0x14]
push esi
push eax
mov byte [ebp - 4], 4
call fcn.10120490
add esp, 0x14
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.10003b75
push 0x101af284
lea ecx, [ebp - 0x28]
call fcn.10007b11
lea eax, [ebp - 0x28]
push eax
push str.uninstallTime
push edi
lea eax, [ebp - 0x10]
push esi
push eax
mov byte [ebp - 4], 7
call fcn.10120490
add esp, 0x14
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.10003b75
push dword [ebp - 0x14]
push str._d__d__d__d:_d:_d
call fcn.100af805
push dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
push 0x101af220
mov edi, edx
call fcn.100af805
mov ebx, edx
add esp, 0x10
mov esi, eax
or eax, ebx
jne 0x100b0b6f
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
xor esi, esi
jmp 0x100b0aae
test edi, edi
jl 0x100b0b9b
jg 0x100b0b7b
cmp dword [ebp - 0x24], 0
jbe 0x100b0b9b
cmp edi, ebx
jl 0x100b0b9b
jg 0x100b0b86
cmp dword [ebp - 0x24], esi
jbe 0x100b0b9b
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
jmp 0x100b0aab
push 0
call fcn.1014a370
mov edi, eax
sub edi, esi
pop ecx
mov esi, edx
mov ecx, 0x101f84e8
sbb esi, ebx
call fcn.10055163
xor ecx, ecx
cmp esi, ecx
jg 0x100b0bc6
jl 0x100b0bc1
cmp edi, eax
jae 0x100b0bc6
xor esi, esi
inc esi
jmp 0x100b0bc8
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
jmp 0x100b0aae
Function at 0x100b16cb
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x10189d19
call fcn.10145d80
mov esi, dword [ebp + 0xc]
cmp dword [esi - 8], 0
mov dword [ebp - 4], 1
jne 0x100b1740
lea eax, [ebp - 0x18]
push eax
call fcn.1011e0f9
pop ecx
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.10007845
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.10003b75
push str.PushTips.exe
lea ecx, [ebp + 0xc]
call fcn.1001107f
mov esi, 0x101f84e8
mov ecx, esi
call fcn.1005461a
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.10095ce3
add esp, 0xc
push 1
mov ecx, esi
call fcn.10054693
jmp 0x100b1832
push str.download
push esi
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
jne 0x100b181d
lea eax, [ebp - 0x18]
mov esi, 0x101f84e8
push eax
mov ecx, esi
call fcn.1005006a
push 1
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov byte [ebp - 4], 3
call fcn.10007ade
lea eax, [ebp - 0x14]
push eax
call fcn.100b0ef7
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.10003b75
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.10050646
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
mov byte [ebp - 4], 5
je 0x100b1806
mov ecx, esi
call fcn.10054f34
test eax, eax
je 0x100b1806
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b1806
mov eax, dword [0x101f3028]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push str.__skin__s_
push eax
mov byte [ebp - 4], 6
call fcn.10004662
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
call fcn.1000e791
lea ecx, [ebp - 0x14]
call fcn.10003b75
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.10003b75
mov esi, dword [ebp + 0xc]
cmp dword [esi - 8], 0
je 0x100b1832
push dword [ebp + 0x10]
push dword [ebp + 8]
push esi
call fcn.10095ce3
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.10003b75
lea ecx, [ebp + 0xc]
call fcn.10003b75
call fcn.10145e58
ret

Function at 0x100b1f4a
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x10189dfa
call fcn.10145d80
mov esi, ecx
call fcn.100b1bf5
test eax, eax
jne 0x100b1f92
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.100b10b4
push dword [ebp - 0x14]
and dword [ebp - 4], 0
call fcn.1011c944
test eax, eax
pop ecx
je 0x100b1f86
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x14]
call fcn.10003b75
xor eax, eax
jmp 0x100b1ff4
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x100b1fdc
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x101f84e8
call fcn.100500f9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.10004076
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [esi + 0x4c]
push eax
push 0x7c
push dword [ebp - 0x10]
call fcn.1012191c
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10003b75
cmp dword [esi + 0x54], 0
jle 0x100b1ff1
mov ecx, esi
call fcn.100afca3
neg eax
sbb eax, eax
neg eax
jmp 0x100b1ff4
xor eax, eax
inc eax
call fcn.10145e58
ret
Function at 0x100b24a0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xc
mov eax, 0x10189ef4
call fcn.10145d80
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], 0x1019f514
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi], fcn.100afbd0
mov dword [esi + 4], 0x101af048
mov dword [esi + 8], 0x101af038
mov dword [esi + 0x48], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov eax, dword [0x101f3028]
mov dword [esi + 0x58], eax
mov eax, dword [0x101f3028]
mov dword [esi + 0x5c], eax
mov eax, dword [0x101f3028]
mov dword [esi + 0x70], eax
mov eax, dword [0x101f3028]
mov dword [esi + 0x74], eax
mov edi, 0x101f84e8
mov ecx, edi
mov byte [ebp - 4], 5
mov dword [esi + 0x80], ebx
call fcn.100547a8
imul eax, eax, 0x3e8
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
mov dword [esi + 0x8c], ebx
call fcn.100500f9
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10004076
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [esi + 0x4c]
push eax
push 0x7c
push dword [ebp - 0x10]
call fcn.1012191c
add esp, 0xc
mov ecx, edi
call fcn.100546b8
mov dword [esi + 0x6c], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.1004ffdb
push eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 7
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.10003b75
mov ecx, edi
call fcn.1005459e
mov ecx, edi
mov dword [esi + 0x60], eax
call fcn.100545c8
test eax, eax
je 0x100b25b8
mov ecx, edi
call fcn.10054669
test eax, eax
jne 0x100b25b8
inc eax
jmp 0x100b25ba
xor eax, eax
mov dword [esi + 0x64], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.1005006a
push eax
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 8
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.10003b75
mov ecx, edi
call fcn.1005461a
mov dword [esi + 0x68], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.1004ff4c
push eax
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 9
call fcn.10007845
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.10003b75
mov ecx, edi
call fcn.10054489
mov ecx, edi
mov dword [esi + 0x78], eax
call fcn.1005452a
mov edi, 0x101f928c
push edi
mov dword [esi + 0x7c], eax
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x3c], 0x1770
cmp dword [0x101f9288], ebx
jne 0x100b2686
push 0x101f9288
push 4
push esi
push 0x100b1ffa
push ebx
push ebx
call fcn.10147cdf
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x100b2686
push 0x4000
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov eax, esi
call fcn.10145e58
ret
Function at 0x100b269d
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 0x18
mov eax, 0x10189f27
call fcn.10145d80
call fcn.100b1848
test eax, eax
jne 0x100b26ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x230
leave
ret
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x101f84e8
call fcn.100500f9
mov eax, dword [ebp - 0x14]
xor edi, edi
cmp dword [eax - 8], edi
mov dword [ebp - 4], edi
jne 0x100b2717
xor edi, edi
inc edi
lea ecx, [ebp - 0x14]
call fcn.10003b75
mov eax, edi
jmp 0x100b26ca
lea ecx, [ebp - 0x14]
call fcn.10004076
push dword [ebp - 0x14]
mov esi, dword [sym.imp.USER32.dll_CharLowerW]
call esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x24]
push eax
push 0x7c
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1012191c
add esp, 0xc
push edi
push 2
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100b276f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
call fcn.100af9c6
jmp 0x100b270b
lea eax, [ebp]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007b11
mov byte [ebp - 4], 2
jmp 0x100b27d7
lea ecx, [ebp - 0x10]
call fcn.10004076
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
call fcn.100afa2e
cmp eax, 0xffffffff
jne 0x100b27f0
lea eax, [ebp]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000425b
push dword [ebp - 0x10]
push str.ExeName:_s_n
push 0xe
call fcn.10104e0d
add esp, 0xc
cmp dword [ebp - 0x18], edi
jne 0x100b278e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.10003b75
jmp 0x100b2765
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x24]
call fcn.100af9c6
jmp 0x100b2708
Function at 0x100bac0d
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.mspaint
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
ret

Function at 0x100bac40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
push dword [esp + 0xc]
xor edi, edi
mov esi, ecx
inc edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100bac76
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x100bac6e
push dword [esi + 0x3c]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x100bac70
xor edi, edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x100bd9cb
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xc
mov eax, 0x1018b115
call fcn.10145d80
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.100111ce
mov ecx, edi
call fcn.10036ba9
mov eax, dword [edi]
mov ecx, dword [eax - 8]
xor esi, esi
inc esi
cmp ecx, esi
jge 0x100bda02
push 0x101afe20
mov ecx, edi
call fcn.1000425b
jmp 0x100bda46
cmp ecx, 0x64
jle 0x100bda46
movzx eax, word [eax + 0xc6]
cmp ax, 0x80
mov ecx, edi
lea eax, [ebp - 0x10]
jbe 0x100bda27
push 0x63
push eax
call fcn.10011725
and dword [ebp - 4], 0
jmp 0x100bda32
push 0x64
push eax
call fcn.10011725
mov dword [ebp - 4], esi
push eax
mov ecx, edi
call fcn.10007845
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov esi, 0x1019f188
push esi
push 0x101a0098
mov ecx, edi
call fcn.10011220
push esi
push 0x1019fce4
mov ecx, edi
call fcn.10011220
push esi
push 0x101a05b8
mov ecx, edi
call fcn.10011220
push esi
push 0x101a34a8
mov ecx, edi
call fcn.10011220
push esi
push 0x101a3498
mov ecx, edi
call fcn.10011220
push esi
push 0x1019fe48
mov ecx, edi
call fcn.10011220
push esi
push 0x101a4288
mov ecx, edi
call fcn.10011220
push esi
push 0x101a4294
mov ecx, edi
call fcn.10011220
push esi
push 0x101a02c8
mov ecx, edi
call fcn.10011220
lea eax, [ebp - 0x10]
push eax
call fcn.1011de11
mov dword [esp], str.screenshot_
push eax
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], 2
call fcn.10007b6e
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10003b75
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100bdb11
mov esi, dword [ebp + 8]
mov ecx, 0x101f8c68
call fcn.10016a0b
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100100f8
push str..png
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 5
call fcn.10007b6e
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.10007845
lea ecx, [ebp - 0x14]
call fcn.10003b75
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp + 8]
call fcn.10003b75
xor eax, eax
call fcn.10145e58
ret
Function at 0x100be6ee
Capabilities:
Capture webcam image

Disassembly:
push 8
mov eax, 0x1018b25e
call fcn.10145d80
mov esi, ecx
lea edi, [esi + 4]
push 0
mov ecx, edi
call fcn.1000e570
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x41a
push dword [edi]
call ebx
lea ecx, [esi + 0x24]
push eax
call fcn.1002de5e
push 0x101
mov dword [esi + 0x78], 4
push dword [edi]
call ebx
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
push 0x7f04
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_LoadIconW]
lea edi, [esi + 0x80]
push eax
mov ecx, edi
call fcn.10056c44
cmp dword [edi], ebx
jne 0x100be764
push ebx
mov ecx, edi
call fcn.10056c44
mov dword [ebp - 0x10], ebx
push ebx
push dword [edi]
push 0x170
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x101f84e8
add esi, 0x20
call fcn.10054f0a
push ebx
push esi
push 0x419
mov ecx, esi
mov dword [esi], eax
call fcn.100bb9ee
xor eax, eax
call fcn.10145e58
ret 0x10
Function at 0x100c11ec
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, ecx
push dword [edi + 0x158]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100c1229
mov ecx, dword [esp + 8]
push esi
mov esi, 0x100
push esi
call fcn.1000401e
push esi
push eax
push dword [edi + 0x158]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
call fcn.100041f7
pop esi
pop edi
ret 4

Function at 0x100c18f3
Capabilities:
Get graphical window text

Disassembly:
push 0x28
mov eax, 0x1018b629
call fcn.10145d80
mov ebx, ecx
lea esi, [ebx + 0x1c0]
push esi
lea ecx, [ebp - 0x18]
call fcn.10007ade
mov eax, dword [0x101f3028]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
push 0x401
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000401e
push 0x400
push eax
push dword [ebx + 0x158]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100041f7
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.10007845
push dword [ebp - 0x18]
push dword [esi]
call fcn.10005373
test eax, eax
pop ecx
pop ecx
je 0x100c1a5e
mov esi, 0x101a4d60
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
lea esi, [ebx + 0x38]
push eax
mov ecx, esi
call fcn.1004b7ae
mov eax, dword [esi + 4]
push esi
push eax
lea ecx, [ebp - 0x24]
call fcn.1004aacb
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x24]
call fcn.1004a1ed
test al, al
jne 0x100c1a58
lea ecx, [ebp - 0x34]
call fcn.1004a2aa
mov edi, dword [eax + 0x10]
test edi, edi
je 0x100c1a58
mov eax, dword [edi + 4]
push edi
push eax
lea ecx, [ebp - 0x24]
call fcn.1004aaef
mov eax, dword [edi + 8]
push edi
push eax
jmp 0x100c1a3c
lea ecx, [ebp - 0x24]
call fcn.1004a218
cmp dword [eax], 0
je 0x100c1a30
lea ecx, [ebp - 0x24]
call fcn.1004a218
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.1004aa3a
mov esi, dword [ebp - 0x14]
test esi, esi
mov byte [ebp - 4], 2
je 0x100c1a22
push dword [ebx + 0x1c0]
lea ecx, [ebp - 0x1c]
call fcn.10005f82
push dword [ebx + 0x20]
mov eax, dword [eax]
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 3
call dword [ecx + 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x14]
test esi, esi
mov byte [ebp - 4], 1
je 0x100c1a30
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [ebp - 0x24]
call fcn.1004a239
push edi
push dword [edi + 8]
lea ecx, [ebp - 0x34]
call fcn.1004aaef
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x34]
call fcn.1004a25d
test al, al
je 0x100c19ce
mov eax, dword [ebx]
push ebx
call dword [eax + 0x54]
mov eax, dword [ebp + 0x14]
and dword [eax], 0
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x18]
call fcn.10003b75
xor eax, eax
call fcn.10145e58
ret 0x10