joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10bb3b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x150
mov eax, dword [str.win.ini]
mov edx, dword [0x10df39b4]
push ebx
push esi
push edi
mov ecx, 7
mov esi, str.Control_PanelInternational
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x10df39b0]
mov dword [esp + 0x20], eax
mov al, byte [0x10df39b8]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], al
call fcn.10bd19f0
mov ebx, dword [sym.imp.MSVCRT.dll__mbscpy]
test eax, eax
je 0x10bb3bcf
lea ecx, [esp + 0x50]
push 0x10df39bc
push ecx
call ebx
add esp, 8
jmp 0x10bb3bf5
mov edi, 0x10df39c4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x50]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10bd19f0
test eax, eax
je 0x10bb3c0f
lea ecx, [esp + 0x64]
push 0x10df39cc
push ecx
call ebx
add esp, 8
jmp 0x10bb3c35
mov edi, 0x10df39d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x50]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x78]
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
lea edx, [esp + 0x50]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea edx, [esp + 0x28]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x64]
push edx
mov dword [esp + 0x2c], reloc.oledlg.dll_OleUIAddVerbMenuA
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x50], ecx
call fcn.10bb3dc0
mov al, byte [esp + 0xc]
lea ecx, [esp + 0xc]
cmp al, 0x27
lea eax, [esp + 0xc]
push eax
push ecx
jne 0x10bb3cad
push 0x10df39d4
jmp 0x10bb3cb2
push 0x10df39e8
lea edx, [esp + 0xa0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x94]
lea ecx, [esp + 0xf8]
push 0x63
push eax
push ecx
call sym.PBVM90.dll_shformatCmplDateTimeMask
test eax, eax
jne 0x10bb3d3e
mov cl, byte [esp + 0xf8]
lea edx, [esp + 0xf8]
test cl, cl
je 0x10bb3d34
mov edi, dword [esp + 0x164]
mov esi, dword [esp + 0x160]
cmp cl, 0x1d
je 0x10bb3d0e
cmp cl, 0x1c
je 0x10bb3d0e
dec edi
je 0x10bb3d22
mov byte [esi], cl
inc esi
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x10bb3cfe
mov byte [esi], cl
pop edi
pop esi
pop ebx
add esp, 0x150
ret
mov eax, 1
mov byte [esi], 0
pop edi
pop esi
pop ebx
add esp, 0x150
ret
mov esi, dword [esp + 0x160]
mov byte [esi], 0
pop edi
pop esi
pop ebx
add esp, 0x150
ret
Function at 0x10bb3dc0
Capabilities:
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
test ebx, ebx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
je 0x10bb3f25
mov edx, dword [ebx]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 4]
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10bb3e41
mov edx, dword [ebx + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x10bb3e68
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [ebx]
push edx
push 0
push 0x2001f
push 0
push 0x10e2c68c
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call fcn.10bd19f0
test eax, eax
je 0x10bb3e83
lea edx, [esp + 0x18]
push 0x10e2c690
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
jmp 0x10bb3e93
lea eax, [esp + 0x18]
push 0x10e2c694
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10bb3ed7
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x24]
push ecx
mov ecx, dword [ebx + 0x18]
lea edx, [esp + 0x1c]
push 0x100
push edx
mov edx, dword [ebx + 0x14]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebx + 8]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0xc]
push 0x100
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.10bd19f0
test eax, eax
je 0x10bb3ef4
mov ecx, dword [ebx + 0x1c]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10bb3f16
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebx + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10bb3f25
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret 4
Function at 0x10bb8dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push esi
mov cl, byte [edx]
test cl, cl
je 0x10bb8df7
mov esi, eax
shl eax, 1
test esi, esi
jge 0x10bb8de7
or al, 1
and ecx, 0xff
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x10bb8ddd
test eax, eax
jge 0x10bb8dfd
neg eax
cdq
idiv dword [esp + 0xc]
pop esi
mov eax, edx
ret

Function at 0x10bb8e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
je 0x10bb8e2a
mov ecx, dword [edi]
test ecx, ecx
mov dword [edi + 8], ecx
je 0x10bb8e2a
mov edx, dword [ecx + 8]
jmp 0x10bb8e2c
xor edx, edx
test edx, edx
je 0x10bb8e79
mov cl, byte [edx]
test cl, cl
je 0x10bb8e50
mov esi, eax
shl eax, 1
test esi, esi
jge 0x10bb8e40
or al, 1
and ecx, 0xff
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x10bb8e36
test edi, edi
je 0x10bb8e73
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10bb8e65
cmp ecx, dword [edi + 4]
je 0x10bb8e65
mov ecx, dword [ecx + 4]
jmp 0x10bb8e67
xor ecx, ecx
test ecx, ecx
mov dword [edi + 8], ecx
je 0x10bb8e73
mov edx, dword [ecx + 8]
jmp 0x10bb8e75
xor edx, edx
test edx, edx
jne 0x10bb8e30
cdq
idiv dword [esp + 0x10]
pop edi
pop esi
mov eax, edx
ret
Function at 0x10bc4820
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
and eax, 3
add eax, 0xfffffffd
ret

Function at 0x10bc48f0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10bc4919
mov eax, dword [esp + 0x18]
jmp 0x10bc491c
or eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x10bc4947
push 0x5335
call fcn.10b3dc90
add esp, 4
cmp eax, 4
jne 0x10bc4942
push esi
push edi
push ebx
call fcn.10bc48f0
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
ret

Function at 0x10bc4950
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push eax
push 3
push esi
call fcn.10bc48c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret

Function at 0x10bc49a0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
lea eax, [esp + 0x1c]
push 0
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10bc49ca
mov edi, dword [esp + 0x1c]
jmp 0x10bc49cd
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x10bc4a00
push 0x5335
call fcn.10b3dc90
add esp, 4
cmp eax, 4
jne 0x10bc49f4
push ebx
push ebp
push esi
call fcn.10bc49a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, 0xfffffffd
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edi, ebx
jae 0x10bc4a40
push 0x5336
call fcn.10b3dc90
add esp, 4
cmp eax, 4
jne 0x10bc4a3b
push esi
call fcn.10bc4840
add esp, 4
sub eax, edi
push eax
push esi
call fcn.10bc4950
add esp, 8
push ebx
push ebp
push esi
call fcn.10bc49a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, 0xffffffef
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10bce5a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov ebp, ecx
je 0x10bce5cb
mov dword [ebp + 0x10574], ebx
mov dword [ebp + 0x10578], ebx
mov dword [ebp + 0x1057c], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0x10574]
mov ecx, dword [ebp + 0x10578]
add eax, edx
cmp eax, ecx
jl 0x10bce675
cmp dword [ebp + 0x1057c], ebx
je 0x10bce5f7
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [ebp + 0x10580]
mov dl, byte [ebp + ecx + 0x1045a]
lea eax, [ebp + ecx]
lea ecx, [ebp + 0x1045e]
mov byte [ebp + 0x1045c], dl
mov al, byte [eax + 0x1045b]
push ecx
mov ecx, ebp
mov byte [ebp + 0x1045d], al
call fcn.10bce530
cmp al, bl
mov byte [esp + 0x18], al
jne 0x10bce63a
mov dword [ebp + 0x1057c], 1
mov edx, dword [esp + 0x18]
mov esi, dword [ebp + 0x10578]
and edx, 0xff
mov ecx, 0x10
sub ecx, esi
lea eax, [edx + 2]
mov edx, dword [ebp + 0x10574]
add edx, ecx
mov dword [ebp + 0x10580], eax
mov dword [ebp + 0x10574], edx
lea edx, [eax*8]
mov dword [ebp + 0x10578], edx
mov eax, dword [esp + 0x14]
mov esi, dword [ebp + 0x10574]
xor edi, edi
cmp eax, ebx
jle 0x10bce6ce
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
mov ecx, eax
mov eax, esi
sub ecx, edx
mov edx, 1
shl edx, cl
mov ecx, edi
mov dword [esp + 0x18], edx
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x18]
sar eax, 3
mov al, byte [eax + ebp + 0x1045c]
and dl, al
mov eax, dword [esp + 0x14]
neg dl
sbb edx, edx
neg edx
shl edx, cl
or ebx, edx
inc esi
inc edi
cmp edi, eax
jl 0x10bce685
mov eax, dword [ebp + 0x10574]
mov ecx, dword [esp + 0x14]
add ecx, eax
pop edi
mov dword [ebp + 0x10574], ecx
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 8
Function at 0x10bcee70
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
cmp ebp, ebx
push edi
mov dword [esp + 0x10], 1
jl 0x10bceea7
jne 0x10bceed5
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jl 0x10bceea7
jne 0x10bceed5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
jge 0x10bceed5
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, ebp
mov ebp, ebx
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x51eb851f
mov ecx, edx
imul ebp
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
sub edx, ecx
test edx, edx
jle 0x10bcef36
mov ecx, ebx
mov edi, edx
mov eax, 0x51eb851f
imul ecx
mov eax, edx
sar eax, 5
mov edx, eax
shr edx, 0x1f
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 3
xor eax, edx
sub eax, edx
neg eax
sbb eax, eax
add ecx, 0x64
add eax, 0x19
dec edi
lea esi, [esi + eax + 0x8e94]
jne 0x10bcef03
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push ebp
call fcn.10bcedf0
mov edx, dword [esp + 0x38]
add esp, 0xc
mov edi, eax
mov eax, dword [esp + 0x28]
push edx
push eax
push ebx
call fcn.10bcedf0
sub edi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
add esi, edi
imul eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10bfe910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x10], 0
mov dword [edi], 0
mov esi, dword [eax + 0x52]
mov dword [esp + 0x7c], esi
call fcn.10bd19f0
mov ebx, dword [esp + 0x78]
push 0x21
test eax, eax
push ebx
je 0x10bfe94c
call dword [sym.imp.MSVCRT.dll__mbschr]
jmp 0x10bfe952
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x10bfe9b9
mov eax, dword [edi]
mov ebp, dword [esi + 0x9c]
test eax, eax
jne 0x10bfea71
mov esi, 0x10e01408
cmp esi, 0x10e02278
jae 0x10bfe9b9
call fcn.10bd19f0
test eax, eax
push ebx
je 0x10bfe98b
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
jmp 0x10bfe994
mov edx, dword [esi]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10bfe9b0
mov eax, dword [esi + 4]
push eax
push ebp
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [esp + 0x10], eax
mov dword [edi], 1
mov eax, dword [edi]
add esi, 8
test eax, eax
je 0x10bfe96e
cmp dword [edi], 0
jne 0x10bfea71
mov ebp, dword [esp + 0x74]
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x7c]
stosw word es:[edi], ax
mov edi, dword [esp + 0x70]
mov eax, dword [edx + 0xd0]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push esi
push 0
push edx
call sym.PBVM90.dll_osLoadPicture
test eax, eax
je 0x10bfea69
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
test eax, 0x80000000
je 0x10bfea2b
mov eax, dword [esp + 0x20]
or eax, 0x20000000
jmp 0x10bfea2d
xor eax, eax
mov ecx, dword [esp + 0x80]
mov dword [ecx], eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x10bfea48
mov edx, dword [edi + 0x10]
push eax
push edx
call sym.PBVM90.dll_pbstg_fee
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x10bfea5a
push eax
mov eax, dword [edi + 0x10]
push eax
call sym.PBVM90.dll_pbstg_fee
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10bfea69
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x10bff860
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
mov ecx, 0xf
mov ebx, dword [esi + 0xb0]
xor eax, eax
lea edi, [esp + 0x10]
xor ebp, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x58]
mov edi, dword [sym.imp.USER32.dll_GetParent]
add eax, 0xfffffffe
mov dword [esp + 0x24], 0xffffffff
cmp eax, 0x1f
ja case.0x10bff8a6.9
xor ecx, ecx
mov cl, byte [eax + 0x10bffa28]
jmp dword [ecx*4 + 0x10bffa08]
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 0x68]
or al, 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov ebp, 1
jmp case.0x10bff8a6.9
mov eax, dword [esp + 0x10]
or ah, 0x40
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x1c]
push eax
call fcn.10bfe710
add esp, 4
mov dword [esp + 0x38], eax
jmp case.0x10bff8a6.9
mov eax, dword [esp + 0x10]
or ah, 0x30
mov dword [esp + 0x10], eax
mov ecx, dword [ebx + 0x20]
push ecx
call fcn.10bfe710
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
jmp case.0x10bff8a6.9
mov edx, dword [esp + 0x10]
mov ebp, 1
or dh, 2
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x10]
shr edx, 0x1c
and edx, 1
mov dword [esp + 0x48], edx
jne case.0x10bff8a6.9
mov eax, dword [esi + 0x18]
push 0
push 0
push 0x130b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0xb4]
cmp eax, dword [ecx + 0x18]
jne case.0x10bff8a6.9
mov edx, dword [esi + 0x18]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x10bff8a6.9
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x10]
shr eax, 0x1b
or bh, 4
and eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x44], eax
jmp case.0x10bff8a6.9
push esi
call fcn.10bffa50
mov ebx, dword [ebx + 0x24]
add esp, 4
test ebx, ebx
je 0x10bff9a0
cmp byte [ebx], 0
je 0x10bff9a0
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x10]
push ecx
push esi
push edx
call fcn.10bff770
add esp, 0xc
mov ebp, 1
jmp case.0x10bff8a6.9
mov eax, dword [esp + 0x10]
or ah, 0x80
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x3c], eax
mov edx, dword [esi + 0xb4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x18]
mov eax, dword [edx + 0x18]
push eax
push 0x1306
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ebp, ebp
je 0x10bff9fc
mov edx, dword [esi + 0x18]
push edx
call edi
push eax
call fcn.10c3ce00
add esp, 4
test eax, eax
je 0x10bff9fc
push eax
mov eax, dword [esp + 0x54]
push eax
call sym.PBVM90.dll_FN_TabResize
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
Function at 0x10c09e90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x24]
test eax, eax
je 0x10c09eb3
mov ecx, dword [eax]
mov dword [eax + 8], ecx
mov edx, dword [edi + 0x24]
mov eax, dword [edx + 8]
test eax, eax
je 0x10c09eb3
mov esi, dword [eax + 8]
jmp 0x10c09eb5
xor esi, esi
test esi, esi
je 0x10c09f14
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp word [esi], 1
jne 0x10c09ee2
mov eax, dword [esi + 0x34]
push 0xfffffffffffffff0
push eax
call ebx
test eax, 0x10000000
je 0x10c09ee2
mov ecx, dword [esi + 0x34]
push 0
push ecx
call ebp
mov eax, dword [edi + 0x24]
test eax, eax
je 0x10c09f0e
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10c09efa
cmp ecx, dword [eax + 4]
je 0x10c09efa
mov ecx, dword [ecx + 4]
jmp 0x10c09efc
xor ecx, ecx
mov dword [eax + 8], ecx
mov edx, dword [edi + 0x24]
mov eax, dword [edx + 8]
test eax, eax
je 0x10c09f0e
mov esi, dword [eax + 8]
jmp 0x10c09f10
xor esi, esi
test esi, esi
jne 0x10c09ec5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10c0a300
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
push ebp
call ebx
push ebp
mov edi, eax
call ebx
mov ecx, dword [esi + 0x9b0]
mov ebx, eax
mov eax, dword [esi + 0x9ac]
push ecx
mov dword [esp + 0x54], ecx
push eax
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SetRect]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x10]
push edx
push eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 0x8c8]
push eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x58], ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x50]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 0xcc0020
push 0
push 0
push ebx
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10c0a4b8
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x34]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esi + 0x9c4]
mov ecx, dword [esp + 0x38]
cmp ecx, eax
jge 0x10c0a3da
mov eax, ecx
mov ecx, dword [esi + 0x9c8]
mov edx, dword [esp + 0x3c]
cmp edx, ecx
jge 0x10c0a3ea
mov ecx, edx
push 0xcc0020
push 0
push 0
push ebx
push ecx
mov ecx, dword [esi + 0x9cc]
push eax
mov eax, dword [esi + 0x9d0]
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test byte [esi + 0x24], 4
je 0x10c0a4b8
mov eax, dword [esp + 0x58]
test eax, eax
je 0x10c0a4b8
lea edx, [esp + 0x24]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x14], eax
lea edx, [ecx + eax - 3]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
lea edx, [eax + ecx - 4]
mov eax, dword [esi + 0x9dc]
push eax
push edi
mov dword [esp + 0x28], edx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push 8
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x58]
push 1
push ecx
push esi
call fcn.10c09db0
add esp, 0xc
lea edx, [esp + 0x14]
mov dword [esp + 0x54], eax
push 0x29
push edx
push 0xffffffffffffffff
push eax
push edi
call dword [sym.imp.USER32.dll_DrawTextA]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
cmp eax, ecx
je 0x10c0a4b8
push eax
mov eax, dword [esi + 4]
push eax
call sym.PBVM90.dll_pbstg_fee
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
call edi
push ebx
call edi
mov ecx, dword [esi + 0xc]
push ebp
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x10c3e630
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov ebp, dword [esp + 0x20]
mov esi, eax
cmp ebp, 9
mov dword [esp + 0x18], esi
jne 0x10c3e739
push edi
call fcn.10c3ce00
mov esi, eax
add esp, 4
test esi, esi
je 0x10c3e7de
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
test ah, 0x80
je 0x10c3e68f
push esi
call fcn.10c42fc0
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x10c3e7de
cmp dword [esi], 0x40a1
jne 0x10c3e6c5
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x10c3e6c5
mov eax, dword [esi + 0xb4]
mov eax, dword [eax]
test eax, eax
je 0x10c3e6c5
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push ecx
push 9
push edx
push eax
call fcn.10c3e630
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x10
call ebx
and eax, 0x8000
mov dword [esp + 0x20], eax
je 0x10c3e6d9
mov esi, dword [esi + 0x20]
jmp 0x10c3e6dc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x10c3e709
push edi
call fcn.10c3ce00
mov eax, dword [eax + 0xc8]
add esp, 4
push eax
call fcn.10c3ce00
mov ecx, dword [eax + 0xb4]
add esp, 4
mov esi, dword [ecx + 0x20]
test esi, esi
je 0x10c3e7d6
push esi
call fcn.10c3ce00
add esp, 4
test eax, eax
je 0x10c3e733
cmp dword [eax], 0x4072
jne 0x10c3e733
cmp dword [eax + 0x18], edi
je 0x10c3e733
push 0
push 0
push 0x52d
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
jmp 0x10c3e7d0
cmp ebp, 0x26
je 0x10c3e7ab
cmp ebp, 0x25
je 0x10c3e7ab
cmp ebp, 0x28
je 0x10c3e7ab
cmp ebp, 0x27
je 0x10c3e7ab
cmp ebp, 0xd
jne 0x10c3e77c
push edi
call fcn.10c3ce00
add esp, 4
test eax, eax
je 0x10c3e7de
cmp dword [eax], 0x40a0
jne 0x10c3e7de
mov eax, dword [eax + 0xb4]
lea edx, [esp + 0x10]
push edx
mov ecx, dword [eax]
push ecx
call sym.PBVM90.dll_PBROI_ControlEatsReturn
jmp 0x10c3e7de
cmp ebp, 0x1b
jne 0x10c3e7de
push edi
call fcn.10c3ce00
add esp, 4
test eax, eax
je 0x10c3e7de
cmp dword [eax], 0x40a0
jne 0x10c3e7de
mov eax, dword [eax + 0xb4]
lea edx, [esp + 0x10]
push edx
mov ecx, dword [eax]
push ecx
call sym.PBVM90.dll_PBROI_ControlEatsEscape
jmp 0x10c3e7de
push edi
call fcn.10c3ce00
add esp, 4
test eax, eax
je 0x10c3e7de
cmp dword [eax], 0x40a1
jne 0x10c3e7de
push eax
push ebp
push esi
call fcn.10c428c0
add esp, 0xc
test eax, eax
je 0x10c3e7de
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10c3e808
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x10c3e808
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret