joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a585
Capabilities:
Query environment variable

Disassembly:
push 8
mov eax, 0x1008091d
call fcn.1006a09e
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push 0x1009a394
lea esi, [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.100041e8
neg eax
sbb al, al
inc al
je 0x1000a5d3
mov eax, esi
call fcn.1000a871
push 0x22
call fcn.1000a6ae
cmp eax, 0xffffffff
jle 0x1000a608
mov ecx, eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.1000a926
mov byte [ebp - 4], 1
jmp 0x1000a5f2
push 0x25
lea esi, [ebp + 0xc]
call fcn.1000a6ae
cmp eax, 0xffffffff
jle 0x1000a608
mov ecx, eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.1000a926
mov byte [ebp - 4], 2
lea edi, [ebp + 0xc]
call fcn.100023e1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
lea eax, [ebp + 0xc]
call fcn.1000a71f
mov eax, dword [0x100b27b4]
mov ecx, 0x100b27b4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov edi, 0x104
push edi
mov byte [ebp - 4], 3
mov ebx, dword [ebp + 0xc]
push edi
lea esi, [ebp - 0x14]
call fcn.10002938
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
call fcn.10002668
cmp ebx, edi
jg 0x1000a656
mov eax, esi
lea edi, [ebp + 0xc]
call fcn.100023e1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10002aac
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, esi
call fcn.1006a176
ret

Function at 0x1000af02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000af66
cmp dword [ebp + 0xc], 1
je 0x1000af3e
cmp dword [ebp + 0xc], 2
je 0x1000af3e
push 0xd
pop eax
jmp 0x1000af66
mov eax, dword [ebp - 4]
test edi, edi
je 0x1000af60
test eax, eax
je 0x1000af5b
test al, 1
jne 0x1000af39
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1000af60
jmp 0x1000af39
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x1000c359
Capabilities:
Create thread

Disassembly:
xor edx, edx
cmp dword [ecx + 0x28], edx
jbe 0x1000c36e
mov eax, dword [ecx + 0x24]
mov eax, dword [eax]
cmp eax, edx
je 0x1000c36e
jmp fcn.1000bb1f
mov byte [ecx + 0x34], dl
ret

Function at 0x1000c372
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x10082db1
call fcn.1006a09e
mov ebx, ecx
mov eax, dword [ebx + 8]
cmp eax, 2
sete al
test al, al
je 0x1000c47a
lea esi, [ebp - 0x14]
mov eax, ebx
call fcn.1000bf8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x100998a8
push ecx
mov ecx, eax
call fcn.10002473
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ecx
pop ecx
push dword [eax]
call esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10002b29
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.1000bfd9
lea ecx, [ebp - 0x18]
push 0x100998b0
push ecx
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10002473
pop ecx
pop ecx
push dword [eax]
call esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10002b29
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10002b29
mov dword [edi + 0x3c], 0x1e
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1000c44d
dec eax
jne 0x1000c44d
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, ebx
call fcn.1000bfd9
mov dword [ebp - 4], 2
call fcn.1002404a
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.10024380
cmp dword [edi + 0x28], 0
jbe 0x1000c4e3
lea esi, [edi + 0x24]
cmp dword [esi + 4], 0
ja 0x1000c46a
push 0x80070057
call fcn.10002b60
mov eax, dword [esi]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000c4d7
mov eax, dword [ecx]
push 1
call dword [eax]
jmp 0x1000c4d7
xor esi, esi
cmp dword [edi + 0x3c], 0x5a
ja 0x1000c4ba
cmp dword [ebx + 0x10], esi
je 0x1000c4ba
mov eax, dword [edi + 0x38]
cmp eax, esi
je 0x1000c49b
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi + 0x38], esi
mov eax, dword [edi + 0x3c]
imul eax, eax, 0x3e8
push esi
push eax
push 0xa
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
add dword [edi + 0x3c], 0x1e
mov dword [edi + 0x38], eax
jmp 0x1000c4e3
cmp dword [edi + 0x28], esi
jbe 0x1000c4e3
lea ebx, [edi + 0x24]
cmp dword [ebx + 4], esi
jbe 0x1000c460
mov eax, dword [ebx]
mov ecx, dword [eax]
cmp ecx, esi
je 0x1000c4d5
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, ebx
call fcn.1000c7ac
mov ecx, edi
call fcn.1000c359
call fcn.1006a176
ret
Function at 0x1000d544
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0x14
push ebx
push edi
jne 0x1000d65c
push dword [esi + 0x24]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push dword [esi + 4]
call edi
and dword [esi + 0x24], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esi + 0x30]
je 0x1000d59a
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1000d583
push eax
push dword [esi + 4]
call edi
push 0
push 0x64
push 0x15
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x28], eax
jmp 0x1000d648
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_MonitorFromPoint]
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea ecx, [ebp - 0x58]
push ecx
push eax
mov dword [ebp - 0x58], 0x28
call ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push 2
push dword [ebp - 4]
push dword [ebp - 8]
call edi
lea ecx, [ebp - 0x58]
push ecx
push eax
mov dword [ebp - 0x58], 0x28
call ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
je 0x1000d625
push dword [ebp - 4]
lea eax, [ebp - 0x30]
push dword [ebp - 8]
push eax
call edi
test eax, eax
jne 0x1000d648
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1000d636
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x32
push 0x16
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x2c], eax
push 0
push 0x64
push 0x14
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x24], eax
jmp 0x1000d6d0
cmp dword [ebp + 8], 0x15
jne 0x1000d6ad
push dword [esi + 0x28]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
and dword [esi + 0x28], 0
push 1
call ebx
mov edi, 0x8000
mov ecx, edi
and ax, cx
cmp ax, cx
je 0x1000d699
push 2
call ebx
mov ecx, edi
and ax, cx
cmp ax, di
jne 0x1000d6c3
push 0
push 0x64
push 0x15
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x28], eax
jmp 0x1000d6d0
cmp dword [ebp + 8], 0x16
jne 0x1000d6d0
push dword [esi + 0x2c]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [esi + 0x2c], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], 1
xor eax, eax
pop ebx
leave
ret 8
Function at 0x1000d992
Capabilities:
Check mutex on windows

Disassembly:
push 0x100997d0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x1000d9c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000d9bd
push 0xbb8
push dword [esi]
jmp 0x1000d9dc
cmp dword [esi], 0
jne 0x1000d9e2
push str.Global71C6E2D5_E762_40BC_9CB6_B3C757FD699C
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0xbb8
mov dword [esi], eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x1000da4f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea ebx, [edi + 0xc]
push ebx
push str.VBScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea esi, [edi + 0x24]
push esi
push 0x1009d8cc
push 1
push 0
push ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
jge 0x1000da8d
push str.Failed_to_create_scripting_engine._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebx
jmp 0x1000daed
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi]
mov ecx, dword [eax]
lea ebx, [edi + 0x28]
push ebx
push 0x1009d8dc
push eax
call dword [ecx]
mov dword [ebp - 4], eax
test eax, eax
jge 0x1000dabc
push str.Engine_doesnt_support_IActiveScriptParse._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 4]
jmp 0x1000daed
mov esi, dword [esi]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jge 0x1000dad2
push str.Error_calling_SetScriptSite_n
jmp 0x1000dae5
mov ebx, dword [ebx]
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jge 0x1000daed
push str.Error_calling_InitNew_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1000daf1
Capabilities:
Print debug messages

Disassembly:
push 0
mov eax, 0x1008057f
call fcn.1006a09e
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
jne 0x1000db12
xor ebx, ebx
inc ebx
jmp 0x1000db9c
lea eax, [esi + 0x20]
push eax
call fcn.1000ddde
mov ebx, eax
cmp ebx, edi
jl 0x1000db9c
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push 6
push 0x10099614
push eax
call dword [ecx + 0x20]
mov ebx, eax
cmp ebx, edi
jl 0x1000db9c
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
cmp eax, edi
jne 0x1000db56
call fcn.1002c260
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push ecx
call dword [edx + 0x14]
mov ebx, eax
cmp ebx, edi
jge 0x1000db7b
push str.Error_calling_ParseScriptText_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000db9c
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x14]
mov ebx, eax
cmp ebx, edi
jge 0x1000db93
push str.Error_calling_SetScriptState_n
jmp 0x1000db73
mov eax, dword [esi + 0x20]
mov al, byte [eax + 8]
mov byte [esi + 0x2c], al
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, ebx
call fcn.1006a176
ret 4
Function at 0x1000ed80
Capabilities:
Hide graphical window
Log keystrokes via application hook

Disassembly:
push 0x20
mov eax, 0x100851ec
call fcn.1006a09e
call fcn.10011263
call fcn.1001143e
cmp eax, 4
je 0x1000ef43
cmp eax, 1
je 0x1000edd4
cmp eax, 2
je 0x1000edd4
cmp eax, 6
je 0x1000edd4
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10011263
mov esi, eax
call fcn.100303c2
call fcn.10011263
call fcn.10013917
jmp 0x1000ef43
mov cl, byte [edi + 0x24]
test cl, cl
jne 0x1000ef4c
cmp eax, 1
sete byte [ebp - 0xd]
mov byte [edi + 0x24], 1
cmp byte [ebp - 0xd], cl
je 0x1000edf9
call fcn.10011263
call fcn.10013a66
lea eax, [ebp - 0x2c]
push str.Msg_ConfirmCancelTitle
push eax
call fcn.10016880
push eax
call fcn.10016ba6
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push str.Msg_ConfirmCancelText
push eax
call fcn.10016880
push eax
call fcn.10016ba6
mov byte [ebp - 4], 1
call fcn.10011263
mov esi, eax
call fcn.100112be
lea esi, [ebp - 0x1c]
mov ebx, eax
call fcn.1002d61f
mov byte [ebp - 4], 2
test ebx, ebx
je 0x1000ee52
lea eax, [ebx + 0x100]
call fcn.1002d91d
call fcn.10011263
call fcn.100112d2
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x2c]
call fcn.1002db76
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x24]
call fcn.1002db76
call fcn.10011263
mov dword [eax + 0x44c], 2
mov eax, dword [edi + 4]
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x10010ee9
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0x41
push esi
push ebx
push dword [ebp - 0x14]
mov dword [0x100b3318], eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x1000ef03
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10011263
mov esi, eax
call fcn.100303c2
call fcn.10011263
mov esi, eax
call fcn.100112be
test eax, eax
je 0x1000eeed
mov dword [eax + 0x180], 2
call fcn.10011263
call fcn.100112d2
call fcn.10011263
call fcn.10013917
jmp 0x1000ef13
cmp byte [ebp - 0xd], 0
je 0x1000ef13
call fcn.10011263
call fcn.10013aa5
xor esi, esi
mov byte [edi + 0x24], 0
cmp dword [ebp - 0x1c], esi
je 0x1000ef27
push dword [ebp - 0x1c]
call fcn.10060146
pop ecx
cmp dword [ebp - 0x24], esi
je 0x1000ef35
push dword [ebp - 0x24]
call fcn.10060146
pop ecx
cmp dword [ebp - 0x2c], esi
je 0x1000ef43
push dword [ebp - 0x2c]
call fcn.10060146
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax], 1
xor eax, eax
call fcn.1006a176
ret 4
Function at 0x1000f1ce
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x10084a78
call fcn.1006a09e
call fcn.10011263
call fcn.1001143e
cmp eax, 5
jne 0x1000f301
call fcn.10011263
mov esi, eax
call fcn.100112be
mov ebx, eax
mov eax, dword [0x100b27b4]
mov esi, 0x100b27b4
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [0x100b27b4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [0x100b27b4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1002d074
lea esi, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.1002d074
mov byte [ebp - 4], 4
cmp ebx, edi
je 0x1000f298
lea eax, [ebx + 0x74]
lea edi, [ebp - 0x18]
call fcn.100023e1
lea eax, [ebx + 0x78]
lea edi, [ebp - 0x14]
call fcn.100023e1
lea eax, [ebx + 0x7c]
lea edi, [ebp - 0x10]
call fcn.100023e1
push dword [ebx + 0x84]
lea esi, [ebp - 0x28]
call fcn.1002d486
push dword [ebx + 0x140]
lea esi, [ebp - 0x20]
call fcn.1002d486
xor edi, edi
call fcn.10011263
call fcn.100112d2
mov eax, dword [ebp + 8]
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10011263
mov esi, eax
call fcn.100303c2
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [ebp - 0x20], edi
je 0x1000f2d0
push dword [ebp - 0x20]
call fcn.10060146
pop ecx
cmp dword [ebp - 0x28], edi
je 0x1000f2de
push dword [ebp - 0x28]
call fcn.10060146
pop ecx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10002b29
jmp 0x1000f334
cmp eax, 3
jne 0x1000f32a
mov eax, dword [ebp + 8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10011263
mov esi, eax
call fcn.100303c2
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1000f334
mov edi, dword [ebp + 8]
push 1
call fcn.1000f3f2
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
xor eax, eax
call fcn.1006a176
ret 8
Function at 0x1000f3f2
Capabilities:
Create thread

Disassembly:
push 0x18
mov eax, 0x10084a35
call fcn.1006a09e
call fcn.10011263
call fcn.1001143e
mov esi, eax
cmp esi, 3
jne 0x1000f439
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000f5cc
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x1000f5cc
call fcn.10011263
call fcn.1001143e
cmp eax, 5
sete bl
call fcn.1000faf6
mov byte [ebp - 0x11], al
test bl, bl
jne 0x1000f45e
test al, al
je 0x1000f45e
cmp byte [ebp + 8], bl
je 0x1000f487
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000f47f
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test bl, bl
jne 0x1000f5cc
cmp byte [ebp - 0x11], 0
je 0x1000f5cc
cmp esi, 4
je 0x1000f5cc
push 4
call fcn.10011263
mov esi, eax
call fcn.10011461
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
test eax, eax
je 0x1000f4c5
push 3
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
lea eax, [ebp - 0x1c]
push str.Msg_Installing
push eax
call fcn.10016880
push eax
call fcn.10016ba6
and dword [ebp - 4], 0
lea esi, [ebp - 0x24]
call fcn.1002d61f
mov byte [ebp - 4], 1
call fcn.10011263
mov esi, eax
call fcn.100112be
test eax, eax
je 0x1000f506
add eax, 0x100
lea esi, [ebp - 0x24]
call fcn.1002d91d
call fcn.10011263
call fcn.100112d2
lea eax, [ebp - 0x24]
push eax
lea ebx, [ebp - 0x1c]
call fcn.1002db76
push dword [ebp - 0x1c]
mov ebx, edi
call fcn.1000fba6
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov esi, esp
mov dword [ebp + 8], esp
push eax
call fcn.1002d6ae
mov byte [ebp - 4], 2
call fcn.10011263
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10013d9d
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e9
push dword [edi + 4]
call esi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x32
push 1
push 0x40a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3ef
push dword [edi + 4]
call esi
xor esi, esi
push esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.10011263
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x10011489
push esi
push esi
call fcn.10061b68
add esp, 0x18
cmp dword [ebp - 0x24], esi
je 0x1000f5be
push dword [ebp - 0x24]
call fcn.10060146
pop ecx
cmp dword [ebp - 0x1c], esi
je 0x1000f5cc
push dword [ebp - 0x1c]
call fcn.10060146
pop ecx
call fcn.1006a176
ret 4
Function at 0x100107b0
Capabilities:
Check mutex on windows

Disassembly:
push 0x10099118
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x100107dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100107dd
push 0x3e8
push dword [esi + 4]
jmp 0x100107fe
cmp dword [esi + 4], 0
jne 0x10010804
push str.Global223CEB62_A2BC_4E33_BA9B_FCAC6DAAB1BE
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0x3e8
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x10013659
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x10084a02
call fcn.1006a09e
call fcn.10011263
mov esi, eax
call fcn.100112be
xor ebx, ebx
cmp eax, ebx
je 0x1001367f
mov edi, dword [eax + 0x14c]
jmp 0x10013681
xor edi, edi
cmp eax, ebx
je 0x10013690
push eax
call fcn.1002b5fe
mov byte [ebp - 0x11], al
jmp 0x10013693
mov byte [ebp - 0x11], bl
call fcn.10011263
call fcn.100112d2
cmp byte [ebp - 0x11], bl
jne 0x100137db
mov eax, dword [ebp + 8]
call fcn.10011326
cmp eax, edi
je 0x100137db
call fcn.10011263
mov esi, eax
call fcn.100112be
mov esi, dword [ebp + 8]
mov edi, eax
call fcn.100113ff
test al, al
jne 0x10013743
lea eax, [ebp - 0x20]
push 0x10098b6c
push eax
call fcn.10016880
push eax
call fcn.10016ba6
mov dword [ebp - 4], 2
cmp edi, ebx
je 0x100136f7
mov eax, dword [edi + 0x100]
jmp 0x100136fc
mov eax, 0x1008fc3a
push eax
lea esi, [ebp - 0x2c]
call fcn.1002d76d
mov eax, esi
push eax
lea ebx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.1002db76
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
call fcn.10030441
cmp dword [ebp - 0x2c], 0
je 0x1001372e
push dword [ebp - 0x2c]
call fcn.10060146
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], 0
je 0x10013741
push dword [ebp - 0x20]
call fcn.10060146
pop ecx
xor ebx, ebx
lea esi, [ebp - 0x2c]
call fcn.1002d074
push 4
pop eax
mov dword [ebp - 4], eax
cmp edi, ebx
je 0x1001376a
push 1
push eax
mov ecx, edi
call fcn.1002640d
push dword [edi + 0x130]
call fcn.1002d486
call fcn.10011263
call fcn.100112d2
push ecx
push ecx
mov esi, esp
mov dword [ebp - 0x18], esp
push str.Fail_Lang:
call fcn.1002d08b
push ecx
push ecx
mov byte [ebp - 4], 5
mov esi, esp
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x2c]
call fcn.1002d08b
push 2
mov byte [ebp - 4], 4
call fcn.10025ba2
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 0x10012804
push ebx
push ebx
call fcn.10061b68
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx + 0x450], eax
cmp dword [ebp - 0x2c], ebx
je 0x10013881
push dword [ebp - 0x2c]
call fcn.10060146
pop ecx
jmp 0x10013881
call fcn.10011263
mov esi, eax
call fcn.10011305
mov esi, eax
cmp esi, ebx
je 0x1001380a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001380a
push ebx
push ebx
push 0x4c8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.10011263
call fcn.10011319
mov eax, dword [0x100b27b4]
mov ecx, 0x100b27b4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
push edi
call fcn.10011326
push eax
movzx eax, byte [ebp - 0x11]
push eax
push str.COCDownloadManager::DLMPrepareOffer:_download_completed_already._download:_d_progress:_d_filesize:_d
lea eax, [ebp - 0x18]
call fcn.1000261c
mov esi, dword [ebp - 0x18]
add esp, 0x10
push ebx
push ebx
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [ebp + 8], esp
mov edi, esp
call fcn.10002aac
add eax, 0x10
mov dword [edi], eax
push ebx
push ebx
push ecx
mov byte [ebp - 4], 1
call fcn.1001a54d
pop ecx
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.1001f748
mov eax, esi
call fcn.10002b29
call fcn.1006a176
ret 4
Function at 0x100154a5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.1002e1b1
test al, al
jne 0x100154ba
xor eax, eax
jmp 0x10015515
call sym.OCSetupHlp.dll_OCPRD1379OpenCandy32
test eax, eax
jne 0x100154b6
push ecx
mov eax, esp
mov dword [ebp - 4], esp
push eax
mov ecx, str.SDK_OCSignalProductInstalled_called.
call fcn.10002a34
call fcn.1002100c
mov edi, eax
call fcn.10022d46
call fcn.1002100c
mov esi, eax
push esi
call fcn.100215e2
test al, al
jne 0x100154f6
push 4
pop eax
jmp 0x10015515
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x4a
push dword [esi + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xd
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
leave
ret

Function at 0x10015882
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call sym.OCSetupHlp.dll_OCPRD1379OpenCandy32
test eax, eax
jne 0x1001595e
mov eax, dword [0x100b27b4]
mov ecx, 0x100b27b4
call dword [eax + 0xc]
push dword [ebp + 0x10]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call fcn.1000724e
push dword [eax]
lea eax, [ebp - 4]
push str.SDK_Display_called:_lpszCmdLine:_s
call fcn.1000261c
mov eax, dword [ebp - 8]
add esp, 0x10
add eax, 0xfffffff0
call fcn.10002b29
mov ebx, dword [ebp - 4]
push ecx
add ebx, 0xfffffff0
mov eax, ebx
mov dword [ebp - 8], esp
mov esi, esp
call fcn.10002aac
add eax, 0x10
mov dword [esi], eax
call fcn.1002100c
mov edi, eax
call fcn.10022d46
push 0x1000
call fcn.1005fb39
mov esi, eax
push esi
push 0x800
push dword [ebp + 0x10]
call fcn.10030739
push 7
push 0x10097338
push dword [ebp + 0x10]
call fcn.10061d2b
add esp, 0x1c
test eax, eax
je 0x1001593d
push 8
push 0x100972e4
push dword [ebp + 0x10]
call fcn.10061d2b
add esp, 0xc
test eax, eax
jne 0x10015950
push 1
xor eax, eax
push eax
push eax
push esi
push 0x10097340
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call fcn.10060146
pop ecx
mov eax, ebx
call fcn.10002b29
pop edi
pop esi
pop ebx
leave
ret 0x10