joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
push 0
mov esi, ecx
mov dword [ebx], 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 0x10]
mov eax, dword [esi + 4]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax + 4]
call sym.HncOfficeFramework.dll_public_virtual:_int___thiscall_CHncDialogEx::ProcessWindowMessage_struct_HWND_____unsigned_int__unsigned_int__long_int__long_int___unsigned_long_int_
test eax, eax
jne 0x10013b17
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x40]
mov edi, dword [eax]
mov eax, dword [eax + 4]
sub eax, edi
sar eax, 2
cmp eax, ecx
jbe 0x10013b17
mov edi, dword [edi + ecx*4]
test edi, edi
je 0x10013b17
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
mov ecx, 0xff00
test cx, ax
jne 0x10013b17
push 0x11
call esi
mov ecx, 0xff00
test cx, ax
jne 0x10013b17
push 0x10
call esi
mov ecx, 0xff00
test cx, ax
jne 0x10013b17
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.1013df80
test eax, eax
je 0x10013b17
pop edi
pop esi
mov dword [ebx], 1
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10014f00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x1023c014]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.10014e50
mov esi, eax
test esi, esi
jne 0x10014ff7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x10014fc9
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10014f00
mov esi, eax
test esi, esi
jne 0x10014ff7
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x10014f90
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10014fe0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.10014d70
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10015006
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 4
Function at 0x100154a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bf496
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1023c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x1001554c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x1001554c
call fcn.10014b60
mov edi, eax
jmp 0x1001566b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1001556f
call fcn.10014b60
jmp 0x1001565e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x1001558d
call fcn.10014b60
jmp 0x1001565e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x100155ae
mov edi, 0x8007000e
jmp 0x10015660
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x100156a4
jb 0x100155cc
cmp eax, 0xffffffff
ja 0x100156a4
cmp eax, 0x400
jbe 0x100155e1
push eax
lea ecx, [ebp - 0x418]
call fcn.1002a310
jmp 0x10015607
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10015607
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x1001561e
mov edi, 0x8007000e
jmp 0x10015660
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1001563e
call fcn.10014b60
jmp 0x1001565e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.100162a0
mov edi, eax
test esi, esi
je 0x1001566b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10015684
lea ecx, [ebp - 0x418]
call fcn.10017580
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.10014a70
int3
Function at 0x100240e0
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [0x1024099c]
test ecx, ecx
jne 0x10024199
push str.HncNetffice.dll
call dword [sym.imp.HncFoundation.dll_HncLoadLibrary]
mov ecx, eax
mov dword [0x1024099c], ecx
test ecx, ecx
je 0x100241ca
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EncodeUrl
push ecx
call esi
push str.DecodeUrl
push dword [0x1024099c]
mov dword [0x10240990], eax
mov dword [edi], eax
call esi
push str.UnicodeToAnsi
push dword [0x1024099c]
mov dword [0x102408f8], eax
mov dword [edi + 4], eax
call esi
push str.AnsiToUnicode
push dword [0x1024099c]
mov dword [0x102409a0], eax
mov dword [edi + 8], eax
call esi
push str.SplitUrl
push dword [0x1024099c]
mov dword [0x102409bc], eax
mov dword [edi + 0xc], eax
call esi
push str.HncGetNetffice
push dword [0x1024099c]
mov dword [0x102408c4], eax
mov dword [edi + 0x10], eax
call esi
mov ecx, dword [0x1024099c]
test ecx, ecx
pop esi
mov dword [edi + 0x14], eax
mov dword [0x102409a8], eax
setne al
pop edi
ret
mov eax, dword [0x10240990]
test ecx, ecx
mov dword [edi], eax
mov eax, dword [0x102408f8]
mov dword [edi + 4], eax
mov eax, dword [0x102409a0]
mov dword [edi + 8], eax
mov eax, dword [0x102409bc]
mov dword [edi + 0xc], eax
mov eax, dword [0x102408c4]
mov dword [edi + 0x10], eax
mov eax, dword [0x102409a8]
mov dword [edi + 0x14], eax
setne al
pop edi
ret
Function at 0x10035cf0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10035ebd
cmp eax, 0x7c
je 0x10035ebd
cmp eax, 0x29
jne 0x10035d31
cmp dword [esi + 0x10], 0
jne 0x10035ebd
cmp eax, eax
jne 0x10035d31
test dword [esi + 0x50], 0x10000000
je 0x10035eca
jmp 0x10035e76
cmp eax, 0x2e
jne 0x10035d45
push 5
lea ecx, [esi + 0x24]
call fcn.10035f20
jmp 0x10035ea1
cmp eax, 0x5c
jne 0x10035da1
mov ecx, esi
call fcn.10035c90
test byte [esi + 0x50], 0x80
je 0x10035d95
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x10035d74
push 4
lea ecx, [esi + 0x24]
call fcn.10035f20
mov ecx, esi
call fcn.10035c90
jmp 0x10035eaf
cmp al, 0x42
jne 0x10035d95
push 4
lea ecx, [esi + 0x24]
call fcn.10035f20
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10035c90
jmp 0x10035eaf
mov ecx, esi
call fcn.100390e0
jmp 0x10035ea8
cmp eax, 0x5b
jne 0x10035e02
mov ecx, esi
call fcn.10035c90
lea ecx, [esi + 0x24]
call fcn.1003bbe0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x10035dce
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10035c90
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x10035dec
cmp eax, 0x5d
jne 0x10035dec
push eax
lea ecx, [esi + 0x24]
call fcn.1003bc70
mov ecx, esi
call fcn.10035c90
mov ecx, esi
call fcn.1003b660
cmp dword [esi + 0x4c], 0x5d
jne 0x10035ed1
jmp 0x10035ea1
cmp eax, 0x28
jne 0x10035e32
mov ecx, esi
call fcn.10035c90
mov ecx, esi
call fcn.10039230
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x10035eca
mov ecx, esi
call fcn.10035c90
test bl, bl
je 0x10035eaf
jmp 0x10035ea8
cmp eax, 0x5e
jne 0x10035e4a
push 2
lea ecx, [esi + 0x24]
call fcn.10035f20
mov ecx, esi
call fcn.10035c90
jmp 0x10035eaf
cmp eax, 0x24
jne 0x10035e62
push 3
lea ecx, [esi + 0x24]
call fcn.10035f20
mov ecx, esi
call fcn.10035c90
jmp 0x10035eaf
cmp eax, 0x2a
je 0x10035ec3
cmp eax, 0x2b
je 0x10035ec3
cmp eax, 0x3f
je 0x10035ec3
cmp eax, 0x7b
je 0x10035ec3
cmp eax, 0x7d
jne 0x10035e86
test dword [esi + 0x50], 0x10000000
je 0x10035ed8
jmp 0x10035e94
cmp eax, 0x5d
jne 0x10035e94
test dword [esi + 0x50], 0x10000000
je 0x10035ed1
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10039480
mov ecx, esi
call fcn.10035c90
mov ecx, esi
call fcn.10039330
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10035d03
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.10030880
push 5
call fcn.10030880
push 4
call fcn.10030880
push 6
call fcn.10030880
int3
Function at 0x10053850
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c0d4f
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1023c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [edi], 0x101df748
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 1
movq qword [edi + 0x30], xmm0
mov ecx, dword [edi + 4]
mov dword [edi + 0x10], 0xc56a31
test ecx, ecx
jne 0x10053922
push 0x18
call fcn.100854b0
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.HncBaseDraw.dll_public:_void___thiscall_CHncDrawContext::constructor_void_]
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 4], eax
test eax, eax
je 0x10053976
mov ecx, eax
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::IsValid_void_]
test eax, eax
jne 0x10053918
mov ecx, dword [edi + 4]
push eax
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::CreateDrawCtxFromHWnd_struct_HWND____]
test eax, eax
jne 0x10053918
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1005390f
push ecx
call fcn.10027250
mov dword [edi + 4], 0
jmp 0x10053976
mov ecx, dword [edi + 4]
mov dword [edi + 8], 1
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_int___thiscall_CHncDrawContext::GetTextExtentMode_void_const]
mov ecx, dword [edi + 0xc]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x74]
mov ecx, esi
or esi, 1
and ecx, 0xfffffffe
and al, 0x10
mov eax, dword [edi + 0xc]
cmove esi, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov ecx, esi
or esi, 2
and ecx, 0xfffffffd
and al, 0x20
mov eax, dword [edi + 0xc]
cmove esi, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov ecx, esi
or esi, 4
and ecx, 0xfffffffb
and al, 0x40
cmove esi, ecx
mov ecx, dword [edi + 4]
push esi
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_int___thiscall_CHncDrawContext::SetTextExtentMode_unsigned_int_]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10054170
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebp + 0x10]
mov ecx, dword [ebx + 4]
call dword [sym.imp.HncBaseDraw.dll_public:_class_CHncFont____thiscall_CHncDrawContext::SelectObject_class_CHncFont__]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
cmp ecx, 1
jne 0x1005419a
or edi, 0x20000000
jmp 0x100541a5
cmp ecx, 2
jne 0x100541a5
or edi, 0x40000000
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x8c]
cmp eax, 0x10041f20
jne 0x100542a6
mov eax, dword [ecx + 0x30]
cmp eax, 4
jne 0x100541ca
mov eax, 0x10e
jmp 0x100541d9
cmp eax, 0x20
jne 0x100541d6
mov eax, 0x5a
jmp 0x100541d9
mov eax, dword [ecx + 0x38]
cmp eax, 0x1ff
je 0x100541f0
mov eax, dword [ebx + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
test eax, 0x800
je 0x100541f6
or edi, 0x80000000
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
cmp eax, 0x10040080
jne 0x100542ae
mov eax, dword [esi + 0x38]
shr eax, 0x1e
and eax, 1
test eax, eax
mov edx, 0x14000000
mov ecx, 0x16000000
cmove ecx, edx
or ecx, edi
push ecx
mov ecx, dword [ebx + 4]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_int___thiscall_CHncDrawContext::SetTextAlign_unsigned_int_]
mov ecx, dword [ebx + 4]
push 1
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::SetBkMode_int_]
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
cmp eax, 0x100400f0
jne 0x100542b6
mov eax, dword [esi + 0x44]
cmp eax, 0xffffffff
je 0x10054261
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
cmp eax, 0x100400f0
jne 0x100542bb
mov eax, dword [esi + 0x44]
push eax
jmp 0x10054266
push eax
jmp 0x10054266
push 0xffffff
mov ecx, dword [ebx + 4]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetBkColor_unsigned_long_int_]
mov eax, dword [esi]
mov eax, dword [eax + 0x64]
cmp eax, 0x10040100
jne 0x100542c0
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebx + 4]
push eax
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetTextColor_unsigned_long_int_]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebx + 4]
push eax
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetTextColor_unsigned_long_int_]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push ecx
call eax
jmp 0x100541d9
push esi
call eax
jmp 0x10054212
push esi
call eax
jmp 0x10054247
push esi
call eax
jmp 0x1005425e
push esi
call eax
jmp 0x10054292
Function at 0x10062a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c10cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1023c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 8]
mov dword [edi], 0x101dec74
mov dword [edi + 4], 0
mov dword [ebp - 0x10], esi
mov dword [esi], 0x101df5d4
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0x101de9b8
mov dword [esi + 0x18], 0x101de814
mov dword [esi + 0x20], 0x101df338
mov dword [esi + 0x24], 0
push 0x68
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add esi, 0x20
mov ecx, esi
call fcn.1003f030
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x58]
cmp edx, sym.HncOfficeFramework.dll_public_virtual:_void___thiscall_CHncColorPickerID::SetColorPickerID_int_
jne 0x10062b42
mov dword [esi + 4], 0
mov eax, dword [eax + 0x60]
cmp eax, sym.HncOfficeFramework.dll_public:_void___thiscall_CHDCListCtrl::SetOption_unsigned_long_int_
jne 0x10062b4c
mov eax, edi
mov dword [edi + 0xa0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
jmp 0x10062b1b
push 0
mov ecx, esi
call eax
jmp 0x10062b25
Function at 0x10062bb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c10f8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x1023c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], 0x101de9b8
mov dword [ebp - 0x2c], 0x101de814
mov dword [ebp - 0x24], 0x101df338
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x30]
mov dword [ebp - 0x14], 0
mov eax, dword [ecx + 0xc]
cmp eax, 0x10064a20
jne 0x10062d6b
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], eax
cmp edx, sym.HncOfficeFramework.dll_public_virtual:_int___thiscall_CHncColorPickerID::GetColorPickerID_void_const
jne 0x10062d7c
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0x10]
push dword [ecx + 4]
push dword [ecx]
lea ecx, [ebp - 0x24]
push eax
push dword [esi + 4]
call fcn.1003fdd0
and edi, 0xf
mov dword [ebp - 0x20], 0
cmp edi, 1
je 0x10062c7d
cmp edi, 2
jne 0x10062cc1
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 8]
lea edx, [ebp - 0x3c]
call fcn.10064150
add esp, 4
test eax, eax
je 0x10062cc1
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
mov ecx, esi
push dword [ebp + 8]
push dword [ebp - 0x14]
push eax
push 1
call fcn.100639a0
test eax, eax
jne 0x10062cc1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 0x20]
test eax, eax
je 0x10062d52
cmp edi, 1
je 0x10062cdc
cmp edi, 2
jne 0x10062ce6
push 1
lea ecx, [esi + 8]
call fcn.100627c0
push 0
lea ecx, [ebp - 0x2c]
call fcn.1003fbb0
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
mov ebx, 1
call dword [eax + 0x20]
test eax, eax
je 0x10062d16
mov eax, dword [esi + 0x30]
and eax, 0xf
cmp eax, ebx
je 0x10062d11
cmp eax, 2
jne 0x10062d16
mov ebx, 0x401
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x28]
call fcn.1003fe30
push 2
lea ecx, [esi + 0x20]
call fcn.1003fbb0
test eax, eax
je 0x10062d40
cmp dword [esi + 0x34], 0
je 0x10062d40
push 0
lea ecx, [esi + 0x20]
call fcn.1003fa70
push ebx
push ecx
mov ecx, dword [esi + 0xc]
call fcn.10064360
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0x10]
call eax
mov ecx, dword [esi + 0x10]
jmp 0x10062c40
lea ecx, [esi + 0x10]
call edx
jmp 0x10062c55
Function at 0x1007ae50
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
xor eax, eax
mov esi, ecx
test edi, edi
jle 0x1007af3b
test esi, esi
je 0x1007af3b
push ebx
mov ebx, edi
sar edi, 2
and ebx, 3
test edi, edi
jle 0x1007aeab
movzx ecx, byte [esi]
dec edi
movzx edx, byte [esi + 1]
add eax, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add eax, edx
movzx edx, byte [esi + 3]
shl edx, 8
add esi, 4
add edx, ecx
mov ecx, eax
shl ecx, 0x10
shl edx, 0xb
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test edi, edi
jg 0x1007ae75
sub ebx, 1
je 0x1007aef9
sub ebx, 1
je 0x1007aedd
sub ebx, 1
jne 0x1007af0b
movzx ecx, byte [esi]
movzx edx, byte [esi + 1]
add eax, ecx
movsx ecx, byte [esi + 2]
shl edx, 8
shl ecx, 2
add eax, edx
xor ecx, eax
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x1007af09
movzx ecx, byte [esi]
movzx edx, byte [esi + 1]
add eax, ecx
shl edx, 8
add eax, edx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x1007af09
movsx ecx, byte [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [eax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
pop ebx
shr ecx, 6
pop edi
add eax, ecx
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x10087b10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1023c014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1023fa38], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
jne 0x10087b48
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008548c
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
mov dword [0x1023fa38], 1
cmp word [ecx], bx
je 0x10087bf0
push 0x101cfb7c
push ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x10087bf0
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x10087bf0
push esi
push edi
push eax
push 0x1e
lea eax, [ebp - 0x24]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov byte [ebp - 6], bl
mov ebx, str.HWP_Document_File_V3.00
xor edi, edi
lea edx, [ebp - 0x24]
mov eax, ebx
mov esi, 0x1a
nop word [eax + eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10087bc9
add edx, 4
add eax, 4
sub esi, 4
jae 0x10087bb0
mov cx, word [edx]
cmp cx, word [eax]
je 0x10087c0b
add edi, 0x104
add ebx, 0x104
cmp edi, 0x514
jb 0x10087ba0
xor ebx, ebx
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
mov dword [0x1023fa38], 0
pop ebx
call fcn.1008548c
mov esp, ebp
pop ebp
ret
push 0
push 0x9e
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [ebp - 0x108]
lea eax, [ebp - 0x94]
push 0x38
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
lea eax, [ebp - 0x104]
push 0
push 0x38
push eax
push 0x38
lea eax, [ebp - 0x94]
push eax
push 0x30133
call dword [sym.imp.HncFoundation.dll_HncHCharToUnicode]
lea eax, [ebp - 0x104]
push eax
push 0x100
push dword [ebp - 0x10c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov ebx, 1
jmp 0x10087bdf