joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e0
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4a6968
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004a5ac8
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004a5ae8
mov ebx, eax
jmp 0x4a693a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054d0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a428
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004095c4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004095c4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405688
je 0x4a691a
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054d0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004095c4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004095c4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405688
jne 0x4a692f
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004a5b08
mov ebx, eax
test ebx, ebx
jne 0x4a687b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a696f
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405284
lea eax, [ebp - 4]
call fcn.00405260
ret

Function at 0x4a6e6c
Capabilities:
Log keystrokes via application hook

Disassembly:
xor eax, eax
mov dword [0x4b403c], eax
push 0x4a6eac
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4b403c], eax
mov eax, dword [0x4ae010]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [0x4b4040], eax
push 0
mov eax, dword [0x4b17f8]
push eax
push 0x4a6e24
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4b4044], eax
ret
Function at 0x4a7164
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056e0
xor eax, eax
push ebp
push 0x4a723e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4a7254
mov edx, dword [ebp - 4]
call fcn.00405578
mov eax, dword [ebp - 8]
call fcn.004056f0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4a71ae.0
jmp dword [eax*4 + 0x4a71b5]
mov eax, ebx
mov edx, 0x4a7260
call fcn.004052b4
jmp 0x4a7223
mov eax, ebx
mov edx, 0x4a7274
call fcn.004052b4
jmp 0x4a7223
mov eax, ebx
mov edx, 0x4a7284
call fcn.004052b4
jmp 0x4a7223
mov eax, ebx
mov edx, 0x4a7298
call fcn.004052b4
jmp 0x4a7223
mov eax, ebx
mov edx, 0x4a72a8
call fcn.004052b4
jmp 0x4a7223
mov eax, ebx
mov edx, 0x4a72bc
call fcn.004052b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7245
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405284
ret
Function at 0x10004423
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x100928cc], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x10004467
call ebx
test eax, eax
jns 0x1000445d
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x100928c8], eax
mov dword [0x100928cc], 1
mov eax, dword [0x100928c8]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x10004483
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x100044b3
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x100044a9
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x1000449d
push dword [eax + 8]
call dword [eax]
jmp 0x100044a3
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x100044b2
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x10005a22
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, ecx
je 0x10005aba
mov ecx, dword [ebx + 0x2c]
call fcn.10004889
test eax, eax
je 0x10005a53
push 1
mov ecx, eax
call fcn.1003b0c0
test byte [ebp + 0xc], 2
je 0x10005ab2
push esi
push edi
mov edi, 0x10092ab8
push edi
push str.__supdate_install.exe_
mov esi, 0x104
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.100011f2
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.1004a0e0
push edi
push 0x10071138
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.100011f2
add esp, 0x2c
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
mov ecx, dword [ebx + 0x2c]
call fcn.10005756
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.100511f7
leave
ret 0x10

Function at 0x100064d2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000652c
cmp dword [ebp + 0x10], 1
je 0x10006511
cmp dword [ebp + 0x10], 2
je 0x10006511
push 0xd
pop eax
jmp 0x1000652c
test edi, edi
mov eax, dword [ebp - 4]
je 0x10006528
test eax, eax
je 0x10006525
cmp byte [eax + edi - 1], 0
je 0x10006528
jmp 0x1000650c
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x1000716a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push esi
push edi
mov esi, ecx
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1012
push dword [esi + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x100071c5
cmp dword [ebp - 0xc], 8
jne 0x100071c5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x100071c5
push dword [ebp - 8]
mov ecx, esi
call fcn.100070ea
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10
Function at 0x100074d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x504
lea ebp, [esp - 4]
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp + 0x504], eax
push 0x40
mov eax, 0x10069e10
call fcn.1005163c
mov ebx, dword [ebp + 0x510]
xor edi, edi
mov esi, 0x100a61f4
push esi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], edi
call fcn.1000250e
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 1
call fcn.1000250e
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.1000250e
mov dword [ebp - 0x10], edi
push 0x100a2a38
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.10006ba1
push 0x20019
push 0x10099fb0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.1000649d
cmp eax, edi
jne 0x1000766a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x400]
push eax
push dword [0x10090d8c]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 0x104
call fcn.100064d2
cmp eax, edi
jne 0x1000766a
push esi
lea ecx, [ebp - 0x1c]
call fcn.1000250e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
push dword [0x10090d88]
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xb
mov dword [ebp - 0x18], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x10007632
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x38]
call fcn.100065be
push 0x200
lea eax, [ebp]
push eax
push edi
lea eax, [ebp - 0x4c]
push eax
push edi
mov esi, 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x200
lea eax, [ebp + 0x200]
push eax
push edi
lea eax, [ebp - 0x4c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp + 0x200]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push str._s__s
push eax
call fcn.10003228
add esp, 0x10
mov esi, dword [ebp - 0x1c]
push esi
lea eax, [ebp + 0x400]
push eax
push 0x10098628
lea eax, [ebp - 0x14]
push 0x100a2630
push eax
call fcn.10003228
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.1000704c
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.10001b77
push 0x100a2420
push 0x100a00a8
push 0x100a2528
push 0x1009f490
push str._br__br__a_href__s___s__a__br__a_href__s___s__a_
push ebx
call fcn.10006bc6
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.10006486
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001b77
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.10001b77
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x504]
xor ecx, ebp
call fcn.100511f7
add ebp, 0x508
leave
ret
Function at 0x10008275
Capabilities:
Accept command line arguments

Disassembly:
push ebx
xor ebx, ebx
cmp byte [0x1008cc8c], bl
je 0x1000829f
push ebx
push str.Embedding
mov byte [0x1008cc8c], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.10034224
add esp, 0xc
test eax, eax
jne 0x100082fe
call fcn.10007dae
test al, al
je 0x100082fe
push esi
mov esi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x140]
cmp eax, dword [0x100a3818]
jbe 0x100082f0
cmp byte [esi + 0x144], bl
je 0x100082f0
mov eax, dword [esi + 0x60]
push dword [eax + 0x60]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100082f0
cmp byte [esi + 0x145], bl
je 0x100082f0
mov eax, dword [esp + 0x14]
or word [eax], 0xffff
mov ecx, esi
call fcn.100080f2
mov byte [esi + 0x144], 1
mov dword [esi + 0x140], ebx
pop esi
pop ebx
ret 0xc

Function at 0x10008885
Capabilities:
Log keystrokes via application hook

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0x134], 0
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
jne 0x100088b7
mov ebp, dword [esi + 0x120]
call ebx
push eax
push 0
push ebp
push 7
call edi
mov dword [esi + 0x134], eax
lea ebp, [esi + 0x138]
cmp dword [ebp], 0
jne 0x100088dd
mov eax, dword [esi + 0x124]
mov dword [esp + 0x10], eax
call ebx
push eax
push 0
push dword [esp + 0x18]
push 2
call edi
mov dword [ebp], eax
lea ebp, [esi + 0x13c]
cmp dword [ebp], 0
jne 0x100088fc
mov esi, dword [esi + 0x128]
call ebx
push eax
push 0
push esi
push 4
call edi
mov dword [ebp], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10009c2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x539
push 5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10009c4d
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10009c63
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, dword [esi]
mov dword [esi], eax
jbe 0x10009c82
push 0x7a
pop eax
jmp 0x10009c97
cmp dword [ebp + 0xc], 0
je 0x10009c95
push eax
push ebx
push dword [ebp + 0xc]
call fcn.10052b10
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop ebp
ret

Function at 0x10009d89
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x10009ddc
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x10009df2
push 0x80004005
call fcn.1000199e
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10009df5
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000a7be
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.1000649d
mov edi, eax
cmp edi, esi
je 0x1000a826
lea ecx, [ebp - 0x70]
call fcn.10006486
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100511f7
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000a83e
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.1000a7be
cmp eax, esi
jne 0x1000a871
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x1000a82e
lea ecx, [ebp - 0x70]
call fcn.10006486
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.10006486
mov eax, esi
jmp 0x1000a80c
Function at 0x1000d52e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x1006a385
call fcn.1005166f
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x100913cc]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x1000d5e8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000193a
add esp, 0xc
test eax, eax
jl 0x1000d5e8
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x1000d5d0
push edi
call fcn.10001fe7
test al, al
pop ecx
je 0x1000d5d0
mov eax, edi
call fcn.100524c0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000d5d9
push edi
lea ecx, [ebp - 0x20]
call fcn.100024a3
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.10009ac2
cmp eax, ebx
jne 0x1000d62d
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000d5f8
lea ecx, [ebp]
call fcn.1000a697
lea ecx, [ebp - 0x20]
call fcn.10001e0a
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.100511f7
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call fcn.1000b1ce
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x1000d64b
call fcn.10009bfd
mov esi, eax
jmp 0x1000d715
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1000d668
call fcn.10009bfd
jmp 0x1000d70a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x1000d65e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x1000d6af
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000d69b
lea ecx, [ebp]
call fcn.1000a697
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.10001e0a
mov eax, esi
jmp 0x1000d605
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.1000c18a
mov dword [ebp - 4], 1
jmp 0x1000d6d7
cmp dword [ebp], ebx
jne 0x1000d6e3
mov esi, 0x8007000e
jmp 0x1000d70c
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.10009b26
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.1000d10e
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000d6a0
lea ecx, [ebp]
call fcn.1000a697
jmp 0x1000d6a0
Function at 0x10015ca8
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x10
mov eax, 0x1006aa46
call fcn.1005163c
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push ebx
push 0x146
add edi, 0x14c
push dword [edi]
mov dword [ebp - 4], ebx
call esi
mov ecx, dword [ebp + 0x40c]
cmp ecx, ebx
mov dword [ebp - 0x10], eax
je 0x10015d01
call fcn.100113fb
jmp 0x10015d03
xor eax, eax
push eax
push 0xffffffffffffffff
push 0x158
push dword [edi]
call esi
cmp eax, 0xffffffff
jne 0x10015e01
cmp dword [ebp - 0x10], 0x14
jl 0x10015d3d
mov eax, dword [ebp - 0x10]
dec eax
push eax
mov ecx, edi
call fcn.10011397
push ebx
push ebx
push 0x146
push dword [edi]
call esi
cmp eax, 0x14
mov dword [ebp - 0x10], eax
jge 0x10015d1e
mov ecx, dword [ebp + 0x40c]
cmp ecx, ebx
je 0x10015d4e
call fcn.100113fb
jmp 0x10015d50
xor eax, eax
push eax
push ebx
push 0x14a
push dword [edi]
call esi
push 0x10099ea8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], SysReAllocString
call fcn.1000a7be
lea ecx, [ebp - 0x14]
call fcn.10006486
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push 0x10099ea8
push SysReAllocString
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.10009d3b
push ebx
push ebx
push 0x146
push dword [edi]
call esi
cmp eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
jle 0x10015ddb
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push 0x148
push dword [edi]
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jl 0x10015daa
lea ecx, [ebp - 0x14]
call fcn.10006486
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x60]
mov ecx, dword [eax]
push 0x7fff0002
push eax
call dword [ecx + 0x50]
push ebx
push ebx
push 0x14e
push dword [edi]
call esi
jmp 0x10015e09
push eax
mov ecx, edi
call fcn.10011367
mov ecx, dword [ebp + 0x40c]
cmp ecx, ebx
je 0x10015e18
call fcn.100123b5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.100511f7
add ebp, 0x404
leave
ret 4
Function at 0x100168d7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
cmp byte [esi - 4], 0
push edi
je 0x10016916
push str.err_CTB_E_OBJECTREMOVED
push 0x100a3ba4
mov esi, 0x80041401
push esi
call fcn.100033e6
add esp, 0xc
mov dword [ebp - 8], esi
jmp 0x100169d3
cmp dword [ebp + 0xc], 0
jne 0x10016928
mov dword [ebp - 8], 0x80004003
jmp 0x100169d3
push dword [esi + 0x84]
mov edi, 0x10070d78
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
test ebx, ebx
jle 0x10016987
inc ebx
mov eax, ebx
call fcn.100524c0
mov edi, esp
push ebx
push edi
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x10016987
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1001696b
call esi
jmp 0x10016977
call esi
and eax, 0xffff
or eax, 0x80070000
test eax, eax
mov dword [ebp - 8], eax
jl 0x100169d3
mov dword [ebp - 8], 0x80004005
jmp 0x100169d3
call dword [0x100913cc]
test edi, edi
mov ebx, eax
je 0x100169a5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x100169a9
xor eax, eax
jmp 0x100169bc
lea eax, [esi + esi]
call fcn.100524c0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.10001967
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jne 0x100169e3
mov dword [ebp - 8], 0x8007000e
push dword [0x1008e550]
push dword [ebp - 8]
call fcn.100032c5
pop ecx
pop ecx
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100511f7
leave
ret 8

Function at 0x10016a40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009140c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp byte [esi - 4], 0
je 0x10016a9a
push str.err_CTB_E_OBJECTREMOVED
push 0x100a3ba4
mov edi, 0x80041401
push edi
call fcn.100033e6
add esp, 0xc
push dword [0x1008e550]
push edi
call fcn.100032c5
pop ecx
pop ecx
mov eax, edi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100511f7
leave
ret 4
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
test ebx, ebx
jle 0x10016a84
inc ebx
mov eax, ebx
call fcn.100524c0
mov dword [ebp - 8], esp
push ebx
push dword [ebp - 8]
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x10016afb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10016add
call esi
mov edi, eax
jmp 0x10016aed
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x10016a76
mov edi, 0x80004005
jmp 0x10016a76
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
call fcn.10011c34
lea ecx, [esi - 0xc8]
call fcn.10015ca8
jmp 0x10016a84