joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1071a84
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x111121c]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp byte [esi + 0x3c], bl
mov dword [ebp - 4], eax
mov dword [ebp - 0x518], ebx
je 0x1071ab2
mov eax, 0x8000ffff
jmp 0x1071c20
push edi
push esi
push 0x10028c4
push 1
push ebx
push 0x10028d4
mov byte [esi + 0x3c], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x1071c06
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jl 0x1071c06
xor eax, eax
lea edi, [ebp - 0x530]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
push 1
lea edx, [ebp - 0x530]
push edx
mov dword [ebp - 0x530], 0x14
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov edi, eax
cmp edi, ebx
jl 0x1071c06
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x1071b40
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
jne 0x1071b6d
call sub.WSOCK32.dll_WSAGetLastError
test eax, eax
jg 0x1071b55
call sub.WSOCK32.dll_WSAGetLastError
mov edi, eax
jmp 0x1071c06
call sub.WSOCK32.dll_WSAGetLastError
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x1071c06
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 0x123e
mov dword [ebp - 0x110], eax
mov word [ebp - 0x114], 2
call sub.WSOCK32.dll_htons
push 1
lea edx, [ebp - 0x518]
push edx
push 0x36ee80
push 1
push 0x10
mov word [ebp - 0x112], ax
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push edx
push eax
call dword [ecx + 0x18]
mov edi, eax
cmp edi, ebx
jl 0x1071c06
push ebx
push ebx
push ebx
lea edx, [ebp - 0x51c]
push edx
lea edx, [ebp - 0x514]
xor eax, eax
push edx
push dword [ebp - 0x518]
mov ecx, 0x100
lea edi, [ebp - 0x514]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov dword [ebp - 0x51c], 0x400
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov edi, eax
cmp edi, ebx
jl 0x1071c06
mov eax, dword [ebp - 0x510]
mov dword [esi + 0x38], eax
mov byte [esi + 4], 1
cmp dword [ebp - 0x518], ebx
je 0x1071c1d
mov esi, dword [esi]
mov eax, dword [esi]
push ebx
push dword [ebp - 0x518]
push esi
call dword [eax + 0x20]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0105ec09
leave
ret
Function at 0x1073413
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
mov dword [ebp - 4], 0x80004005
jne 0x10734c1
push 0x100d45c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x10734bb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100d444
push eax
call edi
push 0x100d438
push dword [esi + 0xc]
mov dword [esi + 0x20], eax
call edi
push 0x100d428
push dword [esi + 0xc]
mov dword [esi + 0x24], eax
call edi
push 0x100d418
push dword [esi + 0xc]
mov dword [esi + 0x28], eax
call edi
push 0x100d408
push dword [esi + 0xc]
mov dword [esi + 0x2c], eax
call edi
push 0x100d3f8
push dword [esi + 0xc]
mov dword [esi + 0x30], eax
call edi
push 0x100d3e8
push dword [esi + 0xc]
mov dword [esi + 0x34], eax
call edi
push 0x100d3d8
push dword [esi + 0xc]
mov dword [esi + 0x38], eax
call edi
push 0x100d3c4
push dword [esi + 0xc]
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x40], eax
pop edi
mov dword [esi], 1
cmp dword [esi + 0x20], ebx
je 0x10734f1
cmp dword [esi + 0x24], ebx
je 0x10734f1
cmp dword [esi + 0x34], ebx
je 0x10734f1
cmp dword [esi + 0x38], ebx
je 0x10734f1
cmp dword [esi + 0x3c], ebx
je 0x10734f1
cmp dword [esi + 0x40], ebx
je 0x10734f1
cmp dword [esi + 0x28], ebx
je 0x10734f1
cmp dword [esi + 0x2c], ebx
je 0x10734f1
cmp dword [esi + 0x30], ebx
je 0x10734f1
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x10833fc
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x100598c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x108341e
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 8
je 0x108341e
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x108482a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ecx + 0xc], ebx
mov dword [ebp - 4], ecx
jne 0x108483f
xor eax, eax
jmp 0x108488c
push esi
lea esi, [ecx + 0x24]
cmp dword [esi], ebx
jne 0x1084889
push edi
push 0x34
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x108485f
mov ecx, eax
call fcn.01084696
mov edi, eax
jmp 0x1084861
xor edi, edi
cmp edi, ebx
mov dword [esi], edi
je 0x1084888
push ebx
push ebx
push dword [ebp - 4]
push 0x108429a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
mov eax, dword [esi]
cmp dword [eax], ebx
jne 0x1084888
mov ecx, esi
call fcn.0108480e
pop edi
mov eax, dword [esi]
pop esi
pop ebx
leave
ret

Function at 0x108535a
Capabilities:
Log keystrokes via application hook

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push edi
mov edi, dword [0x1112f44]
push 0
push edi
push 0x10852c0
push 0xe
call esi
push 0
push edi
push 0x108528f
push 0xd
mov dword [0x11140ac], eax
call esi
push 0x11140b4
mov dword [0x11140b0], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
pop edi
pop esi
ret
Function at 0x108ea8a
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [esi + 0x698]
cmp byte [eax], 0
jne 0x108ead6
push ebx
mov ebx, dword [esi + 0x28]
push edi
mov edi, dword [esi + 0x24]
and dword [esi + 0x24], 0
mov byte [eax], 1
mov eax, dword [esi + 4]
test eax, eax
je 0x108eabc
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x108eac6
push dword [ebp + 8]
push ebx
call edi
cmp dword [esi + 4], 0
pop edi
pop ebx
je 0x108ead6
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
pop ebp
ret 4

Function at 0x108eaf6
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [0x11141ec]
test ecx, ecx
je 0x108eb46
mov eax, dword [ecx + 4]
test eax, eax
je 0x108eb46
push esi
push edi
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, eax
mov edi, dword [esi + 0x24]
test edi, edi
je 0x108eb2e
and dword [esi + 0x24], 0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [esi + 0x28]
call edi
push 2
mov ecx, esi
call fcn.0108ea8a
mov ecx, dword [0x11141ec]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x108eb09
pop edi
pop esi
ret
Function at 0x108eb99
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [esi], eax
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x108ecae
push eax
push 0x10147ac
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
mov dword [ebp + 8], eax
je 0x108ecae
lea eax, [ebp - 0x14]
push eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
call ebx
test eax, eax
je 0x108ecae
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
je 0x108ecae
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
mov ebx, ecx
sub ebx, edx
cmp ebx, eax
jl 0x108ec7f
cmp dword [0x1113538], 0
push 2
je 0x108ec30
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, dword [ebp - 0x14]
mov dword [esi], eax
jmp 0x108ec40
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [edi + 0x30]
sub ecx, eax
mov dword [esi], ecx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jl 0x108ec62
mov eax, dword [ebp - 0x20]
sub eax, dword [edi + 0x34]
sub eax, dword [0x11141e8]
mov dword [esi + 4], eax
jns 0x108ecae
mov dword [ebp - 4], 1
jmp 0x108ecae
mov ecx, dword [0x11141e8]
add ecx, eax
mov dword [esi + 4], ecx
sub eax, dword [edi + 0x34]
xor edx, edx
inc edx
cmp eax, ecx
jle 0x108ec7a
mov dword [ebp - 4], edx
mov dword [edi + 0x3c], edx
jmp 0x108ecae
mov eax, dword [ebp - 8]
sub eax, dword [edi + 0x34]
sub eax, dword [0x11141e8]
mov dword [esi + 4], eax
jns 0x108ec97
mov dword [ebp - 4], 1
cmp edx, dword [ebp - 0x14]
jle 0x108ecac
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [edi + 0x30]
sub ecx, eax
mov dword [esi], ecx
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop esi
sete al
pop ebx
leave
ret 4
Function at 0x109181b
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], 1
mov al, byte [esi + 0x30]
xor ebx, ebx
or edi, 0xffffffff
test al, al
setne bl
xor ecx, ecx
cmp dword [esi + 0x28], ecx
je 0x109187d
test al, al
je 0x109184b
mov ecx, esi
call fcn.010916bd
jmp 0x1091878
cmp dword [esi + 0x14], ecx
jne 0x1091860
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x14], eax
mov edi, 0xea60
jmp 0x1091878
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x14]
mov ecx, 0xea60
mov edx, ecx
sub edx, eax
cmp eax, ecx
sbb edi, edi
and edi, edx
xor ebx, ebx
inc ebx
jmp 0x1091880
mov dword [esi + 0x14], ecx
push 8
push edi
push 0
lea eax, [esi + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
sub eax, 0
je 0x10918aa
dec eax
je 0x10918b8
sub eax, 0x7f
je 0x10918af
sub eax, 0x82
jne 0x10918c2
mov byte [esi + 0x30], 1
jmp 0x10918af
cmp ebx, 1
jne 0x10918b8
mov ecx, esi
call fcn.010916bd
jmp 0x10918bf
mov ecx, esi
call fcn.010917b1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x109182a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1091932
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x109194c
xor eax, eax
jmp 0x1091aac
push edi
push 0x10157c0
push ebx
push ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi], eax
je 0x1091a33
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x1091a33
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 2
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [esi]
mov dword [ebp - 0x18], eax
push eax
call edi
test eax, eax
je 0x1091a26
push 2
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x1091a26
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x10919dd
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], esi
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [ebp - 0xc], eax
jmp 0x10919e0
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jne 0x10919ee
mov dword [ebp - 0x10], 0x8007000e
jmp 0x1091a26
lea eax, [esi + 8]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
push 0x10918d8
push ebx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x1091a26
push 0x7d0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1091a26
mov byte [esi + 0xc], 1
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x1091a39
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0xc], bl
jne 0x1091aa8
cmp dword [ebp - 0x10], ebx
jl 0x1091a68
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1091a55
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1091a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x1091a73
push eax
call edi
mov dword [esi], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1091a80
push eax
call edi
mov dword [esi + 4], ebx
cmp dword [ebp - 4], ebx
je 0x1091a8d
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x1091a9a
push dword [ebp - 8]
call edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x1091aa8
push 1
call fcn.0109152a
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x109531a
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0105efd0
mov eax, dword [0x111121c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0xe
pop ecx
mov dword [ebp - 0x1008], eax
xor eax, eax
lea edi, [ebp - 0x1040]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1044]
push eax
mov edi, 0x10000000
push edi
xor ebx, ebx
push ebx
push edx
mov dword [ebp - 0x1044], 0x3c
mov word [ebp - 0x804], bx
mov dword [ebp - 0x1030], 0x3ff
call esi
test eax, eax
je 0x1095438
and word [ebp - 0x1004], bx
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1044]
push eax
push edi
push ebx
push dword [ebp - 0x1008]
mov dword [ebp - 0x1030], 0x3ff
call esi
test eax, eax
je 0x1095438
xor esi, esi
cmp word [ebp - 0x804], si
lea eax, [ebp - 0x1004]
lea ecx, [ebp - 0x804]
je 0x10953f4
mov edx, dword [ebp - 0x804]
cmp dx, 0x2e
je 0x10953f4
inc ecx
inc ecx
mov dx, word [ecx]
cmp dx, si
jne 0x10953e4
cmp word [ecx], si
jne 0x10953ff
lea ecx, [ebp - 0x804]
cmp word [ebp - 0x1004], si
je 0x109541e
mov edx, dword [ebp - 0x1004]
cmp dx, 0x2e
je 0x109541e
inc eax
inc eax
mov dx, word [eax]
cmp dx, si
jne 0x109540e
cmp word [eax], si
jne 0x1095429
lea eax, [ebp - 0x1004]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0105ec09
leave
ret 8
Function at 0x1097562
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x34], 0
pop esi
ret

Function at 0x109838f
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
push edi
or edi, 0xffffffff
test eax, eax
mov dword [ebp - 4], 1
mov ebx, edi
jl 0x10983b9
mov ecx, dword [esi + 0x4c]
cdq
idiv ecx
mov ebx, eax
mov edi, edx
mov eax, dword [ebp + 8]
sub eax, 0xd
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
je 0x1098414
sub eax, 0xe
je 0x109840b
sub eax, 5
je 0x1098414
sub eax, 5
je 0x1098402
dec eax
je 0x10983f9
dec eax
je 0x10983ef
dec eax
je 0x10983e5
and dword [ebp - 4], 0
jmp 0x1098461
inc ebx
cmp ebx, dword [esi + 0x50]
jne 0x109842d
xor ebx, ebx
jmp 0x109842d
inc edi
cmp edi, dword [esi + 0x4c]
jne 0x1098432
xor edi, edi
jmp 0x1098432
dec ebx
jns 0x109842d
mov ebx, dword [esi + 0x50]
dec ebx
jmp 0x109842d
dec edi
jns 0x1098432
mov edi, dword [esi + 0x4c]
dec edi
jmp 0x1098432
mov ecx, esi
call fcn.01097562
jmp 0x1098461
mov ecx, esi
call fcn.01097ffc
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.01097562
cmp ebx, dword [ebp - 8]
jne 0x1098437
cmp edi, dword [ebp - 0xc]
je 0x1098461
cmp ebx, 0xffffffff
je 0x109844b
cmp edi, 0xffffffff
je 0x109844b
cmp ebx, dword [esi + 0x50]
jge 0x109844b
cmp edi, dword [esi + 0x4c]
jl 0x109844f
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x4c]
imul eax, ebx
push 0
add eax, edi
push eax
mov ecx, esi
call fcn.010977c1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x109af8e
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
add ecx, 0xfffffff4
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x6c]
test esi, esi
je 0x109afb5
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8
Function at 0x109cff7
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x111121c]
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
mov eax, dword [esi + 0xe0c]
neg eax
sbb eax, eax
push edi
and eax, 5
push eax
push dword [esi + 0x1e28]
call ebx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x2b4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
xor edi, edi
push edi
push eax
call dword [ecx + 0x9c]
test eax, eax
jge 0x109d0b8
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x2b4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
push 1
push eax
call dword [ecx + 0x9c]
test eax, eax
jge 0x109d0b8
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x2b4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
push 2
push eax
call dword [ecx + 0x9c]
test eax, eax
jge 0x109d0b8
push edi
push dword [esi + 0x1e2c]
call ebx
mov eax, dword [esi + 0xe0c]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x1e30]
jmp 0x109d22d
mov eax, dword [0x1113528]
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x14b
push dword [esi + 0x1e2c]
add eax, 0x74
mov dword [ebp - 0x420], eax
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x9d6d
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x109d13b
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x9d69
mov ecx, esi
call fcn.0109ce78
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x9d6a
mov ecx, esi
call fcn.0109ce78
lea eax, [ebp - 0x20c]
push eax
push 2
push 0x9d6b
mov ecx, esi
call fcn.0109ce78
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x9d7c
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x109d20f
lea eax, [ebp - 0x414]
push eax
push 0
push 0x143
push dword [esi + 0x1e2c]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x418], eax
je 0x109d20f
push 0xffffffffffffffff
push eax
push 0x151
push dword [esi + 0x1e2c]
call edi
mov eax, dword [esi + 0x1e38]
cmp eax, 0xfffffffe
jne 0x109d1f5
push 0
push 0
push 0x147
push dword [esi + 0x1e2c]
call edi
mov ecx, dword [ebp - 0x420]
push 0xffffffffffffffff
push 0x1017720
mov dword [ebp - 0x41c], eax
call fcn.01063ebe
cmp dword [ebp - 0x41c], 0xffffffff
je 0x109d1d7
cmp eax, 0xffffffff
jne 0x109d20f
push 0
push dword [ebp - 0x418]
push 0x14e
push dword [esi + 0x1e2c]
call edi
or dword [esi + 0x1e38], 0xffffffff
jmp 0x109d20f
cmp eax, 0xffffffff
jne 0x109d20f
push 0
push dword [ebp - 0x418]
push 0x14e
push dword [esi + 0x1e2c]
call edi
push 0
push dword [esi + 0x1e30]
call ebx
mov eax, dword [esi + 0xe0c]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x1e2c]
call ebx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105ec09
leave
ret
Function at 0x109dfa4
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x34], eax
je 0x109e0c6
push ebx
xor ebx, ebx
push edi
lea edi, [esi + 0x344]
inc ebx
cmp dword [edi], eax
jne 0x109e088
cmp dword [esi + 0x1dc4], eax
jne 0x109dfda
call fcn.0109c329
mov eax, dword [esi + 0x358]
push ebx
add eax, 0xac
push 0x9cdb
lea ecx, [esi + 0x30]
mov dword [edi], ebx
mov dword [esi + 0x350], eax
call fcn.0109d53a
mov eax, dword [0x1114294]
push ebx
mov ecx, esi
mov dword [esi + 0x1dd0], eax
call fcn.0109c3a6
mov ecx, dword [esi + 0x28]
call fcn.010a6e34
mov eax, dword [esi + 0x1dfc]
test eax, eax
je 0x109e054
mov ecx, dword [esi + 0x1df4]
push 0x105
push 0x12
push 0x64
add ecx, 3
push ecx
mov ecx, dword [esi + 0x1df0]
sub ecx, 0x64
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [esi + 0x1dfc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0109cd29
mov eax, dword [esi + 0x34c]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x1dd0]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x1dd4]
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x1dec]
mov edx, dword [esi + 0x1df4]
mov ecx, dword [esi + 0x1de8]
sub edx, eax
push edx
mov edx, dword [esi + 0x1df0]
sub edx, ecx
push edx
push eax
push ecx
push dword [esi + 8]
mov ecx, dword [esi + 0x1b28]
call fcn.0109c241
mov ecx, dword [esi + 0x1b28]
push ebx
push 0xc
call fcn.0109c269
pop edi
pop ebx
pop esi
leave
ret

Function at 0x109f23e
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 0x1dc4], 0
je 0x109f24c
jmp fcn.0109c368
jmp fcn.0109c329

Function at 0x109fb0f
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push eax
push eax
push 0x87
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 2
jne 0x109fb70
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ah, ah
js 0x109fb6f
push 0x10
call esi
and eax, 0x8000
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
push dword [ebx + 0x2614]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
test eax, eax
je 0x109fb68
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 4], 1
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4