joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
pop ebp
jmp fcn.10010310

Function at 0x1000fb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100baf07
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x100fbe80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100536c0
mov ecx, dword [esi + 0xe84]
lea edi, [esi + 0xdf8]
test ecx, ecx
je 0x1000fb43
mov eax, dword [ecx]
call dword [eax + 8]
cmp byte [edi + 0x58], 0
je 0x1000fb54
mov ecx, edi
mov byte [edi + 0x58], 0
call fcn.10024c70
cmp byte [edi + 0x59], 0
je 0x1000fb65
mov ecx, edi
mov byte [edi + 0x59], 0
call fcn.10024d60
cmp byte [edi + 0x5a], 0
je 0x1000fbb6
cmp dword [edi + 0x8c], 0
mov byte [edi + 0x5a], 0
jne 0x1000fbb6
push 0x13b8
call fcn.100925a9
mov esi, eax
mov dword [ebp - 0x44], esi
push 0x13b8
push 0
push esi
mov dword [ebp - 4], 0
call fcn.10094470
add esp, 0x10
mov ecx, esi
push edi
push dword [edi + 4]
call fcn.10026330
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x8c], eax
push 0x32
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push str.HKEY_CURRENT_USER_Software_Red_Rock_Sound_SelfTest
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.1000db40
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], 0
jne 0x1000fbed
mov byte [ebp - 0xd], 0
jmp 0x1000fc24
mov edx, 0x101036d0
lea ecx, [ebp - 0x28]
call fcn.1006da20
test al, al
je 0x1000fc0b
lea ecx, [ebp - 0x28]
call fcn.1006c110
mov byte [ebp - 0xd], al
jmp 0x1000fc24
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne byte [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x1000fc65
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000fc5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000fd13
push ecx
push edx
call fcn.10092592
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x1000fd02
push 0x32
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.HKEY_CURRENT_USER_Software_Red_Rock_Sound_SelfTest
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.1000db40
push 0
xor edx, edx
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.1006da80
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x1000fce1
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000fcd7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000fd18
push ecx
push edx
call fcn.10092592
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
test esi, esi
je 0x1000fd02
push esi
call fcn.10092762
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10097635
call fcn.10097635
int3
Function at 0x1000fdda
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100baf47
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100fbe80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
cmp eax, 0x464
jne 0x1000fe19
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xf34], eax
cmp eax, 2
jl case.default.0x1000fdb8
add eax, 0xfffffffe
lea edi, [ebx + 0xdf8]
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 4]
push 0
push dword [eax + 0x48]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, esi
jne 0x1000fde3
mov ecx, edi
call fcn.10024950
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x1000fdb8
jmp dword [eax*4 + 0x1000fef4]
mov ecx, edi
call fcn.10024c70
jmp case.default.0x1000fdb8
mov ecx, edi
call fcn.10024d60
jmp case.default.0x1000fdb8
mov ecx, edi
call fcn.10024f10
jmp case.default.0x1000fdb8
mov ecx, edi
call fcn.10024e50
jmp case.default.0x1000fdb8
mov ecx, dword [edi + 0x8c]
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push ebx
push method.Steinberg::Vst::AudioEffect.virtual_56
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000fedb
lea edi, [ebx + 0xdf8]
cmp eax, 0x402
jne 0x1000fe40
cmp byte [edi + 0x58], 0
je 0x1000fedb
mov ecx, edi
mov byte [edi + 0x58], 0
call fcn.10024c70
jmp 0x1000fedb
cmp eax, 0x403
jne 0x1000fe5e
cmp byte [edi + 0x59], 0
je 0x1000fedb
mov ecx, edi
mov byte [edi + 0x59], 0
call fcn.10024d60
jmp 0x1000fedb
cmp eax, 0x404
jne 0x1000feb1
cmp byte [edi + 0x5a], 0
je 0x1000fedb
cmp dword [edi + 0x8c], 0
mov byte [edi + 0x5a], 0
jne 0x1000fedb
push 0x13b8
call fcn.100925a9
mov esi, eax
mov dword [ebp + 0xc], esi
push 0x13b8
push 0
push esi
mov dword [ebp - 4], 0
call fcn.10094470
add esp, 0x10
mov ecx, esi
push edi
push dword [edi + 4]
call fcn.10026330
mov dword [edi + 0x8c], eax
jmp 0x1000fedb
push 0
push 0x100fd5a0
push 0x100fd578
push 0
push dword [edi + 0x8c]
call fcn.100b74ec
add esp, 0x14
test eax, eax
je 0x1000fedb
push dword [ebp + 0xc]
mov ecx, eax
call fcn.10027be0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010f60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
cmp byte [esi + 0xa60], 0
je 0x10010fc5
mov eax, dword [esi + 0x48]
mov byte [esi + 0xa60], 0
test eax, eax
je 0x10010f8a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0x7d0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0x3f800000
movups xmm0, xmmword [ebp - 0x14]
mov dword [esi + 0xdb4], 0
movups xmmword [esi + 0xddc], xmm0
mov dword [esi + 0xdec], 0x7d0
mov eax, dword [esi + 0x48]
mov byte [esi + 8], 0
pop edi
pop esi
test eax, eax
je 0x10010fdb
push 0
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov esp, ebp
pop ebp
ret

Function at 0x10014b20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0xf38], 0
mov edx, dword [ebp + 8]
je 0x10014b84
test byte [ebp + 0x10], 1
je 0x10014b84
mov eax, dword [ecx + 0xa58]
movd xmm1, edx
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100e8700]
comisd xmm1, xmm0
jbe 0x10014b84
push dword [ecx + 0x48]
sub eax, edx
mov byte [ecx + 0xf50], 1
mov dword [ecx + 0xf54], eax
mov eax, dword [ecx + 0xa5c]
sub eax, dword [ebp + 0xc]
mov dword [ecx + 0xf58], eax
call dword [sym.imp.USER32.dll_SetCapture]
pop ebp
ret 0xc
mov dword [ebp + 8], edx
pop ebp
jmp fcn.10057b50

Function at 0x10015dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add esi, 0xfffff09c
test edi, edi
jne 0x10015df3
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x48]
test eax, eax
je 0x10015e1a
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10015e1a
mov ecx, esi
call fcn.10010f60
mov ecx, esi
call fcn.1005a5d0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi + 0x48]
mov dword [esi + 0x4c], edi
test eax, eax
je 0x10015e2e
push edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x10015e3c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, esi
call fcn.10059ce0
cmp byte [esi + 0xa60], 1
je 0x10015eaa
cmp dword [esi + 0x48], 0
mov byte [esi + 0xa60], 1
je 0x10015e6f
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
push 5
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0x7d0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0x3f800000
movups xmm0, xmmword [ebp - 0x14]
mov dword [esi + 0xdb4], 0
movups xmmword [esi + 0xddc], xmm0
mov dword [esi + 0xdec], 0x7d0
pop edi
mov byte [esi + 8], 1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020610
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbb00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100fbe80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x24], esi
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi], vtable.RRS::CPurchase.0
movups xmmword [esi + 8], xmm0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], ax
mov dword [ebp - 4], eax
xor ecx, ecx
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 7
mov word [esi + 0x20], cx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], 0x3f800347
mov word [esi + 0x58], cx
mov byte [esi + 0x5a], cl
movups xmmword [esi + 0x5c], xmm0
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], 7
mov word [esi + 0x5c], ax
movups xmmword [esi + 0x74], xmm0
mov dword [esi + 0x84], ecx
mov dword [esi + 0x88], 7
mov word [esi + 0x74], ax
push ecx
push ecx
push ecx
mov byte [ebp - 4], 8
push ecx
mov dword [esi + 0x8c], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x100224c0
push 0
push 0
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x3c]
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1c]
mov dword [esi + 0x3c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push eax
movq qword [ebp - 0x1c], xmm0
call fcn.100209d0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
je 0x10020759
push eax
lea ecx, [esi + 8]
mov dword [esi + 0x54], 0x3f800000
call fcn.100159c0
mov eax, dword [ebp - 0x1c]
lea ecx, [esi + 0x20]
add eax, 0x18
push eax
call fcn.100159c0
lea ecx, [ebp - 0x1c]
call fcn.10015ba0
push 0
push 0
push 0x405
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_GetThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0
push 0
push esi
push 0x100240b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10092561
mov esp, ebp
pop ebp
ret 4
Function at 0x10053a40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test eax, eax
je 0x10053acf
cmp byte [esi + 0xa60], 0
je 0x10053aa4
push 0
push eax
mov byte [esi + 0xa60], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0x7d0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0x3f800000
movups xmm0, xmmword [ebp - 0x14]
mov dword [esi + 0xdb4], 0
movups xmmword [esi + 0xddc], xmm0
mov dword [esi + 0xdec], 0x7d0
push esi
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x10103704]
mov dword [esi + 0x48], 0
push str.RRSGUIWindow
call dword [sym.imp.USER32.dll_UnregisterClassW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005c150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov dword [ebp - 4], ecx
call ebx
mov esi, dword [ebp + 0x10]
xor edi, edi
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
sub edx, esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
sub ecx, eax
movd xmm2, esi
mov esi, dword [ebp - 4]
movd xmm0, edx
movd xmm3, ecx
movd xmm4, eax
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm4, xmm4
movss dword [ebp - 0xc], xmm0
movss dword [ebp - 0x10], xmm2
movss dword [ebp - 0x14], xmm3
movss dword [ebp - 0x18], xmm4
nop dword [eax]
movd xmm1, edi
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x100e8848]
mulss xmm0, xmm1
addss xmm0, xmm2
cvttss2si eax, xmm0
movaps xmm0, xmm3
mulss xmm0, xmm1
movzx ecx, ax
shl ecx, 0x10
addss xmm0, xmm4
cvttss2si eax, xmm0
movzx eax, ax
or ecx, eax
push ecx
push 1
push 0x200
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
movss xmm0, dword [ebp - 0xc]
mov edi, eax
sub edi, dword [ebp - 8]
movss xmm2, dword [ebp - 0x10]
movss xmm3, dword [ebp - 0x14]
movss xmm4, dword [ebp - 0x18]
cmp edi, 0x64
jl 0x1005c1b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10066c40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x314]
test eax, eax
je 0x10066dc3
mov ecx, dword [ebp + 8]
mov dword [edi + 0x318], ecx
test ecx, ecx
jne 0x10066c73
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx]
push 1
call dword [eax + 0x20]
mov ecx, dword [edi + 0x314]
test ecx, ecx
je 0x10066c94
cmp dword [eax + 0x14], 8
jb 0x10066c8c
mov eax, dword [eax]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
movss xmm1, dword [edi + 0x168]
comiss xmm1, dword [0x100e88cc]
movss xmm0, dword [edi + 0x164]
jb 0x10066ce3
movss xmm2, dword [0x100e869c]
comiss xmm2, xmm1
jb 0x10066ce3
mov eax, dword [edi + 4]
xorps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x10066ccd
mov eax, dword [eax + 0xa58]
jmp 0x10066cd3
mov eax, dword [eax + 0xa5c]
call fcn.1002bc10
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
movss dword [ebp + 8], xmm0
fld dword [ebp + 8]
push ecx
fstp dword [esp]
call fcn.100b9090
movss xmm2, dword [edi + 0x154]
add esp, 4
comiss xmm2, dword [0x100e88cc]
movss xmm0, dword [edi + 0x150]
fstp dword [ebp - 4]
jb 0x10066d49
movss xmm1, dword [0x100e869c]
comiss xmm1, xmm2
jb 0x10066d49
mov eax, dword [edi + 4]
xorps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x10066d33
mov eax, dword [eax + 0xa5c]
jmp 0x10066d39
mov eax, dword [eax + 0xa58]
call fcn.1002bc10
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
cvttss2si eax, dword [ebp - 4]
mov esi, dword [edi + 4]
push 0
movss dword [ebp + 8], xmm0
fld dword [ebp + 8]
push eax
push ecx
fstp dword [esp]
call fcn.100b9090
add esp, 4
call fcn.100b6e60
push eax
mov eax, dword [esi + 0xa48]
add eax, dword [esi + 0xa40]
push eax
mov eax, dword [esi + 0xa44]
add eax, dword [esi + 0xa3c]
push eax
push dword [edi + 0x314]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [edi + 0x314]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [edi + 0x314]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi + 0x314]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10066dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be2ed
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100fbe80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x318], 0
je 0x10066e6f
mov edx, dword [edi + 0x314]
lea ecx, [ebp - 0x28]
call fcn.1007a0c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov eax, dword [edi + 0x318]
xorps xmm1, xmm1
mov esi, dword [eax]
call fcn.100155b0
push ecx
mov ecx, dword [edi + 0x318]
movss dword [esp], xmm0
call dword [esi + 0x30]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x10066e6f
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10066e65
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10066e9d
push ecx
push edx
call fcn.10092592
add esp, 8
mov eax, dword [edi + 0x314]
test eax, eax
je 0x10066e8c
push 0
push eax
mov dword [edi + 0x318], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10097635
int3
Function at 0x1006a950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x100fbe80]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
cmp dword [esi + 0x10], 0
jne 0x1006a985
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.10092561
mov esp, ebp
pop ebp
ret
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x40], 0
push eax
mov ecx, esi
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
mov dword [esp + 0x64], 0
mov dword [esp + 0x2c], 0x3c
mov dword [esp + 0x30], 0
call fcn.1000c340
cmp dword [esp + 0x20], 8
lea edi, [esp + 0xc]
mov edx, dword [esp + 0x1c]
cmovae edi, dword [esp + 0xc]
cmp edx, 3
jne 0x1006aa15
mov ecx, 0x100e5b3c
test edx, edx
je 0x1006aa11
sub edi, ecx
nop word [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x1006aa15
add ecx, 2
sub edx, 1
jne 0x1006aa00
mov cl, 1
jmp 0x1006aa17
xor cl, cl
test cl, cl
mov eax, str.runas
mov edx, str.open
cmove eax, edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
cmp eax, 8
jb 0x1006aa62
mov edx, dword [esp + 0xc]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006aa58
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006aab2
push ecx
push edx
call fcn.10092592
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x1006aa6a
mov esi, dword [esi]
cmp dword [ebx + 0x14], 8
mov dword [esp + 0x38], esi
jb 0x1006aa76
mov ebx, dword [ebx]
lea eax, [esp + 0x28]
mov dword [esp + 0x3c], ebx
push eax
mov dword [esp + 0x48], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x1006aa9e
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, dword [esp + 0x64]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10092561
mov esp, ebp
pop ebp
ret
call fcn.10097635
int3
Function at 0x1006c510
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bea72
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x100fbe80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call fcn.10094470
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 5
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1006c6c3
xorps xmm0, xmm0
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 0
movups xmmword [ebp - 0x234], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c5e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.1000db40
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x234]
call fcn.1000cfe0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x21c], 3
push eax
mov ecx, esi
call fcn.1000d830
mov ecx, dword [ebp - 0x240]
cmp ecx, 8
jb 0x1006c66f
mov edx, dword [ebp - 0x254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006c665
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006c6df
push ecx
push edx
call fcn.10092592
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x220]
cmp ecx, 8
jb 0x1006c6af
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006c6a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006c6df
push ecx
push edx
call fcn.10092592
add esp, 8
cmp dword [esi + 0x10], 0
je 0x1006c6c3
push 1
push 0x100e1b3c
mov ecx, esi
call fcn.1000c560
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10092561
mov esp, ebp
pop ebp
ret
call fcn.10097635
int3
Function at 0x1006dca0
Capabilities:
Open clipboard
Write clipboard data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100fbe80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
cmp dword [esi + 0x10], 0
je 0x1006de19
test ebx, ebx
je 0x1006de19
mov edi, dword [ebp + 8]
test edi, edi
je 0x1006de19
mov edx, 0x101036b8
call fcn.1006da20
test al, al
jne 0x1006de19
mov edx, 0x101036d0
mov ecx, esi
call fcn.1006da20
mov ecx, esi
test al, al
je 0x1006dd17
push edi
mov edx, ebx
call fcn.1006bd20
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10092561
mov esp, ebp
pop ebp
ret
mov edx, 0x101036e8
call fcn.1006da20
xor ebx, ebx
test al, al
je 0x1006ddc6
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1006ddb3
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1006ddab
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x1006dda4
push edi
push dword [ebp - 0xc]
push eax
call fcn.10093e90
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [esi + 0x14], 8
jb 0x1006dd72
mov esi, dword [esi]
push esi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
test eax, eax
je 0x1006dda4
push ebx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x1006dda4
mov ebx, edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10092561
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor ebx, ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10092561
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
mov dword [ebp - 8], ebx
jb 0x1006ddd1
mov esi, dword [esi]
push 0x100e5ccc
lea eax, [ebp - 8]
push esi
push eax
call fcn.1009e8c9
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x1006de06
push eax
push edi
push 1
push dword [ebp - 0xc]
call fcn.1009eb2f
push dword [ebp - 8]
cmp eax, edi
cmove ebx, eax
call fcn.1009ec09
add esp, 0x14
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10092561
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10092561
mov esp, ebp
pop ebp
ret