joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e8ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
call fcn.0100e7be
mov ebx, eax
test ebx, ebx
jne 0x100e91f
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1002270
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100e91f
push esi
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x1001f38
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100e915
cmp dword [ebp - 8], esi
jne 0x100e915
cmp dword [ebp - 0x10], eax
je 0x100e915
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x100e929
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
mov edi, 0x1001f54
push edi
push eax
call esi
push edi
push 0
call esi
push edi
push 0
mov ebx, eax
call esi
add esp, 0x18
push ebx
push 0x1001c80
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x100e96b
test esi, esi
jne 0x100e96b
inc eax
jmp 0x100e96d
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x100e976
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push 0x1001fe0
xor ebx, ebx
mov dword [ebp - 8], edi
call sub.slc.dll_SLGetWindowsInformationDWORD
test eax, eax
jl 0x100ea0b
cmp dword [ebp - 8], 1
jne 0x100ea0b
call fcn.0100e7be
mov ebx, eax
cmp ebx, edi
jne 0x100ea0b
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1001f80
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ea0b
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001f5c
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ea01
cmp dword [ebp - 0xc], esi
jne 0x100ea01
cmp dword [ebp - 0x14], edi
je 0x100ea01
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x100ea64
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1002270
push 0x80000001
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ebff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x100213c
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call esi
cmp eax, ebx
jne 0x100ebb9
cmp dword [ebp - 4], edi
jne 0x100ebb9
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x100211c
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebb9
cmp dword [ebp - 4], 4
jne 0x100ebb9
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10020f8
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebb9
cmp dword [ebp - 4], 4
jne 0x100ebb9
mov eax, dword [ebp - 8]
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10020d0
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebb9
cmp dword [ebp - 4], 4
jne 0x100ebb9
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10020b0
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebb9
cmp dword [ebp - 4], 4
jne 0x100ebb9
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x1002090
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebb9
cmp dword [ebp - 4], 4
jne 0x100ebb9
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], 1
mov dword [edi + 4], eax
jmp 0x100ebf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100ebcd
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ebf4
test byte [eax + 0x1c], 4
je 0x100ebf4
push ecx
push 0x1001ecc
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret 8
Function at 0x100f4ed
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x100f66f
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x1002270
push 0x80000001
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100f6aa
push ebx
push edi
push 0xa
pop ecx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
push 2
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x34], 0x28
call dword [sym.imp.USER32.dll_MonitorFromRect]
push 4
cmp eax, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
je 0x100f5f2
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x100f5b8
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push ebx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x10020b0
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x24]
push ebx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x1002090
push dword [ebp - 8]
call esi
jmp 0x100f5f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100f5cc
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100f5f2
test byte [eax + 0x1c], bl
je 0x100f5f2
push ecx
push 0x1001ecc
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30]
je 0x100f5ff
sub eax, dword [ebp - 0x30]
jmp 0x100f602
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x44]
push ebx
add ecx, eax
lea eax, [ebp - 4]
push eax
push ebx
xor edi, edi
push edi
push 0x100213c
push dword [ebp - 8]
mov dword [ebp - 4], ecx
call esi
mov eax, dword [ebp - 0x40]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x100211c
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x3c]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x10020f8
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x38]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x10020d0
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
jmp 0x100f6aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100f683
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100f6aa
test byte [eax + 0x1c], 4
je 0x100f6aa
push ecx
push 0x1001ecc
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
pop esi
leave
ret

Function at 0x1010c24
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x10219b8], 0
jne 0x1010c47
push 0
push dword [0x10218f8]
push 0x1010a5f
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10219b8], eax
xor eax, eax
ret 0x10
Function at 0x10110b5
Capabilities:
Log keystrokes via application hook

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.01010c51
test eax, eax
jge 0x10110ff
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10110ff
test byte [ecx + 0x1c], 4
je 0x10110ff
push eax
push 0x1001ecc
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010086a5
mov ecx, esi
call fcn.01011890
movzx eax, ax
push eax
call fcn.01008732
call fcn.01008df9
call fcn.01008982
test eax, eax
je 0x1011127
push dword [esi + 4]
mov ecx, esi
call fcn.0100edf5
push 0
push dword [esi + 4]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
mov ecx, esi
call fcn.0101177c
test eax, eax
jge 0x1011163
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1011163
test byte [ecx + 0x1c], 4
je 0x1011163
push eax
push 0x1001ecc
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010086a5
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x100
push ebx
lea eax, [esi + 0x34]
push eax
push 0x3e9
push dword [0x10218f8]
call edi
test eax, eax
jne 0x10111bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1011198
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10111bf
test byte [eax + 0x1c], 4
je 0x10111bf
push ecx
push 0x1001ecc
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
mov ecx, esi
call fcn.01010f4a
push ebx
lea eax, [ebp - 0x204]
push eax
push 0x3ef
push dword [0x10218f8]
call edi
push 0x64
push dword [0x10218f8]
xor edi, edi
push 0xd1
push dword [esi + 4]
lea eax, [ebp - 0x204]
push edi
push edi
push edi
push edi
push 0x5003400b
push eax
push 0x1001cc4
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
cmp ebx, edi
je 0x1011220
call fcn.010088c6
push eax
push 0xfffffffffffffff4
push ebx
call dword [sym.imp.USER32.dll_SetClassLongW]
jmp 0x1011244
mov eax, dword [section..data]
cmp eax, section..data
je 0x1011244
test byte [eax + 0x1c], 4
je 0x1011244
push 0x1001ecc
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100935e
mov ecx, esi
call fcn.0100f94e
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [0x10218f8]
push 0x1010a5f
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push edi
push 0xfffffffffffffffc
mov dword [0x10219b8], eax
push dword [esi + 4]
push 0x8002
call dword [sym.imp.USER32.dll_NotifyWinEvent]
cmp dword [0x1021784], edi
je 0x10112d6
mov al, byte [0x1021788]
cmp al, 4
jae 0x1011295
test al, al
jne 0x10112d6
mov ecx, dword [0x1021774]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x10112d6
mov ecx, dword [0x102177c]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x1021778]
jne 0x10112d6
cmp eax, ecx
jne 0x10112d6
push 0x10016d0
push dword [0x102175c]
push dword [0x1021758]
call fcn.0100db3c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0101a14f
leave
ret 0x10
Function at 0x101177c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x10117a9
test byte [eax + 0x1c], 0x10
je 0x10117a9
push 0x1002260
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100935e
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x10117be
mov ecx, eax
call fcn.01013397
jmp 0x10117c0
xor eax, eax
mov dword [esi + 0x20], eax
test eax, eax
je 0x101185c
mov ecx, eax
call fcn.010133e6
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x101182d
lea ecx, [esi + 0x270]
push ecx
push eax
push esi
push 0x100ab8c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x26c], eax
test eax, eax
jne 0x1011885
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1011812
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x1011885
test byte [eax + 0x1c], 4
je 0x1011885
push ebx
push 0x1002260
push 0xb
jmp 0x101187a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1011841
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x1011885
test byte [eax + 0x1c], 4
je 0x1011885
push ebx
push 0x1002260
push 0xc
jmp 0x101187a
mov ecx, 0x8007000e
mov ebx, ecx
mov eax, dword [section..data]
cmp eax, edi
je 0x1011885
test byte [eax + 0x1c], 4
je 0x1011885
push ecx
push 0x1002260
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x1011890
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x410]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1002270
push 0x80000002
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x410], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10119f5
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 0x20
push 0x10022c8
push ebx
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], 0x200
call esi
cmp eax, ebx
jle 0x1011919
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x10119e8
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push 2
push 0x10022fc
push ebx
push dword [ebp - 0x410]
mov dword [ebp - 0x414], 0x200
call esi
test eax, eax
jne 0x10119c4
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x418], ebx
call fcn.0100bcf1
test eax, eax
je 0x10119c4
lea ecx, [ebp - 0x204]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x1011974
sub eax, esi
jmp 0x10119be
push 8
pop edx
cmp dx, word [ebp - 0x408]
jbe 0x10119e8
cmp dword [ebp - 0x40c], ebx
jbe 0x10119e8
inc dword [ebp - 0x408]
add eax, eax
push 0xfffffffffffffffe
pop edx
sub edx, eax
add dword [ebp - 0x40c], edx
lea ecx, [ecx + eax + 2]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x10119b2
sub eax, edx
sar eax, 1
jne 0x1011982
jmp 0x10119e8
mov eax, dword [section..data]
cmp eax, section..data
je 0x10119e8
test byte [eax + 0x1c], 4
je 0x10119e8
push 0x1002260
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100935e
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x408]
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret
Function at 0x1012645
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1012749
xor eax, eax
mov dword [ebp - 0x62c], esi
lea edi, [ebp - 0x628]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x66c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x670], 0x44
mov eax, 0x10024a8
cmp ebx, esi
jne 0x10126b7
mov eax, 0x1002498
push ebx
push 0x100237c
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.01008429
add esp, 0x18
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1012717
push dword [ebp - 0x628]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x62c]
call edi
jmp 0x1012784
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101272b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1012784
test byte [eax + 0x1c], 4
je 0x1012784
push esi
push 0x10023b0
push 0xd
jmp 0x1012779
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101275d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1012784
test byte [eax + 0x1c], 4
je 0x1012784
push esi
push 0x10023b0
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret 4

Function at 0x1013e55
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
je 0x1013ece
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x41e
push ebx
call esi
mov dword [ebp + 8], eax
cmp eax, edi
je 0x1013ecd
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
push eax
push edi
push 0x419
push ebx
call esi
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push 1
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
push eax
push edi
push 0x412
push dword [ebp + 8]
call esi
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x1014687
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, 0xca
cmp dword [esi + 0x28], eax
jne 0x101482f
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov dword [ebp - 0x40c], ebx
test ebx, ebx
je 0x1014844
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x408], eax
test eax, eax
je 0x1014844
push edi
call fcn.010088b0
push eax
push dword [ebp - 0x408]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x410], eax
mov edi, 0x100
push edi
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebx, [esi + 0x430]
push ebx
push edi
lea eax, [ebp - 0x204]
push eax
call fcn.0100a660
test eax, eax
jne 0x101481a
push 2
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
call fcn.01008a42
mov edi, eax
push 7
add edi, edi
call fcn.01008a42
sub eax, edi
push 7
mov dword [ebp - 0x418], eax
call fcn.01008e1a
push 0x18400
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x420]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.USER32.dll_DrawTextW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
test eax, eax
je 0x1014808
lea eax, [ebp - 0x204]
push eax
push ebx
call edi
test eax, eax
je 0x10147d3
mov eax, dword [section..data]
cmp eax, section..data
je 0x10147d3
test byte [eax + 0x1c], 4
je 0x10147d3
push ebx
push 0x100254c
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a49b
lea eax, [ebp - 0x204]
push eax
push 0xca
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, dword [esi + 0x20]
test esi, esi
je 0x1014808
push 0
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x40c]
mov ecx, esi
push 1
call fcn.0100e597
push dword [ebp - 0x410]
push dword [ebp - 0x408]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x408]
push dword [ebp - 0x40c]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
jmp 0x1014844
lea eax, [esi + 0x430]
push eax
push 0xcd
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret
Function at 0x1014b72
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1014c37
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x62c], esi
lea edi, [ebp - 0x628]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x66c]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1002580
lea eax, [ebp - 0x61c]
push 0x208
push eax
mov dword [ebp - 0x670], 0x44
call fcn.01008429
add esp, 0x20
test eax, eax
jne 0x1014c35
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1014c35
push dword [ebp - 0x628]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x62c]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret 4
Function at 0x10168f0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x208], edi
test ebx, ebx
je 0x1016a65
cmp dword [ebx + 8], 0xfffffff4
jne 0x1016a65
mov eax, dword [ebx + 4]
cmp eax, 0xca
je 0x1016a01
cmp eax, 0xcc
je 0x1016a01
cmp eax, 0xc9
jne 0x1016983
call fcn.01008977
test eax, eax
je 0x101695a
cmp dword [ebx + 0xc], 1
jne 0x1016a65
mov eax, dword [ebx + 0x28]
push 4
pop esi
mov ecx, eax
and ecx, esi
push ecx
mov ecx, eax
and ecx, 0x200
push ecx
and eax, 0x10
push eax
push dword [ebx]
mov ecx, edi
push dword [ebx + 0x10]
call fcn.01016188
jmp 0x1016a65
cmp eax, 0xd0
jne 0x1016a65
call fcn.01008977
test eax, eax
je 0x1016a65
call fcn.01008982
test eax, eax
je 0x1016a65
push 0
push 0x102153c
push 0x1021044
push 0
push edi
call sub.msvcrt.dll___RTDynamicCast
add esp, 0x14
test eax, eax
jne 0x1016a65
mov eax, dword [ebx + 0xc]
cmp eax, 1
jne 0x10169d6
push 0x10
jmp 0x1016a64
cmp eax, 2
jne 0x1016a65
lea eax, [ebp - 0x218]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x218]
push eax
push dword [ebx + 0x10]
mov ecx, edi
call fcn.010155ab
jmp 0x1016a65
call fcn.01008977
test eax, eax
je 0x1016a65
call fcn.01008982
test eax, eax
je 0x1016a65
cmp dword [ebx + 0xc], 1
jne 0x1016a65
push 0x100
lea eax, [ebp - 0x204]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebx + 0x28]
mov ecx, eax
and ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x208]
and eax, 0x200
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebx + 4]
lea esi, [ebx + 0x14]
sub esp, 0x10
mov edi, esp
push dword [ebx + 0x10]
movsd dword es:[edi], dword [esi]
push dword [ebx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.010163b7
push 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret 0x10