joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d6b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.0041d910
test edi, edi
je 0x41d6f4
test al, al
je 0x41d6f4
mov ecx, ebx
sar ecx, 0x1f
add edi, ebx
adc ecx, 0
mov eax, ecx
and eax, 1
neg eax
xor ecx, eax
jne 0x41d6f4
test eax, eax
js 0x41d6f4
cmp dword [esi + 8], edi
jb 0x41d6f4
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0041d920
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x425860
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 8]
mov ecx, dword [0x438014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
mov esi, 5
cmp eax, 3
jne 0x4258f3
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x14], 8
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
jb 0x4258a4
mov esi, dword [esi]
mov ebx, dword [ebx]
push 0
push edx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x425907
mov esi, eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
cmp eax, 1
sbb edi, edi
lea eax, [ebp - 0x14]
or edi, dword [eax]
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417da0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
dec edi
jmp 0x4258e3

Function at 0x427460
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
movaps xmm0, xmmword [0x431950]
movups xmmword [esp], xmm0
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.004016a0
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4274ae
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x438014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx - 7]
mov edi, 5
cmp eax, 0xfffffffe
jae 0x429887
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417da0
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x54], 0x44
cmp dword [eax + 0x14], 8
jb 0x4298af
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
call dword [sym.imp.mozglue.dll__wcsdup]
add esp, 4
mov edx, dword [edi + 0x10]
cmp dword [edi + 0x14], 8
jb 0x4298c7
mov edi, dword [edi]
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
test edx, edx
cmove edi, edx
cmp dword [esi + 0x14], 8
jb 0x4298da
mov esi, dword [esi]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
sub esp, 0x28
mov dword [esp + 0x24], ebx
lea ecx, [ebp - 0x54]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [ebp - 0x58], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x429987
mov eax, dword [ebp + 8]
cmp eax, 6
mov eax, 0x1fffff
mov esi, 0x101c01
cmove esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x60], eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
test eax, eax
je 0x4299a1
cmp dword [ebp + 8], 6
mov edi, 0x100c43
mov eax, 0x1fffff
cmove edi, eax
mov esi, dword [ebx + 4]
add ebx, 4
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 1
push 0
push edi
push ebx
push dword [ebp - 0x5c]
push esi
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x429873
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x429873
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x429987

Function at 0x4299b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
test eax, eax
je 0x429a0f
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.kernel32.dll_GetLastError]
Function at 0x430520
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x438014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4393b8]
mov ecx, dword [0x4380f8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43059a
mov eax, dword [esi + 8]
test eax, eax
je 0x430581
mov ecx, dword [0x4393b4]
mov dword [ebp - 0x38], ecx
mov ebx, dword [esi + 4]
lea edi, [ebx + eax*8]
lea eax, [ebp - 0x34]
push eax
push dword [ebx]
push dword [ebp - 0x38]
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
add ebx, 8
cmp ebx, edi
jne 0x430568
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417da0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4393b8
call fcn.00417b36
add esp, 4
cmp dword [0x4393b8], 0xffffffff
jne 0x430552
lea edi, [ebp - 0x34]
push edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [edi + 4]
mov dword [0x4393b4], eax
push 0x4393b8
call fcn.00417b36
add esp, 4
jmp 0x430552

Function at 0x430850
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ecx, dword [ecx + 0x34]
test ecx, ecx
je 0x4308d6
mov edi, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
and ecx, 0xfffffffc
call fcn.0041a8c0
test al, al
je 0x4308d6
mov dword [ebp - 0x10], ebx
push edi
push dword [esi + 0x34]
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x4308d6
mov edi, eax
mov ecx, eax
call fcn.0041a8c0
test al, al
je 0x4308d6
lea ecx, [esi + 0x18]
mov edx, edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.00414080
add esp, 8
mov ecx, eax
mov al, 1
test cl, cl
jne 0x4308d8
cmp byte [esi + 0x14], 0
jne 0x4308c6
mov dword [esi + 0x14], 1
mov dword [esi + 0x10], 0
mov ecx, esi
mov edx, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0040e8a0
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x413dfa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413e20
xor al, al
jmp 0x413e35
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x418cb5
Capabilities:
Inspect section memory permissions

Disassembly:
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x418cd4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x418cf2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x418d50
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x418d37
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x418d40
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x418d4a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x418d2c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x418cb6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x418d9d
dec eax
je 0x418d94
sub eax, 3
je 0x418d8b
mov dword [ebp - 4], 0x40
jmp 0x418dba
mov dword [ebp - 4], 4
jmp 0x418da0
mov dword [ebp - 4], 0x20
jmp 0x418da0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x418dec
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x418d6c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004185fd
scasd eax, dword es:[edi]
inc ebp
pop es
inc edx
push dword [ebp + 0x14]
push 1
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x418df8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1036058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010361a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x103607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103606a
add dl, dl
jne 0x1036089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10360dc
xor eax, eax
add dl, dl
jne 0x1036096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103617d
add dl, dl
jne 0x10360a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10360b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10360bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10360c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10360d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1036075
mov eax, 1
add dl, dl
jne 0x10360ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10360f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10360e1
sub eax, ebx
mov ebx, 1
jne 0x1036128
mov ecx, 1
add dl, dl
jne 0x103610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1036119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1036105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1036075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x103613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1036136
cmp eax, 0x7d00
jae 0x103616d
cmp eax, 0x500
jb 0x1036168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1036075
cmp eax, 0x7f
ja 0x1036170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1036075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x103619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1036075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10011620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100578ce
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10083a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x16], 0
mov eax, 0x32
je 0x1001172e
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp + 8]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x12], eax
setne al
cmp byte [ebp + 0xc], 0
je 0x10011692
test al, al
je 0x10011692
mov eax, dword [edi + 0x22]
push eax
lea ecx, [ebp + 8]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x12]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 8]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
mov edi, eax
test edi, edi
jne 0x100116d7
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100116d7
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x16]
mov edx, dword [ebp - 0x14]
push ecx
push 1
push eax
push edx
call dword [sym.imp.msvcr100.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x100116d7
mov edi, 0x34
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push ecx
call dword [sym.imp.msvcr100.dll_ferror]
add esp, 4
test eax, eax
je 0x10011702
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call dword [sym.imp.msvcr100.dll_clearerr]
add esp, 4
mov edi, 0x34
jmp 0x1001171d
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call dword [sym.imp.msvcr100.dll_ftell]
mov esi, dword [esi + 4]
add esp, 4
cmp eax, dword [esi + 0x1a]
jle 0x1001171d
mov dword [esi + 0x1a], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sym.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10013250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001325f
pop dword [ebp - 0x48]
mov eax, 0x1001325f
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x22a5a3e6
add dword [ebp - 0x58], 0x2baca165
mov dword [ebp - 0x54], 0x3d14b2b5
add dword [ebp - 0x54], 0xf51e9990
mov dword [ebp - 0x50], 0x961c541
add dword [ebp - 0x50], 0x42ea7eed
mov dword [ebp - 0x4c], 0xa2f8e5ef
sub dword [ebp - 0x4c], 0xa2f8e5ef
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xbf84e611
add dword [ebp - 0x58], 0xb4ed8345
mov dword [ebp - 0x54], 0x28de772
add dword [ebp - 0x54], 0x3ede7a03
mov dword [ebp - 0x50], 0x75ec8d7b
sub dword [ebp - 0x50], 0x127d210f
mov dword [ebp - 0x4c], 0x429d3d08
sub dword [ebp - 0x4c], 0x429d3d08
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x62988019
add eax, 0xad6d50e7
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4f51f
push 0
call eax
mov ecx, 0x3aa45ed2
sub ecx, 0x3aa41872
xor edx, edx
add edx, eax
mov ebx, 0x339d2dd2
sub ebx, 0x23941fd2
add ebx, dword [ebp - 0x48]
mov esi, 0xdac7510c
add esi, 0x7ea66195
xor dword [ebp - 0xc], 0x23b6966e
mov edi, dword [ebx]
add dword [ebp - 0x40], eax
sub edi, esi
sub dword [ebp - 0x44], esi
mov dword [edx], edi
mov dword [ebp - 0x28], 0xfdc54e85
add edx, 4
add ebx, 4
loop 0x10013379
add eax, 0x547a4a4a
add eax, 0xab86c209
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x27a9a14a
sub ecx, 0x17a9a14a
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100374a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100374cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x100374f9
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x100374f2
mov eax, esi
mov dword [ebp - 4], eax
jmp 0x100374f5
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1003750b
lea ecx, [ebp - 8]
push ecx
push 0x10037470
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10037510
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x10083a30]
xor eax, ebp
mov dword [ebp - 4], eax
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
mov dword [ebp - 0x188], eax
test eax, eax
je 0x1003768b
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x10037565
mov edi, dword [sym.imp.USER32.dll_GetWindow]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 4
push esi
call edi
test eax, eax
jne 0x10037561
push esi
call ebx
test eax, eax
je 0x10037565
mov esi, eax
jmp 0x10037551
push 0x100
lea eax, [ebp - 0x184]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x1003767b
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x1003767b
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
jne 0x1003767b
test esi, esi
je 0x1003767b
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
mov ebx, eax
call edi
mov ecx, dword [ebp - 0x188]
push 0
push ecx
mov esi, eax
call edi
mov edi, eax
test ebx, ebx
je 0x1003767b
cmp edi, esi
je 0x1003767b
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x10037628
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054c72
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call esi
push 2
lea ecx, [ebp - 0x190]
push ecx
push 0
push 0x2001
mov dword [ebp - 0x190], 0
call esi
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call esi
mov ecx, dword [ebp - 0x188]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054c72
mov esp, ebp
pop ebp
ret

Function at 0x10037780
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x10037790
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
ret
Function at 0x100377b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b5b3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10083a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], edi
mov byte [esi + 0x10], 1
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push edi
push edi
mov dword [ebp - 0x18], edx
call dword [sym.imp.msvcr100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10037839
mov dword [esi + 0xc], 0x20
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [esi + 8], ecx
mov eax, dword [0x10083aa8]
cmp eax, edi
jne 0x1003784d
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x52], ebx
mov dword [eax + 0x56], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083674]
cmp eax, 0xffffffff
je 0x10037b80
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10037b71
cmp esi, dword [0x10083be8]
jne 0x10037b5a
mov dword [0x10083be8], 0
mov ecx, esi
call fcn.10020480
mov ecx, esi
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
push esi
call sub.msvcr100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [0x10083674]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x10037b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083be8]
test eax, eax
jne 0x10037bfa
mov eax, dword [0x10083674]
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10037bfa
push esi
push 0x16c
call sub.msvcr100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10037bc6
mov ecx, eax
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__
mov esi, eax
jmp 0x10037bc8
xor esi, esi
cmp byte [0x10083be4], 0
jne 0x10037be2
mov ecx, esi
mov dword [0x10083be8], esi
call fcn.10020740
mov eax, esi
pop esi
ret
mov ecx, dword [0x10083674]
push esi
push ecx
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.10020740
mov eax, esi
pop esi
ret