joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ec87
Capabilities:
Encode data using xor

Disassembly:
pop esp
invalid
push ds
add eax, 0x85eaf173
invalid
jae 0x40ecc7
dec ebp
jp 0x40ec2f
adc eax, 0x89d4a2f5
arpl word [ecx - 0x3e], si
xlatb
pmulhuw mm4, qword [ebx + 0x6a]
and bl, byte [edi]
push esp
rcr ah, cl
invalid
jbe 0x40ed00
or dword [ebx], ebp
xchg esp, eax
and eax, 0xf7f5cb02
invalid
inc esi
je 0x40ec69
inc esp
dec esi
daa
jb 0x40ed17
retf 0x4915
or esp, dword [eax + 0x12599167]
pop eax
jb 0x40ed50
inc eax
daa
inc esi
sub edx, esi
xor dword [edi], esp
xchg esi, eax
and dl, ch
rcr byte [ebp + 0x39], 0x14
mov byte [0x50ad3343], al
lea ebp, [esi - 0x3dc40089]
std
sub al, 0x90
dec ebx
jge 0x40ed92
int3
push edi
inc ecx
and eax, 0x443a3a7c
adc ah, byte [edi - 0x56ad498b]
mov cl, 0x8b
cli
jb 0x40ece2
mov ebx, 0x35e04185
bound esi, qword [edi]
invalid
jp 0x40edbc
shl byte [eax], 1
invalid
and byte [edx - 0x26], ah
mov byte [esp + ecx*4], al
mov ecx, 0x9fec078a
jg 0x40ed0a
cmp byte [eax + eax*4], bl
and byte [0xf732025c], 0xc0
invalid
loop 0x40ed6e
into
add ebp, dword [ebx + eax*8 - 0xd382281]
movsb byte es:[edi], byte [esi]
ffree st(7)
repne movsb byte es:[edi], byte [esi]
mov ah, 0xed
js 0x40ed71
mov al, byte [0xb7c94fee]
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
xor dword [edi - 0xa], esp
and al, 8
push edi
cmpsd dword [esi], dword es:[edi]
sahf
fistp dword [ecx - 0xf]
pop esi
jmp 0x8b86eecc
mov ah, 0x12
xchg esi, eax
inc ebp
jns 0x40ee39
or dword [edi], edx
mov esp, 0xf247d2
loop 0x40edc2
xchg ecx, eax
push 0xfffffffffffffff6
mov edx, 0xdfb1a7a5
add dh, bl
ror dh, cl
leave
shl byte [edx + 0x69], 1
inc eax
or ebp, dword [eax - 0x14]
popal
pop edx
add byte [ecx - 0x5c], bl
jbe 0x40ed99
scasd eax, dword es:[edi]
push ebp
pop ss
arpl word [esi - 0x4e], si
adc ecx, dword [edx]
lock and cl, byte [ecx]
ret
leave
wait
mov esi, es
mov esp, 0x7e82fe54
lcall 0xe3f0, 0xa34f9392
fst qword [eax + 0x57]
mov edi, 0xb75fe604
mov dr6, esi
invalid

Function at 0x449790
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xfb
imul dword [eax]
xchg ebp, eax
lahf
inc eax
cdq
sub dword [esi + 4], ebx
xor dword [esp + eax], esp
pop ebp
mov eax, 0x37869177
mov edi, 0xbfc93404
pop ecx
salc
dec ebp
mov byte [0x751a00d6], al
fisttp qword [eax]
fidiv dword [ebx]
xchg dword [eax - 0x4faa46fc], edi
cmpsd dword [esi], dword es:[edi]
leave
mov edi, 0xa24dd659
salc
add byte [edx], bl
jne 0x44978e
or dl, bl
xor eax, dword [edi + 0x55b904b8]
mov al, 0xa7
jb 0x4497a6
xor bh, 0xe5
push 0xffffffffffffffa9
xchg ecx, ebp
jmp 0xd0cbfd53

Function at 0x49ec9d
Capabilities:
Encode data using xor

Disassembly:
push eax
push edx
push esi
push edi
insb byte es:[edi], dx
or dl, byte [eax]
pop edi
cmc
inc ecx
cwde
push eax
in eax, 0x6b
push ds
outsd dx, dword [esi]
xor al, 0x63
je 0x49eca6
in al, 0x8a
push es
pop ecx
in al, 0x69
in al, 0xd1
xchg ebp, eax
and ch, bl
cmp eax, 0x3054b11c
xor byte [ecx], dl
mov edx, 0x8017a50c
aad 0xce
ret 0x557e

Function at 0x49fe6b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x372477d0
test eax, 0x950052c6
in eax, dx
Function at 0x5272f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00530303
mov dword [esp + 0x28], 0
test esi, esi
jne 0x52733a
xor eax, eax
jmp 0x52733d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.00530938
lea eax, [edi + 0x7c]
test eax, eax
je 0x527358
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00530c9d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x527396
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.00530c9d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0053001d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005309b9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54e5ed
Capabilities:
Encode data using xor

Disassembly:
push ss
dec edi
mov eax, dword [0x1dc23f1f]
inc ebp
ror dword [esi], 1
jl 0x54e673
lea ebp, [0x3997f08c]
push 0xfffffffffffffffc
mov ebx, dword [edx]
ljmp 0x49c5
popfd
arpl word [edi - 0x2e], ax
inc ecx
retf 0x5044
and al, 0x7e
dec ebp
xor al, 0xe4
push cs
je 0x54e6c5
lahf
push ds
stosd dword es:[edi], eax
or dword [edi + 0x605f42e1], eax
or esp, dword [edx*8 - 0x44df600b]
sbb dword [edx], 0x6c
nop
pop es
das
push ds
adc cl, byte [ecx + 0x245074ab]
mov dl, ah
test eax, 0x5637956a
xor al, byte [eax - 9]
jp 0x54e691
push esi
push ebx
arpl word [ecx - 0x66cc45fc], bp
loop 0x54e661
or eax, 0x6d76bdb2
fidivr word [edx]
mov bh, dh
imul ecx, esp, 2
out dx, al
cmpsd dword [esi], dword es:[edi]
inc eax
jns 0x54e73c
ljmp 0xcac7:0xccbff954
invalid
adc esi, dword [ecx + 0x398a7344]
insb byte es:[edi], dx
add ebx, dword [edx + 7]
inc esp
push ebp
int3
or dword [ebx - 0x31], edx
xchg ecx, eax
jb 0x54e77f
int1
aam 0x70
invalid
test byte [edx + 0x4c433253], bl
jle 0x54e715
out 0x28, al
or dl, byte [eax]
pushal
dec ebx
in al, 0xc5
movsd dword es:[edi], dword [esi]
mov al, byte [edi]
mov fs, ecx
and eax, 0x656c5739
mov edi, 0xf40f60cb
sbb byte [eax + 0x6ba2e464], dh
mov esp, dword [ebx]
ljmp 0xae0a

Function at 0x582d6a
Capabilities:
Encode data using xor

Disassembly:
pop ss
popal
sbb dword [edx + 0x37], ebp
invalid
xor dword [ebp - 0x6c09a459], 0xe8f5b01e
push eax
jmp 0x582d8c
add byte [edi], ah
popfd
jg 0x582d05
ljmp 0x6ac7:0xb7e356b9
sub al, 0x5b
outsd dx, dword [esi]
dec ecx
adc dword [edi + eax], ebx
loopne 0x582d7e
test dword [0x51ac7bbe], eax
pop edi
aad 0x48
imul ebp, dword [ebx + 0x7c], 0xb661bc41
push esp
dec ecx
mov al, byte [edx]
dec edx
sbb eax, ecx
fisubr dword [ecx]
invalid

Function at 0x583071
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xa3
leave
mov bl, bh
nop
xchg edx, eax
push esi
mov edi, dword [ebx + ebp*8 + 0x49]
movsb byte es:[edi], byte [esi]
dec edx
and al, 0x37
add dword [eax], ebp
push 0xffffffffffffffa1
aam 0x7b
test byte [edi + eax], 0xf8
sub byte [ebx - 0x5ce036dc], 0x52
sti
hlt
sub ah, dh
fcmovnb st(0), st(4)
sbb eax, esp
or ecx, dword [ecx - 0x4a]
imul ebp, dword [ecx + 0x429b3265], 0x48
dec ebx
sbb byte [ebx + 0x4b1b69a9], bl
bnd jge 0x58301a
xor bl, byte [ebx + 0x184b4842]
wait
test eax, 0xf24b1b69
jge 0x58301a
ficom word [edx]
imul ebx, dword [ebx], 0xffffffed
test eax, 0x8b24e9f7
and al, 0xfb
xchg al, dh
test byte [ebp - 0x65], al
add eax, 0x4bcd045f
dec ecx
lodsb al, byte [esi]
push 0x563c8565
les ecx, [edx]
or edi, dword [edx - 0x20]
loop 0x58307d
aad 0x5b
insd dword es:[edi], dx
push ss
and eax, 0x62b5bf7b
stosd dword es:[edi], eax
ret
Function at 0x5cd521
Capabilities:
Encode data using xor

Disassembly:
add ch, bh
in eax, 0x83
pop esp
outsb dx, byte [esi]
jnp 0x5cd569
add byte [edi], 0x73
xchg ebx, eax
mov dword [0x11556ee7], eax
sbb ah, byte [edi - 0x5f]
inc ebp
mov dh, 0xeb
out 0x8b, eax
pop ebx
das
div dword cs:[edi - 0x72081128]
stc
std
adc eax, 0x88fb226d
jmp 0x5cd50e
out dx, al
test dword [ebp + 0x6d15fdf9], 0xeb88fb22
hlt
dec edi
jp 0x5cd4ef
std
add ebx, dword [edi]
dec di
push eax
jecxz 0x5cd53e
pop ebx
cmp byte [ecx + 3], cl
dec eax
sahf
xlatb
add eax, 0xdfd4dab3
push esp
mov esi, 0x8f08d2fb
sub edi, dword [esi + 0x1b]
dec esp
invalid
adc bl, byte [edx]
pop ss
outsd dx, dword [esi]
outsd dx, dword [esi]
jnp 0x5cd57b
movsb byte es:[edi], byte [esi]
aam 0x10
invalid
iretd
jno 0x5cd527
lahf
mov ebx, 0xcb87eb8b
pushal
mov al, byte [0xe5236ffe]
fadd st(7)
mov ebp, ecx
adc dword [eax], ebp
sub dl, dl
xlatb
jecxz 0x5cd575
arpl word [edi + 0x6212f1d0], cx
cmp dword [edi + 0x239d4f7b], eax
mov eax, 0x9d722faa
in al, dx
imul ebx, dword [ebx - 0x6b], 0x87edeefd
aas
push ebp
mov ch, 0x3c
add ecx, 0xffffffc1
push 0x6aa804c4
mov byte [0x9c6b4a6d], al
iretd

Function at 0x604c44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0060dc53
mov dword [esp + 0x28], 0
test esi, esi
jne 0x604c8a
xor eax, eax
jmp 0x604c8d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0060e288
lea eax, [edi + 0x7c]
test eax, eax
je 0x604ca8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0060e5ed
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x604ce6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0060e5ed
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0060d96d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0060e309
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x612f1b
Capabilities:
Encode data using xor

Disassembly:
add dword fs:[edi + 0x63e2410b], ebx
or dword [edi - 0x64b89887], ebp
nop
add eax, 0x64c4d9c9
insd dword es:[edi], dx
push esp
into
and eax, 0x115dfe4c
sub ebx, dword [edx - 0x16]
xchg esp, eax
push ebx
sbb edx, ebx
les esp, [esi + 0x34]
xchg ebp, eax
invalid
xor al, 0x95
sub eax, 0xde4021ff
jl 0x612f4f
inc eax
mov eax, 0x79e12de3
adc al, 4
jecxz 0x612efa
je 0x612f0e
std
test dword [esi + edi*2 + 0x32], edi
mov ebx, 0xa32c14d4
adc eax, 0xb75118bf
and byte [eax - 0x3d], 0x85
jbe 0x612f34
jle 0x612ed2
inc esi
lds edi, [ebx*2 - 0x6a3bda50]
mov esp, 0x6d9ef077
pop ebp
mov al, 0x25
les edx, [ebp - 0x610f8844]
insd dword es:[edi], dx
movsd dword es:[edi], dword gs:[esi]
std
sti
in eax, dx
test byte fs:[esp + eax*4], dl
jno 0x612eef
mov al, 0x3d
jae 0x612f05
in eax, 0xd7
in al, dx
jne 0x612fc0
les ebp, [ecx + 0x67df5869]
xchg ebp, eax
salc
mov edi, 0x585b5cc
xor al, 0x81
in eax, dx
invalid
xor edx, dword [edi + edx*2 - 0x45]
iretd

Function at 0x6149b6
Capabilities:
Encode data using xor

Disassembly:
sub esi, esi
out 0x78, eax
aas
ja 0x614a13
movsb byte es:[edi], byte [esi]
dec edi
test byte [0xf40f16d8], al
pop ss
invalid
sbb al, 0x58
mov ebp, 0x33d3adf0
ret
mov ecx, 0x11cfe34d
and ch, ch
jecxz 0x6149d0
adc dword [edx], esp
in eax, dx
push ss
inc esi
sub dh, byte [ebx + edi*2]
push es
xchg ecx, eax
push es
cmp edx, dword [ebp + 0x10]
xor eax, 0x40fc85e9
inc eax
cmpsb byte [esi], byte es:[edi]
pop es
jecxz 0x6149fd
jg 0x614a49
shl eax, 0x57
cwde
stosd dword es:[edi], eax
mov dword [eax], eax
test dword [ebx + 0x147e4647], ebp
jle 0x614a3b
popal
in al, dx
or byte [ebp - 0xe08bba5], bh
xor eax, 0x7bb85e10
mov ah, byte [0xa4f4d6e4]
movsb byte es:[edi], byte [esi]
xchg esi, edx
lodsd eax, dword [esi]
dec eax
fld qword [edx]
popal
loopne 0x614a8a
add esp, dword [ebx + edx - 0x39]
ja 0x6149ff
mov ch, 2
or eax, 0xe89d671b
add cl, byte [0xe89d671b]
sub al, 0xf8
pop ebx
add edx, dword [ebp + 0x14456f5f]
mov al, 0x9b
dec ecx
inc edx
xchg eax, eax
pushfd
push 0x71a4e056
les edx, [edi + esi*2 + 0x75]
shr eax, 1
cli
dec ecx
jne 0x614ab3
mov ch, 0x10
mul byte [0xed75931d]
scasb al, byte es:[edi]
cmc
mov ebp, ebp
pop ds
dec edi
je 0x614a25
fist dword [edi + 0x66]
push ecx
xchg edi, eax
push ss
or dh, dl
jge 0x614a3b
into
les ebx, [esi + 9]
pop ss
in al, 0x50
inc esp
jns 0x614aa1
inc eax
and al, 0x9f
ljmp 0x1184
movsd dword es:[edi], dword [esi]
call 0xb2f0d7ec
les ebp, fs:[ecx + 0x3a864ec3]
out 0xdf, eax
add byte [0xa49cd078], al
sbb ch, dh
pop edx
inc edi
rcr byte [esp + 0x475af518], 1
sar dword [edx + 0x5a9fb4a9], 0x15
push ebx
das
xchg edi, eax
push 0xffffffffffffffa6
ret
Function at 0x10011ce0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x628], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
push 0x208
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ebx, ebx
push esi
push edi
call sym.odbcjt32.dll_InitDialogAgain
jmp 0x10011d47
mov edi, dword [ebp - 0x624]
cmp bx, 0x1d
jae 0x10011f3d
movzx esi, bx
inc ebx
shl esi, 5
add esi, section..data
je 0x10011f3d
push dword [esi + 0x14]
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x10011d41
mov ecx, dword [ebp - 0x628]
lea eax, [ebp - 0x210]
push 0x104
push eax
mov edx, esi
call fcn.10007850
test ax, ax
jne 0x10011e25
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xf
sub eax, 1
je 0x10011ddc
sub eax, 1
je 0x10011f26
sub eax, 1
jne 0x10011d41
mov eax, dword [ebp - 0x210]
mov edx, eax
test ecx, 0x2000000
je 0x10011dc8
xor eax, eax
test edx, edx
sete al
push 0
push eax
push 0xf1
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10011d41
push 0xa
lea eax, [ebp - 0x620]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll__ltow]
add esp, 0xc
test eax, eax
je 0x10011d41
push 0xa
lea eax, [ebp - 0x620]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll__ltow]
add esp, 0xc
push eax
push 0
push 0xc
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10011d41
mov eax, dword [esi + 4]
cmp eax, 0x3ef
ja 0x10011ecc
je 0x10011eb0
sub eax, 6
je 0x10011e7b
sub eax, 2
jne 0x10011d41
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x418], 0
je 0x10011e68
test eax, eax
jne 0x10011d41
push 0xa
lea eax, [ebp - 0x210]
push eax
push 0x200
jmp 0x10011f1d
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x418], 0
je 0x10011ea0
test eax, eax
jne 0x10011d41
push 0xa
lea eax, [ebp - 0x210]
push eax
push 0x258
jmp 0x10011f1d
mov eax, dword [ebp - 0x628]
mov eax, dword [eax + 4]
push dword [eax + 0x1c]
push 0
push 0xc
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10011d41
cmp eax, 0x408
jne 0x10011d41
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x418], 0
je 0x10011efc
test eax, eax
jne 0x10011d41
mov eax, dword [ebp - 0x628]
push 0xa
mov eax, dword [eax + 4]
cmp dword [eax + 0xa8], 0x1b
lea eax, [ebp - 0x210]
push eax
jne 0x10011f1b
push 0x19
jmp 0x10011f1d
push 0x10
call dword [sym.imp.msvcrt.dll__ltow]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0xc
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10011d41
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret 8
Function at 0x100127d0
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x88
push edi
mov dword [ebp - 0x624], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x100129f8
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x429
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x620]
push eax
push 0x43a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x43b
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
je 0x10012889
cmp word [ebp - 0x620], 0
je 0x10012a13
cmp word [ebp - 0x418], 0
je 0x10012a13
push 0
push 0
push 0x147
push 0x42a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x150
push 0x42a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov cx, word [ebp - 0x210]
lea ebx, [eax + 1]
neg ebx
sbb ebx, ebx
and ebx, eax
test cx, cx
jne 0x100129ce
push 0x420
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x34], 0
jne 0x100129be
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1001291a
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10012944
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x10012927
push ecx
jmp 0x1001292f
mov eax, dword [eax + 0x10]
test eax, eax
je 0x10012944
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
cmp word [ebp - 0x210], 0
je 0x100129be
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012957
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x34]
test edx, edx
je 0x10012a13
lea esi, [ebp - 0x210]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10012994
sub esi, ecx
lea eax, [ebp - 0x210]
sar esi, 1
push eax
lea eax, [esi + 1]
push eax
push edx
call dword [sym.imp.msvcrt.dll_wcscpy_s]
mov esi, dword [ebp - 0x624]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.100117a0
mov cx, word [ebp - 0x210]
mov ax, word [ebp - 0x418]
cmp ebx, 1
jl 0x100129ee
test cx, cx
je 0x10012a13
cmp word [ebp - 0x620], 0
je 0x10012a13
test ax, ax
je 0x10012a13
test cx, cx
jne 0x10012a0e
test ax, ax
jne 0x10012a13
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x100129f8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret
Function at 0x10012a30
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov ebx, ecx
push edi
mov dword [ebp - 0x214], eax
xor edi, edi
jmp 0x10012a5c
mov eax, dword [ebp - 0x214]
cmp di, 0x1d
jae 0x10012b15
movzx esi, di
inc edi
shl esi, 5
add esi, section..data
je 0x10012b15
test dword [esi + 8], 0x1000
je 0x10012a5c
cmp dword [esi + 4], 0x3ef
jne 0x10012a91
test byte [eax + 0x16], 2
jne 0x10012a5c
cmp dword [esi + 0x14], 0x403
jne 0x10012ac4
push 0x420
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x10012ac4
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
mov eax, dword [ebp - 0x214]
jne 0x10012a5c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10012a56
push eax
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x10012a56
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
jne 0x10012a5c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret
mov edx, eax
mov ecx, ebx
call fcn.100127d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret
Function at 0x10015c30
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x411
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x40f
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov edi, eax
push 0x188
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xb8
push ebx
mov dword [ebp - 0x670], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x10015d4c
push 0x104
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x412
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x18f
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1000236c
lea eax, [ebp - 0x66c]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x14
push 0
push esi
push 0x182
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x66c]
push eax
push 0
push 0x180
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x19a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp - 0x670]
push 0x186
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret