joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43af21
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x44c7b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004031e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004021d0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4375e4
jmp 0x437670
push 0x50
call fcn.00403252
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], 0x50
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
push str.Start_Page
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43762d
jmp 0x43765e
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x34]
call fcn.00401460
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402f80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00401250
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.00403247
add esp, 4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403100
mov eax, dword [ebp - 0x3c]
or eax, 1
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401250
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401250
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4378f0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43afc0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x44c7b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x78
call fcn.00401ec0
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
call fcn.004031e0
mov dword [ebp - 4], 0
push 3
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x78
call fcn.004060c9
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402f80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00401250
cmp dword [ebp + 8], 0
jne 0x437a01
mov ecx, dword [ebp - 0x34]
call fcn.00401e20
test eax, eax
je 0x4379fc
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x14]
call fcn.00402ed0
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x14]
call fcn.004021d0
push eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00422e40
add esp, 8
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x18]
push ecx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 0x442728
push 0x44272c
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x437aa2
cmp dword [ebp + 8], 1
jne 0x437aa2
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.CommitTasks
call fcn.00402790
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.AddTask
call fcn.00402790
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.ThunderAgent.Agent
call fcn.00402790
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00403100
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0
call dword [0x450464]
mov byte [ebp - 0x59], al
movzx eax, byte [ebp - 0x59]
test eax, eax
jne 0x437aa2
push 0
push str.sorry
push 0x442770
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10077b3
Capabilities:
Enumerate services

Disassembly:
mov eax, 0x101d319
call fcn.0101caf8
sub esp, 0x4c
push esi
push edi
xor esi, esi
push 0xf003f
push esi
mov edi, ecx
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 0x20], eax
je 0x1007784
push esi
push esi
push 0x1004
push dword [edi + 0x9c]
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x50], esi
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
mov dword [ebp - 0x1c], eax
js 0x1007779
push ebx
jmp 0x10076a9
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
push eax
push esi
push 0x104b
push dword [edi + 0x9c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x100776b
mov edi, dword [ebp - 0x38]
cmp edi, esi
je 0x100776b
mov eax, dword [edi]
push 3
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x1007762
lea ecx, [ebp - 0x18]
call fcn.0101c1a4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov dword [ebp - 4], esi
call fcn.010072ef
test eax, eax
je 0x100774d
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x1007726
cmp dword [edi + 0xc], esi
jne 0x100774d
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
mov dword [edi + 0x10], eax
push 4
jmp 0x1007737
cmp dword [edi + 0xc], esi
je 0x100774d
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0x10]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x100774d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0101c168
jmp 0x100776b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jns 0x10076a6
pop ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100778d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
je 0x10077a7
xor eax, eax
cmp dword [ebp - 0x10], 5
push esi
setne al
add eax, 0xfe
push eax
call fcn.01018ad1
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0x10], esi
pop edi
sete al
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100902a
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x101d5b4
call fcn.0101caf8
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
call fcn.0100888b
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], 0x1002200
call fcn.0101c1a4
xor ebx, ebx
inc ebx
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], bl
call fcn.0101c1a4
push dword [ebp + 0xc]
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
mov dword [esi + 0x20], ebx
mov dword [esi + 4], ebx
call fcn.0101c174
push dword [ebp + 8]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.0101c174
push dword [ebp + 0x14]
lea ecx, [esi + 0x10]
call fcn.0101c174
push 0x1002210
lea ecx, [ebp - 0x18]
call fcn.0101c18c
mov ebx, eax
push 0x100209c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0101c18c
push edi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 4
call fcn.0101c3cc
push ebx
push eax
lea eax, [ebp + 0x14]
push eax
mov byte [ebp - 4], 5
call fcn.0101c3cc
push dword [ebp + 0x10]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0101c204
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.0101c1f8
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 6
call fcn.0101c168
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 5
call fcn.0101c168
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0101c168
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0101c168
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0101c168
push dword [ebp + 8]
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], 0x80000001
call fcn.0101c174
push dword [ebp + 0x10]
lea ecx, [esi + 0x1c]
call fcn.0101c174
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x100956a
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x101d604
call fcn.0101caf8
sub esp, 0x6c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, ecx
je 0x10095e2
push edi
lea ecx, [ebp - 0x10]
call fcn.0101c1a4
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0101c1a4
mov eax, dword [ebx]
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 1
call dword [eax + 4]
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x64]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0x104d
push dword [esi + 0x60]
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x24], ebx
call edi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
push 0x1074
push dword [esi + 0x60]
mov dword [esi + 0x64], eax
mov dword [ebp - 0x70], 1
call edi
lea eax, [ebp - 0x78]
push eax
push dword [esi + 0x64]
mov dword [ebp - 0x68], 0xf000
push 0x102b
push dword [esi + 0x60]
mov dword [ebp - 0x6c], 0x2000
call edi
inc dword [esi + 0x64]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.0101c168
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0101c168
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100987b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov esi, ecx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1009890
mov ecx, esi
call fcn.0100650c
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
pop esi
leave
ret 0xc

Function at 0x1009bda
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push dword [esi + 0x9c]
mov dword [ebp - 8], eax
call edi
mov ebx, eax
dec ebx
js 0x1009bfe
xor eax, eax
cmp dword [ebp + 8], eax
setne al
inc eax
mov dword [ebp - 4], eax
shl dword [ebp - 4], 0xc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x102b
push dword [esi + 0x9c]
mov dword [ebp - 0x2c], 0xf000
call edi
dec ebx
jns 0x1009bdc
push dword [ebp + 8]
mov ecx, esi
push 0xf8
call fcn.0100e3d5
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
cmp dword [ebp + 8], 0
jne 0x1009c38
push 0xf8
mov ecx, esi
call fcn.0100e3d5
cmp dword [ebp - 8], eax
jne 0x1009c38
push 0
push 1
push 0x28
push dword [esi + 0x20]
call edi
xor eax, eax
cmp dword [ebp + 8], eax
mov ecx, esi
sete al
push eax
push 0xf7
call fcn.0100e3d5
push eax
call ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1009c71
push 0xf7
mov ecx, esi
call fcn.0100e3d5
cmp dword [ebp - 8], eax
jne 0x1009c71
push ebx
push ebx
push 0x28
push dword [esi + 0x20]
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1009caf
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x101d6ab
call fcn.0101caf8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 1
call fcn.0101c168
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 0
call fcn.0101c168
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.010088d6
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1009d6f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1009109
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esi, 0xc30
test eax, eax
je 0x1009d92
and dword [esi], 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1009d98
mov dword [esi], 0x80004005
mov eax, dword [esi]
pop esi
pop ebp
ret 4
Function at 0x100af32
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x101d870
call fcn.0101caf8
sub esp, 0x214
mov eax, dword [0x1023fb4]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, ecx
jne 0x100ae18
xor eax, eax
jmp 0x100af60
push edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push reloc.ole32.dll_StringFromCLSID
lea eax, [ebp - 0x218]
mov edi, 0x104
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], edi
call fcn.0100652a
test eax, eax
jne 0x100af33
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x14]
call fcn.0101c174
lea eax, [ebp - 0x220]
push eax
push 0x1002574
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call fcn.0100652a
test eax, eax
jne 0x100af33
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x18]
call fcn.0101c174
lea eax, [ebp - 0x220]
push eax
push reloc.MFC42u.DLL_CCmdTarget::OnCmdMsg
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call fcn.0100652a
test eax, eax
jne 0x100af33
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0xc]
call fcn.0101c174
lea eax, [ebp - 0x220]
push eax
push 0x10024f8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call fcn.0100652a
test eax, eax
jne 0x100af33
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x10]
call fcn.0101c174
lea eax, [ebp - 0x220]
push eax
push 0x100252c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call fcn.0100652a
test eax, eax
je 0x100af37
xor esi, esi
jmp 0x100af4c
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 8]
call fcn.0101c174
mov dword [esi + 4], ebx
xor esi, esi
inc esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], ebx
call fcn.0100650c
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101bddf
leave
ret 8
Function at 0x100b1ef
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x101d8c1
call fcn.0101caf8
sub esp, 0xc58
mov eax, dword [0x1023fb4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp + 0x14]
mov esi, ecx
push edi
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp + 0x18]
lea edi, [esi + 0x14]
push eax
mov ecx, edi
call fcn.0101c174
mov ebx, 0x1001c40
push ebx
lea ecx, [ebp - 0xc4c]
call fcn.0101c18c
mov dword [ebp - 0xc50], eax
and dword [ebp - 4], 0
push 1
lea eax, [ebp - 0xc58]
push eax
mov ecx, edi
call fcn.0101c3fc
push dword [ebp - 0xc50]
push eax
call fcn.010094de
lea ecx, [ebp - 0xc58]
mov byte [ebp - 0xc45], al
call fcn.0101c168
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.0101c168
cmp byte [ebp - 0xc45], 0
je 0x100b044
push ebx
lea ecx, [ebp - 0xc4c]
call fcn.0101c18c
push eax
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0101c3f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.0101c168
mov ebx, dword [ebp - 0xc54]
add ebx, 0x2c
push ebx
mov ecx, edi
call fcn.0101c36c
push ebx
lea ecx, [ebp - 0xc5c]
call fcn.0101c18c
lea ecx, [ebp - 0xc5c]
mov dword [ebp - 4], 2
call fcn.0101c33c
push 0x10025bc
lea ecx, [ebp - 0xc58]
call fcn.0101c18c
mov dword [ebp - 0xc54], eax
push 4
lea eax, [ebp - 0xc4c]
push eax
lea ecx, [ebp - 0xc5c]
mov byte [ebp - 4], 3
call fcn.0101c3fc
push dword [ebp - 0xc54]
push eax
call fcn.010094be
lea ecx, [ebp - 0xc4c]
mov byte [ebp - 0xc45], al
call fcn.0101c168
lea ecx, [ebp - 0xc58]
mov byte [ebp - 4], 2
call fcn.0101c168
cmp byte [ebp - 0xc45], 0
je 0x100b174
push dword [edi]
lea eax, [ebp - 0xc44]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0xc44]
push eax
mov ecx, esi
call fcn.01009d5b
test eax, eax
jl 0x100b170
lea edi, [esi + 8]
push ebx
mov ecx, edi
mov dword [esi + 4], 1
call fcn.0101c174
push dword [ebp - 0xc60]
lea ecx, [esi + 0xc]
call fcn.0101c174
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x834]
push eax
push reloc.MFC42u.DLL_CPropertySheet::PreTranslateMessage
add esi, 0x10
push esi
call fcn.0101c1ec
add esp, 0x10
push 0x2e
mov ecx, edi
call fcn.0101c384
test eax, eax
jle 0x100b1e4
push eax
lea eax, [ebp - 0xc54]
push eax
mov ecx, edi
call fcn.0101c27c
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0101c1f8
lea ecx, [ebp - 0xc54]
jmp 0x100b1db
xor esi, esi
jmp 0x100b1e7
lea ecx, [esi + 8]
push ebx
mov dword [esi + 4], 1
mov dword [ebp - 0xc50], ecx
call fcn.0101c174
push dword [ebp - 0xc60]
lea ecx, [esi + 0xc]
call fcn.0101c174
push edi
lea ecx, [esi + 0x10]
call fcn.0101c1f8
mov ecx, dword [ebp - 0xc50]
push 0x2e
call fcn.0101c384
test eax, eax
jle 0x100b1e4
mov ecx, dword [ebp - 0xc50]
push eax
lea eax, [ebp - 0xc64]
push eax
call fcn.0101c27c
mov ecx, dword [ebp - 0xc50]
push eax
mov byte [ebp - 4], 5
call fcn.0101c1f8
lea ecx, [ebp - 0xc64]
mov byte [ebp - 4], 2
call fcn.0101c168
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc5c]
call fcn.0101c168
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101bddf
leave
ret 0x14
Function at 0x100c31f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
inc eax
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov eax, dword [0x1024090]
xor esi, esi
cmp eax, esi
push edi
mov edi, ecx
je 0x100c23c
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0xe5
add eax, 0x90
push eax
mov ecx, edi
call fcn.0100c0d9
mov eax, dword [0x102408c]
cmp eax, esi
je 0x100c25f
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0xe6
add eax, 0x90
push eax
mov ecx, edi
call fcn.0100c0d9
mov eax, dword [0x1024080]
cmp eax, esi
je 0x100c282
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0xe7
add eax, 0x90
push eax
mov ecx, edi
call fcn.0100c0d9
mov eax, dword [0x1024084]
cmp eax, esi
je 0x100c2a5
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0xe8
add eax, 0x90
push eax
mov ecx, edi
call fcn.0100c0d9
mov eax, dword [0x1024088]
cmp eax, esi
mov ebx, 0x3f3
je 0x100c2dd
lea ecx, [eax + 0x90]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
mov ecx, edi
jne 0x100c2ce
mov eax, 0x3f2
push eax
push ebx
push eax
jmp 0x100c2d8
push ebx
push ebx
mov dword [ebp - 4], esi
push 0x3f2
call fcn.0101c438
cmp dword [ebp - 4], esi
je 0x100c2f8
cmp dword [edi + 0x9c], esi
jne 0x100c2f8
mov eax, 0xe2
push eax
push 0xe4
push eax
jmp 0x100c31d
cmp dword [ebp - 8], esi
je 0x100c311
cmp dword [edi + 0x9c], esi
jne 0x100c311
push 0xe3
push 0xe4
jmp 0x100c318
mov eax, 0xe4
push eax
push eax
push 0xe2
mov ecx, edi
call fcn.0101c438
cmp dword [ebp - 4], esi
jne 0x100c32e
cmp dword [ebp - 8], esi
je 0x100c33a
cmp dword [edi + 0x9c], esi
jne 0x100c33a
xor eax, eax
jmp 0x100c33d
xor eax, eax
inc eax
push eax
push 0xe5
mov ecx, edi
call fcn.0100e3d5
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x100c35f
cmp dword [ebp - 8], eax
je 0x100c367
cmp dword [edi + 0x9c], eax
je 0x100c36a
xor eax, eax
inc eax
push eax
push 0xe6
mov ecx, edi
call fcn.0100e3d5
push eax
call esi
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x100c386
cmp dword [ebp - 8], eax
je 0x100c38e
cmp dword [edi + 0x9c], eax
je 0x100c391
xor eax, eax
inc eax
push eax
push 0xe7
mov ecx, edi
call fcn.0100e3d5
push eax
call esi
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x100c3ad
cmp dword [ebp - 8], eax
je 0x100c3b5
cmp dword [edi + 0x9c], eax
je 0x100c3b8
xor eax, eax
inc eax
push eax
push 0xe8
mov ecx, edi
call fcn.0100e3d5
push eax
call esi
xor eax, eax
cmp dword [0x1024088], eax
je 0x100c42a
cmp dword [ebp - 4], eax
jne 0x100c3dc
cmp dword [ebp - 8], eax
je 0x100c3e4
cmp dword [edi + 0x9c], eax
je 0x100c40d
push 1
push 0x3f2
mov ecx, edi
call fcn.0100e3d5
push eax
call esi
push ebx
push 0x3f2
mov ecx, edi
call fcn.0101c42c
sub eax, ebx
neg eax
sbb eax, eax
inc eax
push eax
push ebx
jmp 0x100c420
push eax
push ebx
mov ecx, edi
call fcn.0100e3d5
push eax
call esi
push 0
push 0x3f2
mov ecx, edi
call fcn.0100e3d5
push eax
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100d086
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push esi
push edi
call fcn.0100c70d
test eax, eax
jl 0x100d08a
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
sub esi, eax
push esi
lea eax, [edi + eax*2]
push eax
call fcn.0100c6c4
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100e8ef
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1023fb4]
and dword [ebp - 0x214], 0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x210], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x248]
push eax
push 0
push 0x113e
push edi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x248], CPropertySheet::SetActivePage
mov dword [ebp - 0x234], 0x104
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], CPropertySheet::PreTranslateMessage
call esi
test eax, eax
je 0x100e8e3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0x1132
push edi
call esi
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0xffff0001
je 0x100e93a
push ebx
push 4
mov ebx, 0x110a
jmp 0x100e92c
push dword [ebp - 0x210]
mov ecx, dword [ebp - 0x21c]
push dword [ebp - 0x214]
push dword [ebp - 0x218]
push edi
call fcn.0100e83a
push dword [ebp - 0x218]
mov dword [ebp - 0x210], eax
push 1
push ebx
push edi
call esi
test eax, eax
mov dword [ebp - 0x218], eax
jne 0x100e900
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
call fcn.0101bddf
leave
ret 0x10

Function at 0x1010425
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
and word [esi], 0
push esi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, esi
pop esi
pop ebp
ret 0x10