joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7a18601e
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x184b7a09
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001074
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100010ab
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x100010ab
test eax, eax
je 0x100010ab
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x100010ab
push eax
push dword [ebp + 0xc]
call fcn.1000789a
pop ecx
pop ecx
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
pop ebp
ret

Function at 0x10003361
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push 0x50
xor ebx, ebx
push ebx
mov esi, 0x100a4048
push esi
call fcn.10045030
add esp, 0xc
cmp dword [0x100a2bf8], ebx
jne 0x10003385
xor eax, eax
jmp 0x1000343b
test byte [0x10150600], 1
je 0x1000337e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100a2c04]
add ecx, 0xbb8
cmp ecx, eax
jbe 0x100033ae
xor eax, eax
jmp 0x1000343a
call edi
push 0x50
push ebx
push esi
mov dword [0x100a2c04], eax
call fcn.10045030
add esp, 0xc
push dword [0x10185a54]
push 0x1000317b
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi]
cmp eax, ebx
je 0x100033ed
cmp byte [0x102d3d92], bl
jne 0x100033f8
push ebx
push 0x1000325f
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
add esi, 4
cmp esi, 0x100a4070
jl 0x100033d2
push dword [0x100a2c00]
push str.tc_OLonSend
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10041a19
add esp, 0x10
cmp dword [0x1015668c], ebx
je 0x10003437
push dword [0x100a2c00]
push dword [0x100a2c04]
push str.isUISend___d___d_
push ebx
call fcn.100412e2
add esp, 0x10
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x10008d4a
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
xor ecx, ecx
xor edi, edi
mov dword [ebp + 8], edx
cmp byte [edx], al
je 0x10008ddd
push ebx
mov edx, dword [ebp + 8]
movsx edx, byte [edx]
mov ebx, dword [edx*4 + 0x10078068]
cmp ebx, 0xffffffff
je 0x10008dd1
mov edx, edi
sub edx, 0
je 0x10008dcc
dec edx
je 0x10008db1
dec edx
je 0x10008d97
dec edx
jne 0x10008dcf
cmp eax, dword [ebp + 0x10]
jge 0x10008d93
shl cl, 6
or cl, bl
mov byte [eax + esi], cl
inc eax
xor edi, edi
jmp 0x10008dcf
cmp eax, dword [ebp + 0x10]
jge 0x10008dad
mov edx, ebx
sar edx, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [eax + esi], dl
inc eax
push 3
jmp 0x10008dc9
cmp eax, dword [ebp + 0x10]
jge 0x10008dc7
mov edx, ebx
sar edx, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [eax + esi], dl
inc eax
push 2
pop edi
jmp 0x10008dcf
xor edi, edi
inc edi
mov ecx, ebx
inc dword [ebp + 8]
mov edx, dword [ebp + 8]
cmp byte [edx], 0
jne 0x10008d63
pop ebx
pop edi
mov byte [eax + esi], 0
pop esi
pop ebp
ret
Function at 0x1000cd51
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1015668c], 0
je 0x1000cd75
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.try_MyDetourCreateProcessWithDllExW_lpApplicationName__ls__lpCommandLine__ls_
push 0
call fcn.100412e2
add esp, 0x10
push ebx
mov ebx, dword [ebp + 0x38]
push esi
push edi
test ebx, ebx
jne 0x1000cd85
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [ebp + 0x2c]
test esi, esi
jne 0x1000cd97
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x1000cdc4
xor eax, eax
jmp 0x1000ce8b
mov eax, dword [ebp + 0x34]
mov dword [ebp - 4], eax
test esi, esi
je 0x1000ce0d
mov eax, dword [esi]
test eax, eax
je 0x1000ce0d
cmp byte [0x1015188b], 0
je 0x1000ce0d
push eax
call fcn.1002c57b
pop ecx
test eax, eax
jne 0x1000ce0d
push 0xffffffffffffffff
push dword [esi]
call dword [0x1018797c]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000cdbd
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058ac0
test eax, eax
jne 0x1000ce2e
push ebx
push dword [ebp - 4]
push dword [esi + 8]
call fcn.1005a620
test eax, eax
je 0x1000cde8
cmp dword [0x1015668c], 0
je 0x1000ce4f
push dword [esi + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Success_MyDetourCreateProcessWithDllExW_lpApplicationName__ls__lpCommandLine__ls__hThread__08x_
push 0
call fcn.100412e2
add esp, 0x14
test byte [ebp + 0x1c], 4
je 0x1000ce69
mov eax, dword [esi + 4]
mov dword [0x10151838], eax
mov dword [0x1015183c], 0x20394853
jmp 0x1000ce72
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000ce88
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x34
Function at 0x1000ce92
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1015668c], ebx
je 0x1000ceb9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.try_MyDetourCreateProcessInternalWithDllExW_lpApplicationName__ls__lpCommandLine__ls_
push ebx
call fcn.100412e2
add esp, 0x10
mov esi, dword [ebp + 0x30]
mov ecx, dword [0x10187964]
cmp esi, ebx
jne 0x1000ced1
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebp + 0x34]
mov eax, dword [ebp + 0x20]
push esi
push dword [ebp + 0x2c]
or eax, 4
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x1000cf04
xor eax, eax
jmp 0x1000cfb8
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 4], eax
cmp esi, ebx
je 0x1000cf4c
mov eax, dword [esi]
cmp eax, ebx
je 0x1000cf4c
cmp byte [0x1015188b], bl
je 0x1000cf4c
push eax
call fcn.1002c57b
pop ecx
test eax, eax
jne 0x1000cf4c
push 0xffffffffffffffff
push dword [esi]
call dword [0x1018797c]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000cefd
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058ac0
test eax, eax
je 0x1000cf27
cmp dword [0x1015668c], ebx
je 0x1000cf7c
push dword [esi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.Success_MyDetourCreateProcessInternalWithDllExW_lpApplicationName__ls__lpCommandLine__ls__hThread__08x_
push ebx
call fcn.100412e2
add esp, 0x14
test byte [ebp + 0x20], 4
je 0x1000cf96
mov eax, dword [esi + 4]
mov dword [0x10151838], eax
mov dword [0x1015183c], 0x20394853
jmp 0x1000cf9f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000cfb5
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x3c
Function at 0x1000cfbf
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1015668c], ebx
je 0x1000cfe6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.try_MyDetourCreateProcessInternalWithDllExW_lpApplicationName__ls__lpCommandLine__ls_
push ebx
call fcn.100412e2
add esp, 0x10
mov esi, dword [ebp + 0x30]
mov ecx, dword [0x10187968]
cmp esi, ebx
jne 0x1000cffe
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebp + 0x34]
mov eax, dword [ebp + 0x20]
push esi
push dword [ebp + 0x2c]
or eax, 4
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x1000d031
xor eax, eax
jmp 0x1000d0e5
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 4], eax
cmp esi, ebx
je 0x1000d079
mov eax, dword [esi]
cmp eax, ebx
je 0x1000d079
cmp byte [0x1015188b], bl
je 0x1000d079
push eax
call fcn.1002c57b
pop ecx
test eax, eax
jne 0x1000d079
push 0xffffffffffffffff
push dword [esi]
call dword [0x1018797c]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000d02a
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058ac0
test eax, eax
je 0x1000d054
cmp dword [0x1015668c], ebx
je 0x1000d0a9
push dword [esi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.Success_MyDetourCreateProcessInternalWithDllExA_lpApplicationName__ls__lpCommandLine__ls__hThread__08x_
push ebx
call fcn.100412e2
add esp, 0x14
test byte [ebp + 0x20], 4
je 0x1000d0c3
mov eax, dword [esi + 4]
mov dword [0x10151838], eax
mov dword [0x1015183c], 0x20394853
jmp 0x1000d0cc
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000d0e2
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x3c
Function at 0x1000d0ec
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1015668c], 0
je 0x1000d110
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.try_MyDetourCreateProcessWithDllExA_lpApplicationName__s__lpCommandLine__s_
push 0
call fcn.100412e2
add esp, 0x10
push ebx
mov ebx, dword [ebp + 0x38]
push esi
push edi
test ebx, ebx
jne 0x1000d120
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [ebp + 0x2c]
test esi, esi
jne 0x1000d132
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x1000d15f
xor eax, eax
jmp 0x1000d226
mov eax, dword [ebp + 0x34]
mov dword [ebp - 4], eax
test esi, esi
je 0x1000d1a8
mov eax, dword [esi]
test eax, eax
je 0x1000d1a8
cmp byte [0x1015188b], 0
je 0x1000d1a8
push eax
call fcn.1002c57b
pop ecx
test eax, eax
jne 0x1000d1a8
push 0xffffffffffffffff
push dword [esi]
call dword [0x1018797c]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000d158
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058ac0
test eax, eax
jne 0x1000d1c9
push ebx
push dword [ebp - 4]
push dword [esi + 8]
call fcn.10059fb0
test eax, eax
je 0x1000d183
cmp dword [0x1015668c], 0
je 0x1000d1ea
push dword [esi + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Success_MyDetourCreateProcessWithDllExA_lpApplicationName__s__lpCommandLine__s__hThread__08x_
push 0
call fcn.100412e2
add esp, 0x14
test byte [ebp + 0x1c], 4
je 0x1000d204
mov eax, dword [esi + 4]
mov dword [0x10151838], eax
mov dword [0x1015183c], 0x20394853
jmp 0x1000d20d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000d223
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x34
Function at 0x1000d583
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp - 4], eax
push str.C:CodewareCOMPRESS.
call fcn.10040a77
pop ecx
test eax, eax
jne 0x1000d5e1
push str.C:Program_FilesIntergraph_CAS.
call fcn.10040a77
pop ecx
test eax, eax
jne 0x1000d5e1
push str.C:Program_Files__x86_Intergraph_CAS.
call fcn.10040a77
pop ecx
test eax, eax
jne 0x1000d5e1
push str.D:Program_FilesIntergraph_CAS.
call fcn.10040a77
pop ecx
test eax, eax
jne 0x1000d5e1
push str.D:Program_Files__x86_Intergraph_CAS.
call fcn.10040a77
pop ecx
test eax, eax
je 0x1000d62b
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.10045030
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0
call fcn.10040bae
add esp, 0x18
push str.explorer.EXE
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000d62b
xor eax, eax
jmp 0x1000d63c
push 1
push str.SeDebugPrivilege
call fcn.1002d134
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004501f
leave
ret

Function at 0x1000db9d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push 1
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
xor esi, esi
push esi
push 1
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
push 0x100610e0
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x5c]
push str.Global_s
push eax
mov dword [ebp - 0x6c], 0xc
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
call fcn.10045378
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea eax, [ebp - 0x6c]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call ebx
cmp eax, 0xb7
jne 0x1000dc3a
mov dword [ebp - 0x60], 1
test edi, edi
je 0x1000dc4c
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100610e0
lea eax, [ebp - 0x5c]
push str._s_Service
push eax
call fcn.10045378
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
push 0
lea eax, [ebp - 0x6c]
push eax
call esi
mov esi, eax
call ebx
cmp eax, 0xb7
jne 0x1000dc88
mov dword [ebp - 0x60], 1
test esi, esi
je 0x1000dc9a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x60], 0
mov ecx, dword [ebp + 0xa8]
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0xac
leave
ret
Function at 0x1000f1e4
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
lea ebp, [esp - 0x3dc]
sub esp, 0x45c
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x3d8], eax
mov eax, dword [ebp + 0x3ec]
push ebx
push str.Floppy
push eax
call fcn.10045450
pop ecx
test eax, eax
mov eax, dword [ebp + 0x3e8]
pop ecx
setne cl
dec eax
dec eax
push 0
pop ebx
je 0x1000f23c
dec eax
je 0x1000f247
dec eax
dec eax
je 0x1000f233
xor eax, eax
jmp 0x1000f36e
mov dword [ebp - 0x68], 0x100725cc
jmp 0x1000f24e
mov dword [ebp - 0x68], 0x100725dc
cmp cl, bl
jne 0x1000f24e
mov dword [ebp - 0x68], 0x100725bc
push 0x12
push ebx
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0x64], eax
cmp eax, 0xffffffff
je 0x1000f22c
push esi
push 0x3ff
lea eax, [ebp - 0x27]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x28], bl
call fcn.10045030
add esp, 0xc
push 0x1c
pop esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x44], esi
push dword [ebp - 0x68]
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x1000f361
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
cmp dword [ebp - 0x6c], ebx
je 0x1000f351
cmp dword [ebp - 0x6c], 0x400
ja 0x1000f351
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x60], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
je 0x1000f351
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000f351
push ebx
lea eax, [ebp - 0x74]
push eax
push 0xc
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x2d1080
push edi
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1000f34a
mov eax, dword [ebp + 0x3e4]
cmp eax, dword [ebp - 0x7c]
je 0x1000f384
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x1f4
jl 0x1000f280
push dword [ebp - 0x64]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp + 0x3d8]
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x3dc
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x4c]
jmp 0x1000f36c
Function at 0x1000f7e2
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
push esi
mov esi, dword [ebp + 0x3a8]
push edi
xor ebx, ebx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x3b0]
push ebx
push esi
mov dword [ebp - 0x68], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x1000f8ae
push 0x1ff
lea eax, [ebp + 0x19d]
push ebx
push eax
mov byte [ebp + 0x19c], bl
call fcn.10045030
lea eax, [ebp + 0x19c]
push eax
push esi
call fcn.100403ef
lea eax, [ebp + 0x19c]
push 0x2e
push eax
call fcn.10044f10
add esp, 0x1c
cmp eax, ebx
je 0x1000f8aa
mov byte [eax], bl
mov eax, dword [ebp - 0x68]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000f86d
sub eax, esi
cmp dword [ebp + 0x3b4], eax
jae 0x1000f88f
lea eax, [ebp + 0x19c]
push eax
push dword [ebp - 0x68]
call fcn.1000789a
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x39c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x3a0
leave
ret
xor eax, eax
jmp 0x1000f892
push edi
call fcn.10045413
push edi
push ebx
push eax
mov dword [ebp - 0x6c], eax
call fcn.10007858
add esp, 0x10
push dword [ebp - 0x6c]
push edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1000f8de
push dword [ebp - 0x6c]
call fcn.1004536d
pop ecx
mov eax, ebx
jmp 0x1000f892
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], ebx
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 0x74], ebx
je 0x1000f93b
mov eax, dword [ebp - 0x80]
movzx ecx, word [eax + 2]
push dword [ebp - 0x7c]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp + 0x19c]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.10045378
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x19c]
push eax
push dword [ebp - 0x6c]
call sub.VERSION.dll_VerQueryValueA
mov edi, dword [ebp - 0x70]
cmp edi, ebx
je 0x1000f9b1
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000f947
sub eax, edx
inc eax
cmp eax, dword [ebp - 0x78]
jne 0x1000f973
mov esi, dword [ebp + 0x3b4]
lea eax, [esi - 1]
push eax
push edi
mov edi, dword [ebp - 0x68]
push edi
call fcn.100078ec
add esp, 0xc
mov byte [edi + esi - 1], bl
jmp 0x1000f9b1
push 0x3ff
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.10045030
push ebx
push ebx
push 0x400
lea eax, [ebp - 0x64]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call fcn.1004491a
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov ecx, eax
add esp, 0x2c
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1000f9a7
xor ebx, ebx
inc ebx
jmp 0x1000f8d1
Function at 0x1000f9b9
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x18c], eax
or dword [ebp - 0x78], 0xffffffff
push ebx
xor ebx, ebx
cmp dword [0x1015668c], 4
push esi
jne 0x1000f9f2
push str.Is_MouseClickCheck_
push ebx
call fcn.100412e2
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1000fafe
push edi
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
cmp edi, ebx
je 0x1000fafd
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [0x1015668c], 4
jne 0x1000fa41
push dword [ebp - 0x78]
push edi
push str.Is_MouseClickCheck_sub__d___d_
push ebx
call fcn.100412e2
add esp, 0x10
mov eax, dword [ebp - 0x78]
cmp eax, dword [0x1015185c]
jne 0x1000fabe
push 0x1ff
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.10045030
add esp, 0xc
mov esi, 0x200
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x1000fab6
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.ConsoleWindowClass
lea eax, [ebp - 0x74]
push eax
call ebx
test eax, eax
je 0x1000fab6
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x1000fab6
push 0x10155a28
lea eax, [ebp - 0x74]
push eax
call ebx
test eax, eax
je 0x1000fab6
mov dword [0x100784a8], 0x5b6a7988
jmp 0x1000fafd
push edi
call fcn.1003de58
jmp 0x1000fafc
cmp eax, ebx
je 0x1000fafd
cmp eax, dword [0x10185a58]
je 0x1000fae2
cmp eax, dword [0x10185a5c]
je 0x1000fae2
cmp eax, dword [0x10185a60]
je 0x1000fae2
cmp eax, dword [0x10185a64]
jne 0x1000fafd
call fcn.10036f8e
cmp dword [0x1015668c], 4
jne 0x1000fafd
push str.MouseClickCheck_5
push ebx
call fcn.100412e2
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp + 0x18c]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x190
leave
ret