joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
add esp, 4
jmp 0x1003552b
Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call sym.ScCore.dll_public:_void___thiscall_ScCore::FileWrapper::constructor_class_ScCore::String_const___bool_
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x35e35e27
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x397c5715
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2c9f0422
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7425bda
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1000bc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000bc7f
pop dword [ebp - 0x50]
mov eax, 0x1000bc7f
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xf336ced1
add dword [ebp - 0x60], 0x5b1b767a
mov dword [ebp - 0x5c], 0xd6cab793
sub dword [ebp - 0x5c], 0xa4976b4e
mov dword [ebp - 0x58], 0xc4920e4c
sub dword [ebp - 0x58], 0x7845ca1e
mov dword [ebp - 0x54], 0xb5e6442a
sub dword [ebp - 0x54], 0xb5e6442a
lea eax, [ebp - 0x60]
push eax
mov eax, 0x175bb7f5
sub eax, 0x75517bd
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4ab92fc0
add dword [ebp - 0x60], 0x29b93996
mov dword [ebp - 0x5c], 0xa24404dd
sub dword [ebp - 0x5c], 0x60d7a368
mov dword [ebp - 0x58], 0x4e920ac5
sub dword [ebp - 0x58], 0xeb229e59
mov dword [ebp - 0x54], 0xf08dc8d3
sub dword [ebp - 0x54], 0xf08dc8d3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x4658f21b
sub eax, 0x365251df
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x45eeb
push 0
call eax
mov ecx, 0xfe1046f8
add ecx, 0x1f00421
mov edx, eax
mov ebx, 0x100a3400
add ebx, dword [ebp - 0x50]
mov esi, 0xde7ba145
add dword [ebp - 0x24], eax
mov edi, dword [ebx]
add dword [ebp - 0x1c], 0x9b6b873c
sub edi, esi
xor dword [ebp - 0x40], 0x20b4073b
mov dword [edx], edi
xor dword [ebp - 0x24], edx
add edx, 0x6d52ddab
add edx, 0x92ad2259
add ebx, 0xde128b94
sub ebx, 0xde128b90
loop 0x1000bd90
add eax, 0x11f37
mov ebx, eax
add eax, 0x3c5dea94
add eax, 0xc3a21571
mov ecx, 0xacdcd5f5
add ecx, 0x63232a0b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1002a7a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
push edi
push ebx
add ecx, 0xec
call dword [0x1006a19c]
push str.JSINCLUDE
call dword [sym.imp.msvcr100.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x1002a801
cmp byte [edi], 0
je 0x1002a801
mov ecx, ebx
call dword [sym.imp.ScCore.dll_public:_int___thiscall_ScCore::String::length_void_const]
test eax, eax
je 0x1002a7f1
mov ecx, dword [esi + 8]
push 0x3a
add ecx, 0xec
call dword [0x1006a2a4]
mov ecx, dword [esi + 8]
push edi
add ecx, 0xec
call dword [0x1006a2c4]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10033280
Capabilities:
Get number of processors

Disassembly:
mov dword [ecx], vtable.jsEngine.0
jmp fcn.10018120
Function at 0x10037280
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100647d9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10094144]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Root::constructor_void_]
mov edi, dword [ebp + 8]
mov dword [esi], vtable.ScScript::Node.0
mov dword [esi + 4], 0
mov eax, dword [edi]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x24]
mov dword [esi + 0xc], ecx
mov edx, dword [edi + 0x28]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x18], ecx
mov eax, dword [edi + 0x1c]
mov dword [ebp - 4], 0
mov dword [esi + 0x1c], eax
cmp eax, 4
jl 0x1003731f
cmp eax, 6
jg 0x1003731f
push 0x18
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100373ba
add edi, 4
push edi
mov ecx, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_class_ScCore::Variant_const__]
jmp 0x100373bc
mov eax, dword [esi + 8]
cmp eax, 0x44
je 0x10037398
cmp eax, 0x55
je 0x10037357
cmp eax, 0x64
jne 0x100373bf
push 0x18
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x100373ba
push 1
mov ecx, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_bool_]
jmp 0x100373bc
push 0x18
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10037386
mov ecx, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov ecx, eax
mov byte [ebp - 4], 0
mov dword [esi + 4], eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setNull_void_]
jmp 0x100373bf
xor eax, eax
mov ecx, eax
mov byte [ebp - 4], al
mov dword [esi + 4], eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setNull_void_]
jmp 0x100373bf
push 0x18
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x100373ba
push 0
mov ecx, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_bool_]
jmp 0x100373bc
xor eax, eax
mov dword [esi + 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1005c13a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10094144]
jne 0x1005c144
repz ret
jmp fcn.1005c74e
Function at 0x401200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x876160]
mov ecx, dword [0x8750b4]
shr eax, 3
sub esp, 0x81c
test eax, eax
jbe 0x4012f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x876160], 0x959
jne 0x4012d6
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push str.genoy_lakiluwobiyevopodajerunopixozo
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
lea eax, [ebp - 0x81c]
push eax
push 0
push str.lutaxigivikijiter_fomodukinijabujofasijokiyatomot_weruvufayunuxefaxasit
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
push 0
push str.mumocire_lanabujegepuxigidurira
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
push edx
call fcn.00401020
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402540
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4560c8]
jne 0x40254a
repz ret
jmp fcn.00405ede

Function at 0x405b0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402fc9
and dword [ebp - 4], 0
cmp dword [0x457b28], 0
mov ebx, eax
jne 0x405bbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405c6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405c6d
push eax
call fcn.00402f57
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x457b28], eax
call esi
push eax
call fcn.00402f57
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x457b2c], eax
call esi
push eax
call fcn.00402f57
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x457b30], eax
call esi
push eax
call fcn.00402f57
pop ecx
mov dword [0x457b38], eax
test eax, eax
je 0x405bbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402f57
pop ecx
mov dword [0x457b34], eax
mov eax, dword [0x457b34]
cmp eax, ebx
je 0x405c14
cmp dword [0x457b38], ebx
je 0x405c14
push eax
call fcn.00402fd2
push dword [0x457b38]
mov esi, eax
call fcn.00402fd2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405c14
test edi, edi
je 0x405c14
call esi
test eax, eax
je 0x405c0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405c0b
test byte [ebp - 0xc], 1
jne 0x405c14
or dword [ebp + 0x10], 0x200000
jmp 0x405c4d
mov eax, dword [0x457b2c]
cmp eax, ebx
je 0x405c4d
push eax
call fcn.00402fd2
pop ecx
test eax, eax
je 0x405c4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405c4d
mov eax, dword [0x457b30]
cmp eax, ebx
je 0x405c4d
push eax
call fcn.00402fd2
pop ecx
test eax, eax
je 0x405c4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x457b28]
call fcn.00402fd2
pop ecx
test eax, eax
je 0x405c6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405c6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10010cdf
pop dword [ebp - 0x4c]
mov eax, 0x10010cdf
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x6c97440d
add dword [ebp - 0x5c], 0xe1bb013e
mov dword [ebp - 0x58], 0x670c7c44
sub dword [ebp - 0x58], 0x34d92fff
mov dword [ebp - 0x54], 0x42beb965
sub dword [ebp - 0x54], 0xf6727537
mov dword [ebp - 0x50], 0x28321bf4
add dword [ebp - 0x50], 0xd7cde40c
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x6915b59d
sub eax, 0x59136519
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xa0b3af69
add dword [ebp - 0x5c], 0xd3beb9ed
mov dword [ebp - 0x58], 0x1c5ea2ab
add dword [ebp - 0x58], 0x250dbeca
mov dword [ebp - 0x54], 0x91da0366
sub dword [ebp - 0x54], 0x2e6a96fa
mov dword [ebp - 0x50], 0xdabd52d6
sub dword [ebp - 0x50], 0xdabd52d6
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x26a09142
add eax, 0xe961bf3a
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3db87
push 0
call eax
mov ecx, 0x49a8c7ec
sub ecx, 0x49a876cb
mov esi, eax
mov edi, 0x87b58187
add edi, 0x884d8a79
add edi, dword [ebp - 0x4c]
mov ebx, 0x69372d4b
sub ebx, 0x604df03c
mov edx, dword [edi]
add dword [ebp - 8], ebx
add edx, ebx
xor dword [ebp - 0x24], 0x4e452990
mov dword [esi], edx
sub dword [ebp - 0x20], 0x2f5bc13
add esi, 4
add edi, 0x1a53fd74
add edi, 0xe5ac0290
loop 0x10010dfc
add eax, 0x684390e1
sub eax, 0x6842598a
mov ebx, eax
add eax, 0xf7d6e3c1
add eax, 0x8291c44
mov ecx, 0xceab9f6f
sub ecx, 0xbeab9f6f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10

Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8