joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e42ae4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, str.There_is_nothing_to_unexport.
mov ebp, esp
push ebx
mov ebx, 0xa3a
sub esp, 0x14
mov eax, dword [0x5e58268]
xor eax, 0x92d5b9e1
mov edx, eax
or edx, 0x65a236b4
imul edx, edx, 0x3c570744
mov dword [0x5e5812c], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x5e42b25
add ebx, edx
cmp ebx, 0xaa1
jbe 0x5e42b13
imul eax, eax, 0x216b6915
mov edx, dword [0x5e58270]
xor edx, 0x4e4f0e45
mov dword [0x5e58268], edx
mov dword [0x5e581d0], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, dword [0x5e5812c]
push eax
mov eax, dword [0x5e58270]
mov ecx, eax
and ecx, 0x1115c584
mov dword [0x5e58268], ecx
imul ecx, edx, 0x7da87e44
cmp byte [str.There_is_nothing_to_unexport.], 0
mov dword [0x5e581d0], ecx
je 0x5e42b86
xor edx, 0x2dba8165
mov dword [0x5e581d0], edx
mov edx, dword [0x5e581d0]
and eax, 0x1058584
mov dword [0x5e581d0], eax
xor edx, 0x4e6a3b89
mov dword [0x5e58270], edx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
sub dword [0x5e581d0], 0x13071e7b
mov edx, eax
and eax, 0x68480a08
and edx, 0x696a5eab
mov dword [0x5e58270], eax
mov dword [0x5e5812c], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
cmp word [eax + str.Failed_to_allocate_DB_structure], 0
je 0x5e42bf5
add eax, 2
cmp eax, 0xadc
jne 0x5e42bd2
imul eax, dword [0x5e58268], 0x90a9504a
mov dword [0x5e5812c], eax
mov edx, dword [0x5e5812c]
mov ebx, dword [ebp - 4]
imul eax, edx, 0x221f65fe
add edx, 0x5e813325
mov dword [0x5e581d0], edx
mov dword [0x5e58270], eax
xor eax, 0x769d72f3
mov dword [0x5e58268], eax
leave
ret

Function at 0x5e42c24
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5e57e18]
or eax, 0x73a295f3
mov dword [0x5e58148], eax
cmp word [edx + str.Address_of_the_debug_info_found_in_the_active_list.], 0
je 0x5e42c5a
add edx, 2
cmp edx, 0xa3c
jne 0x5e42c3b
xor eax, 0x313519d0
mov dword [0x5e57e18], eax
imul eax, dword [str.IM], 0xad196c29
mov dword [esp], str.Failed_to_get_the_database_id
mov dword [str.IM], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x5e58194]
push eax
mov eax, dword [0x5e58148]
lea edx, [ecx - 0x3c67f211]
mov ecx, dword [0x5e57e18]
add eax, 0xfd08b1
mov dword [str.IM], edx
or eax, 0x726f7557
lea edx, [ecx + 0x6e864ff5]
mov dword [0x5e58194], eax
xor eax, 0xc924d061
mov dword [0x5e57e18], eax
mov eax, edx
xor eax, 0x1a40b7e9
mov dword [0x5e58148], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [str.IM]
movzx eax, ax
xor eax, 0xa1300eae
or edx, 0x66570b33
add eax, 0x6e7224c4
mov dword [0x5e58148], edx
mov edx, eax
mov dword [0x5e58194], eax
and edx, 0xc7468753
mov dword [str.IM], edx
leave
ret
Function at 0x5e436bc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x480
push ebx
mov ebx, str.An_invalid_allocation_instance_is_being_referenced.
sub esp, 0x2c
mov eax, dword [0x5e57f6c]
imul edx, dword [0x5e5807c], 0xaab6a478
mov dword [0x5e580d4], edx
movzx ecx, byte [ebx]
inc ebx
test cl, cl
je 0x5e436f6
add esi, ecx
cmp esi, 0x169c
jbe 0x5e436e4
and eax, 0x6529c3b9
mov ebx, str.Error_getting_StringRef
mov esi, 0x51f
mov dword [0x5e58278], eax
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
je 0x5e4372a
add esi, ecx
cmp esi, 0x5e1
jbe 0x5e4370a
imul eax, eax, 0xb78c5f1
mov dword [0x5e58278], eax
mov eax, edx
or edx, 0xf95ff9df
or eax, 0xe94de1db
mov dword [0x5e57f6c], edx
mov dword [0x5e5807c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str._cHRM_WhitePointY
mov ecx, 0x332
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x5e43767
add ecx, eax
cmp ecx, 0x2539
jbe 0x5e43752
mov eax, dword [0x5e5807c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
xor dword [0x5e57f6c], 0x9aad6811
add eax, 0x424d5dc9
imul edx, eax, 0x73f863d3
mov dword [0x5e580d4], eax
mov dword [0x5e58278], edx
mov dword [esp], eax
call ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push ecx
mov eax, dword [0x5e58278]
imul edx, eax, 0xb0da069e
imul eax, eax, 0x52f647
mov dword [0x5e580d4], edx
add eax, 0x31231de3
mov dword [0x5e58278], eax
mov eax, dword [0x5e57f6c]
xor eax, 0x9463f68e
mov dword [0x5e5807c], eax
mov dword [esp], 0x182f
call esi
push edi
mov eax, dword [0x5e57f6c]
mov edi, 0x278
and eax, 0xccedbdc1
mov dword [0x5e58278], eax
mov dword [esp], 0x17f
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, str.Error_getting_StringRef
push edx
mov dword [ebp - 0x1c], eax
imul eax, eax, 0x1d747208
mov dword [0x5e58278], eax
mov eax, dword [0x5e580d4]
lea edx, [eax - 0x1593c4a]
mov dword [0x5e5807c], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x5e43840
add edi, edx
cmp edi, 0x422
jbe 0x5e4381e
imul edx, dword [ebp - 0x1c], 0x4c52b620
mov dword [0x5e58278], edx
lea edx, [eax + 0x14d167e9]
and eax, 0xf81bbd5e
mov dword [0x5e57f6c], edx
mov dword [0x5e580d4], eax
mov dword [esp], 0x160c
call esi
push eax
mov eax, dword [0x5e57f6c]
imul edx, eax, 0x3d550071
mov dword [0x5e580d4], edx
imul edx, eax, 0x5b0ff972
mov dword [0x5e5807c], edx
mov dword [esp], eax
call ebx
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5e44004
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
cmp byte [eax + str.The_requested_authentication_level_is_not_supported.], 0
je 0x5e4402c
inc eax
cmp eax, 0x389
jne 0x5e4400c
mov eax, dword [0x5e57e1c]
and eax, 0x35dc1bf
mov dword [0x5e58124], eax
mov eax, dword [0x5e58124]
xor edx, edx
xor eax, 0xdef073ef
imul eax, eax, 0xc89eeb60
mov dword [0x5e58124], eax
cmp byte [edx + str.VirtualProtect_Failed_0x_p__x], 0
je 0x5e4405f
inc edx
cmp edx, 0x1f0c
jne 0x5e44043
add eax, 0x1e842299
mov dword [0x5e58124], eax
mov eax, dword [0x5e58124]
add eax, 0x52a0507c
mov dword [0x5e57e1c], eax
xor eax, 0xfd2ab719
imul eax, eax, 0x7a0ace19
mov dword [0x5e58124], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x5e57e1c]
mov dword [esp], 0x1cab
lea edx, [eax + 0x40a288d0]
add eax, 0x32bbd0dd
mov dword [0x5e58124], eax
mov dword [0x5e57e1c], edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x5e57e1c]
imul ecx, eax, 0x6816cefc
lea edx, [ecx - 0x1b9ec692]
mov dword [0x5e58124], edx
xor edx, edx
cmp byte [edx + str.Windows.WindowsPhone8x], 0
je 0x5e440e4
inc edx
cmp edx, 0x899
jne 0x5e440c6
add ecx, 0x3b9dfa17
mov dword [0x5e58124], ecx
and eax, 0x82bfbaca
mov dword [0x5e57e1c], eax
mov eax, dword [0x5e58124]
and eax, 0x60fb5fd5
xor eax, 0x2713600
mov dword [0x5e58124], eax
leave
ret
Function at 0x5e44630
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
cmp byte [eax + str.Signature_Size], 0
je 0x5e44659
inc eax
cmp eax, 0xeab
jne 0x5e44639
imul eax, dword [0x5e581d8], 0xb5666d
mov dword [0x5e57d88], eax
mov eax, dword [0x5e58154]
xor edx, edx
cmp byte [edx + 0x5e59520], 0
je 0x5e44684
inc edx
cmp edx, 0x189b
jne 0x5e44660
mov ebx, dword [0x5e581d8]
lea edx, [ebx + 0x34db1a9d]
mov dword [0x5e57d88], edx
mov edx, eax
and edx, 0xb4908b88
cmp byte [str.StandardBias], 0
mov dword [0x5e581d8], edx
je 0x5e446a5
and dword [0x5e57d88], 0x84313e9f
imul edx, eax, 0x54d9fff4
mov ecx, 0x5e59520
or dword [0x5e57d88], 0x8e55875
mov dword [0x5e58198], edx
mov dl, byte [ecx]
test dl, dl
je 0x5e446e4
sub edx, 0x30
cmp dl, 9
jbe 0x5e446e1
imul eax, eax, 0x75c6af00
mov dword [0x5e58154], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x5e446e4
inc ecx
jmp 0x5e446c0
mov eax, dword [0x5e58198]
mov ecx, 0x5e59520
mov ebx, 0x18a
mov edx, eax
or edx, 0x8e40c9e7
mov dword [0x5e581d8], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x5e44722
add ebx, edx
cmp ebx, 0x81
jbe 0x5e44701
and eax, 0x6469cb10
or eax, 0x440c900
mov dword [0x5e581d8], eax
mov eax, dword [0x5e581d8]
xor edx, edx
sub eax, 0x36f17a99
imul eax, eax, 0x45f6420c
mov dword [0x5e581d8], eax
mov eax, dword [0x5e58154]
sub eax, 0x60d79036
cmp byte [edx + str.LockVariable], 0
je 0x5e44761
inc edx
cmp edx, 0x369
jne 0x5e44743
imul edx, eax, 0xe9d5180d
mov dword [0x5e581d8], edx
mov ecx, str.StandardBias
mov bl, byte [ecx]
lea edx, [ebx - 0x30]
cmp dl, 9
ja 0x5e44773
inc ecx
jmp 0x5e44766
or eax, 0x5181cc53
mov dword [esp], 0x25e4
mov dword [0x5e57d88], eax
mov eax, dword [0x5e581d8]
xor eax, 0x40a7deb
mov dword [0x5e58198], eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ebx, dword [ebp - 4]
xor eax, 0xf1110f7f
push edx
mov dword [0x5e581d8], eax
leave
ret
Function at 0x5e44d50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, 0x10c3
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edx, ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x5e44d7e
add ecx, eax
cmp ecx, 0x37f
jbe 0x5e44d69
mov eax, ebx
mov cx, word [eax]
lea edx, [ecx - 0x30]
cmp dx, 9
ja 0x5e44d91
add eax, 2
jmp 0x5e44d80
mov edx, edi
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x5e44da4
add edx, 2
jmp 0x5e44d93
mov eax, esi
mov edx, str.Specified_video_present_target_is_invalid.
or eax, 0xb8ba9145
mov dword [0x5e57e98], eax
mov al, byte [edx]
test al, al
je 0x5e44dd3
sub eax, 0x30
cmp al, 9
jbe 0x5e44dd0
mov eax, esi
xor eax, 0xaa17d2b2
mov dword [0x5e57e98], eax
jmp 0x5e44dd3
inc edx
jmp 0x5e44db5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, ebx
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x5e44dec
add edx, 2
jmp 0x5e44ddb
and esi, 0x9133a8f8
mov dword [0x5e57e98], esi
mov ax, word [ebx]
sub eax, 0x30
cmp ax, 9
ja 0x5e44e09
add ebx, 2
jmp 0x5e44df8
mov edx, 0x153a
movzx eax, word [edi]
add edi, 2
test ax, ax
je 0x5e44e23
add edx, eax
cmp edx, 0x1ed
jbe 0x5e44e0e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [0x5e57e98]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10011230
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x628], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
push 0x208
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ebx, ebx
push esi
push edi
call sym.odbcjt32.dll_InitDialogAgain
jmp 0x1001129e
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x624]
cmp bx, 0x1d
jb 0x100112a8
xor esi, esi
jmp 0x100112b4
movzx esi, bx
shl esi, 5
add esi, section..data
inc ebx
test esi, esi
je 0x1001147a
push dword [esi + 0x14]
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x10011298
mov ecx, dword [ebp - 0x628]
lea eax, [ebp - 0x210]
push 0x104
push eax
mov edx, esi
call fcn.100076e0
test ax, ax
jne 0x10011370
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xf
sub eax, 1
je 0x1001132e
sub eax, 1
je 0x1001146a
sub eax, 1
jne 0x10011298
mov eax, dword [ebp - 0x210]
mov edx, eax
test ecx, 0x2000000
je 0x10011321
xor eax, eax
test edx, edx
sete al
push 0
push eax
push 0xf1
jmp 0x10011291
push 0xa
lea eax, [ebp - 0x620]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll__ltow]
add esp, 0xc
test eax, eax
je 0x10011298
push 0xa
lea eax, [ebp - 0x620]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll__ltow]
add esp, 0xc
push eax
push 0
push 0xc
jmp 0x10011291
mov eax, dword [esi + 4]
cmp eax, 0x3ef
ja 0x10011410
je 0x100113fb
sub eax, 6
je 0x100113c6
sub eax, 2
jne 0x10011298
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x418], 0
je 0x100113b3
test eax, eax
jne 0x10011298
push 0xa
lea eax, [ebp - 0x210]
push eax
push 0x200
jmp 0x10011461
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x418], 0
je 0x100113eb
test eax, eax
jne 0x10011298
push 0xa
lea eax, [ebp - 0x210]
push eax
push 0x258
jmp 0x10011461
mov eax, dword [ebp - 0x628]
mov eax, dword [eax + 4]
push dword [eax + 0x1c]
push 0
push 0xc
jmp 0x10011291
cmp eax, 0x408
jne 0x10011298
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x418], 0
je 0x10011440
test eax, eax
jne 0x10011298
mov eax, dword [ebp - 0x628]
push 0xa
mov eax, dword [eax + 4]
cmp dword [eax + 0xa8], 0x1b
lea eax, [ebp - 0x210]
push eax
jne 0x1001145f
push 0x19
jmp 0x10011461
push 0x10
call dword [sym.imp.msvcrt.dll__ltow]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0xc
jmp 0x10011291
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret 8
Function at 0x10011d10
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x88
push edi
mov dword [ebp - 0x624], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x10011f38
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x429
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x620]
push eax
push 0x43a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x43b
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
je 0x10011dc9
cmp word [ebp - 0x620], 0
je 0x10011f53
cmp word [ebp - 0x418], 0
je 0x10011f53
push 0
push 0
push 0x147
push 0x42a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x150
push 0x42a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov cx, word [ebp - 0x210]
lea ebx, [eax + 1]
neg ebx
sbb ebx, ebx
and ebx, eax
test cx, cx
jne 0x10011f0e
push 0x420
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x34], 0
jne 0x10011efe
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x10011e5a
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10011e84
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x10011e67
push ecx
jmp 0x10011e6f
mov eax, dword [eax + 0x10]
test eax, eax
je 0x10011e84
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
cmp word [ebp - 0x210], 0
je 0x10011efe
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011e97
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x34]
test edx, edx
je 0x10011f53
lea esi, [ebp - 0x210]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10011ed4
sub esi, ecx
lea eax, [ebp - 0x210]
sar esi, 1
push eax
lea eax, [esi + 1]
push eax
push edx
call dword [sym.imp.msvcrt.dll_wcscpy_s]
mov esi, dword [ebp - 0x624]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.10010d10
mov cx, word [ebp - 0x210]
mov ax, word [ebp - 0x418]
cmp ebx, 1
jl 0x10011f2e
test cx, cx
je 0x10011f53
cmp word [ebp - 0x620], 0
je 0x10011f53
test ax, ax
je 0x10011f53
test cx, cx
jne 0x10011f4e
test ax, ax
jne 0x10011f53
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x10011f38
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret
Function at 0x10011f70
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov ebx, ecx
push edi
mov dword [ebp - 0x214], eax
xor edi, edi
jmp 0x10011f9c
mov eax, dword [ebp - 0x214]
cmp di, 0x1d
jb 0x10011fa6
xor esi, esi
jmp 0x10011fb2
movzx esi, di
shl esi, 5
add esi, section..data
inc edi
test esi, esi
je 0x10012057
test dword [esi + 8], 0x1000
je 0x10011f9c
cmp dword [esi + 4], 0x3ef
jne 0x10011fd3
test byte [eax + 0x16], 2
jne 0x10011f9c
cmp dword [esi + 0x14], 0x403
jne 0x10012006
push 0x420
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x10012006
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
mov eax, dword [ebp - 0x214]
jne 0x10011f9c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10011f96
push eax
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x10011f96
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
jne 0x10011f9c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret
mov edx, eax
mov ecx, ebx
call fcn.10011d10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret
Function at 0x10014ed0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x411
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x40f
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov edi, eax
push 0x188
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xb8
push ebx
mov dword [ebp - 0x670], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x10014fec
push 0x104
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x412
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x18f
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10002384
lea eax, [ebp - 0x66c]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x14
push 0
push esi
push 0x182
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x66c]
push eax
push 0
push 0x180
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x19a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp - 0x670]
push 0x186
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret
Function at 0x100225a0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.10022350
test ax, ax
je 0x100225c1
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0x100039f0
push 0
push 0x100039e0
push dword [esi + 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10022602
push 1
mov edx, 0x100039e0
mov ecx, esi
call fcn.10021c90
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0x100039f0
push 0
push 0x10002b78
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10022649
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov edx, 0x10002b78
mov ecx, esi
call fcn.10021c90
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 6
push 0x10001e48
push 1
push 0
push 0x10001cac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002266d
mov edx, 0x10001cac
jmp 0x1002268f
push 6
push 0x10001e48
push 1
push 0
push 0x10001e28
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002269b
mov edx, 0x10001e28
push 1
mov ecx, esi
call fcn.10021c90
movzx edi, ax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100226c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
movzx esi, word [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
cmp dword [edi + 0x108], 0
jne 0x100226f9
call fcn.10023140
test ax, ax
je 0x100226f6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 8]
cmp dword [ebp + 0x14], 0
mov ebx, dword [ebp + 0xc]
je 0x1002270e
mov eax, dword [edi + 0x110]
test eax, eax
je 0x1002272b
jmp 0x10022714
mov eax, dword [edi + 0x108]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002274b
lea eax, [esi - 1]
push eax
push dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
mov eax, 0x64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, edx
shr ecx, 1
shr eax, 1
cmp eax, ecx
jbe 0x1002275c
mov eax, ecx
test eax, eax
jne 0x10022765
mov eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
test edx, edx
jne 0x10022782
lea eax, [esi - 1]
push eax
push dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10022790
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, ecx
cmp dword [edi + 0x10c], 0
jne 0x100227c6
call fcn.10022350
test ax, ax
jne 0x100228ba
test esi, esi
je 0x100227e8
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100227d0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x100227f2
mov ecx, 2
mov esi, 0x10001ba0
cmp dword [ebp + 0xc], 0
je 0x10022800
mov eax, dword [edi + 0x110]
jmp 0x10022806
mov eax, dword [edi + 0x10c]
push ecx
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100228d0
xor eax, eax
push 0x104
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0xb3b0
push dword [0x10041578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x210], 0
jne 0x10022874
mov esi, dword [0x1004138c]
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10042350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x418]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.10019780
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret 8