joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a4c1
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1005f0c5
call fcn.1005dcd4
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x24], 0x783c
mov eax, edx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x24], 0x7b35
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jle 0x1002a567
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, edi
mov dword [ebp - 0x14], esi
cdq
idiv ebx
mov eax, edx
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, 0x4846
mov esi, dword [ebp - 0x14]
mov ecx, edi
sar eax, cl
mov ecx, 0x10079b38
cdq
push edx
push eax
call fcn.10006e46
mov eax, dword [ebp - 0x18]
add edi, esi
dec ebx
jne 0x1002a50f
inc esi
push 0
mov dword [ebp - 0x14], esi
cmp esi, 0x25f7
pop esi
jl 0x1002a505
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x3b0a
jl 0x1002a4f8
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x29c1
jl 0x1002a4f3
push 0x16e7
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
cmp byte [ebp + 0x10], 0
je 0x1002a58b
cmp byte [ebp + 0x18], 0
je 0x1002a578
cmp byte [ecx], 0
jmp 0x1002a57b
cmp byte [eax], 0
je 0x1002a5c6
push esi
push 0x16ba
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1002a5c6
cmp byte [ebp + 8], 0
je 0x1002a5ad
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
cmp dword [eax], 0x1a
jge 0x1002a5c6
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0xfffffffc
inc dword [eax]
cmp dword [eax], 0x1a
jl 0x1002a59e
jmp 0x1002a5c6
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002a5c6
push 0x86b
push esi
push 0x1851
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x75db
jge 0x1002a5e1
mov edx, str.zbwxthr_igpmclvw_wkor_dcqjscde_kqcugui_jafs_htvhh_kdych_nvw_yte_kbycehzv
mov ecx, 0x10079b38
call fcn.10009b61
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a63e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push edi
mov edi, ecx
je 0x1002a6d3
cmp byte [ebp + 0x18], 0
je 0x1002a6ba
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push esi
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
push edi
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
push eax
call fcn.10032287
mov esi, dword [ebp + 0x10]
cmp esi, dword [ebx]
je 0x1002a686
mov eax, dword [edi]
cmp eax, dword [esi + 0x10]
jge 0x1002a6aa
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push ecx
mov ecx, ebx
call fcn.1003274f
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1003277f
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
pop esi
pop ebx
jmp 0x1002a6f0
push 0
push 0x63c
push 0x505
push 0x26aa
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1002a6f0
cmp byte [ebp + 0x14], 0
je 0x1002a6e6
cmp byte [edx], 0
je 0x1002a6f0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1002a6f0
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1002ade3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f0cf
call fcn.1005dcd4
sub esp, 0x44
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002ae38
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002afb7
push 0x50b2
push 0x662f
push 0x48
push 1
push 1
push 0x6a55
push 0x37a3
mov edx, 0x55eb
mov cl, 1
call fcn.100298d9
add esp, 0x1c
jmp 0x1002afb7
mov dword [ebp - 0x28], 0x7fa8
xor esi, esi
cmp dword [ebp - 0x28], 0x8256
jle 0x1002ae84
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10079b38
xor eax, edi
cdq
push edx
push eax
call fcn.10006e46
inc esi
cmp esi, 0x5843
jl 0x1002ae51
inc ebx
push 0
pop esi
cmp ebx, 0x4e48
jl 0x1002ae4e
inc edi
cmp edi, 0x358d
jl 0x1002ae4c
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 0x26c0
cmp dword [ebp - 0x24], 0x129c
jge 0x1002af62
lea eax, [ebp - 0x18]
mov ebx, str._ld__ld__ld
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.10045abb
add esp, 0x10
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x44], esi
push eax
push dword [ebp - 0x1c]
call fcn.100322ec
mov edi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1002af0b
dec eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.10045abb
mov ecx, dword [ebp - 0x30]
add esp, 0x10
dec ecx
jmp 0x1002af04
mov eax, dword [ebp - 0x34]
cmp dword [edi + ecx*4], eax
cmovl eax, dword [edi + ecx*4]
mov dword [edi + ecx*4], eax
inc ecx
cmp ecx, dword [ebp - 0x20]
jl 0x1002aef6
jmp 0x1002aed0
dec eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
mov ecx, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, esi
jle 0x1002af3f
mov eax, dword [edi + eax*4]
imul eax, eax
cdq
add ebx, eax
mov eax, dword [ebp - 0x24]
adc ecx, edx
inc eax
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x1c]
jl 0x1002af28
push ecx
push ebx
push str._lld_n
call fcn.1004603d
add esp, 0xc
test edi, edi
je 0x1002af62
push edi
call fcn.100451d4
pop ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x28], 0x7e69
jge 0x1002af98
mov edx, str.nirxbkums_xgvlll_pvy_prnzlhty_pzgcch_xrykwtv_bdkud_cavucoxdy_tjjw
mov ecx, 0x10079b38
call fcn.10009b61
jmp 0x1002af98
mov edx, dword [ebp + 8]
mov dword [edx], esi
cmp dword [edx], 3
jge 0x1002afb7
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x19fa553f
inc dword [edx]
cmp dword [edx], 3
jl 0x1002afa5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b87a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
test dl, dl
je 0x1002b8ca
cmp byte [ebp + 0x18], 0
je 0x1002b8ac
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002b8f0
push esi
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1002b89a
pop esi
jmp 0x1002b8f0
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002b8f0
push 0x86b
push 0
push 0x1851
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1002b8f0
cmp byte [ebp + 0xc], 0
je 0x1002b8e9
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002b8f0
push 0x2317
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1002b8f0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002c112
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1005f10b
call fcn.1005dcd4
sub esp, 0x24
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
je 0x1002c269
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], eax
mov dword [edi], esi
cmp dword [edi], 0xffffffef
je 0x1002c27e
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x18], 0x380ee91b
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x4553
cmp dword [ebp - 0x1c], 0x484b
jle 0x1002c1ad
mov ebx, esi
mov edi, esi
mov eax, edi
mov ecx, 0x10079b38
xor eax, ebx
cdq
push edx
push eax
call fcn.10006e46
inc edi
cmp edi, 0x363a
jl 0x1002c173
inc ebx
cmp ebx, 0x6741
jl 0x1002c171
push esi
push esi
push esi
push esi
push 0x172d
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
sub edx, dword [edi]
mov eax, dword [ebp - 0x14]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp + 8]
sete cl
mov dword [edx], ecx
cmp dword [edx], esi
je 0x1002c1da
cmp dword [edi], esi
je 0x1002c1da
xor ecx, ecx
inc ecx
jmp 0x1002c1dc
mov ecx, esi
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [edi]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x18]
add ecx, eax
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
add ecx, 0xb2726aa7
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x14], ecx
je 0x1002c208
mov eax, dword [edi]
mov eax, dword [edi]
xor ecx, ecx
cmp eax, 1
setne cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x4202
jge 0x1002c230
mov edx, str.nwkq_efu_csbjg_aewhslyq_xmkjfy_jqqtrkp_fnbxgsmq_ilaxwpxy
mov ecx, 0x10079b38
call fcn.10009b61
or dword [ebp - 4], 0xffffffff
dec dword [edi]
jmp 0x1002c141
cmp byte [ecx], 0
je 0x1002c27e
xor esi, esi
push esi
push 0x1096
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c58e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov byte [esp + 4], cl
push ebx
push edi
test cl, cl
je 0x1002c640
mov dword [esp + 0x1c], 0x39bf
cmp dword [esp + 0x1c], 0x3c1c
jle 0x1002c623
xor edi, edi
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], 0xb85
mov dword [esp + 0x10], ebx
mov edi, ebx
mov ebx, 0x2a2e
mov eax, edi
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.1000288f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002c5ea
mov eax, dword [eax]
push eax
call fcn.1004603d
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.100078fb
inc edi
dec ebx
jne 0x1002c5d2
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
add ebx, edi
dec dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jne 0x1002c5cb
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x43b7
jl 0x1002c5bd
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
cmp dword [esp + 0x1c], 0x38e8
jge 0x1002c653
push str.zmrxdgxmm_xkjkje_ooqvk_jlmhilwwe_rlst_uuanc_ovqgnye_tumh_sdlcicl_vlizmz_ayky_przw_bftv_vruseipwu
call fcn.1004603d
pop ecx
jmp 0x1002c653
push 0
push 0x5ad
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d6eb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f160
call fcn.1005dcd4
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x25ba
cmp dword [ebp - 0x20], 0x2680
push edi
mov dword [ebp - 0x10], esp
jle 0x1002d771
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x24], 0
mov eax, edi
cdq
idiv ebx
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10079b38
xor eax, edx
cdq
push edx
push eax
call fcn.10006e46
mov edx, dword [ebp - 0x14]
inc ebx
cmp ebx, 0x2980
jl 0x1002d729
inc edi
cmp edi, 0x4f62
jl 0x1002d727
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x547c
jl 0x1002d718
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x7a29
jl 0x1002d713
cmp byte [ebp + 0xc], 0
je 0x1002d842
mov dword [ebp - 0x1c], 0x6635
cmp dword [ebp - 0x1c], 0x67e0
jle 0x1002d7eb
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10079b38
cdq
push edx
push eax
call fcn.10006e46
inc ebx
cmp ebx, 0x5aa6
jl 0x1002d78f
inc edi
cmp edi, 0x29d0
jl 0x1002d78d
push 0x1d2
push 0xfb9
push 0x20af
push 0x1dc8
push 0x129b
push 0x25aa
push 0x183c
push 0x95f
push 0x2078
push 0x5d4
push 0x3f
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002d80a
push 0
push 0x253e
push 0xb34
push 0x958
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6255
jge 0x1002d826
mov edx, str.arnjrpibs_epvdnbmqd_vwj_izergkpaf_eula_bkpiupgjl
mov ecx, 0x10079b38
call fcn.10009b61
jmp 0x1002d848
mov eax, dword [ebp + 8]
add dword [eax], 4
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x23e3
jge 0x1002d867
mov edx, str.ymcxonq_qfg_mmjiop_dmyqougj_wvgpoietj_gqn_ndxmohqhm_wuysu_nammi
mov ecx, 0x10079b38
call fcn.10009b61
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100363cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f431
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003653d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10036427
push 0x185d
push 0
push 0xe30
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x1003653b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x2943
mov dword [ebp - 0x30], str.aqtko_jajci_fqvsjwbng_tmbbhf_nlvf_nmxohu_uspgchb_fhkqwc_njjcwuo
cmp dword [ebp - 0x1c], 0x2cf9
jle 0x100364c8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
and dword [ebp - 0x14], 0
jmp 0x10036461
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7831
jge 0x100364bb
and dword [ebp - 0x18], 0
jmp 0x10036477
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x149c
jge 0x100364b9
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.1000288f
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10006e26
push eax
call fcn.1004603d
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10006e1c
jmp 0x10036470
jmp 0x1003645a
push 0xf72
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2630
jge 0x100364e4
push dword [ebp - 0x30]
call fcn.1004603d
pop ecx
jmp 0x10036500
or dword [ebp - 4], 0xffffffff
jmp 0x1003650a
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003653b
push 0x61ed
push 0x5aea
push 0x449c
push 0
push 0x21cd
push 0xb63
push 1
push 0
call fcn.10036147
add esp, 0x20
jmp 0x10036560
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0x1a9d
push 0
mov eax, dword [ebp - 0x3c]
push dword [eax]
call fcn.10036728
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036571
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f43b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100365b9
push 0x6291
push 0x345d
push 0x789d
push 1
call fcn.10036703
add esp, 0x10
jmp 0x100366f2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x32a5
mov dword [ebp - 0x24], str.mddgmrg_fueuazdm_nebnp_elllceru_mpvdpnvty
cmp dword [ebp - 0x20], 0x3563
jle 0x10036637
push 0
push 0x18c2
push 0
push 0x172d
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
and dword [ebp - 0x14], 0
jmp 0x100365f7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2bb0
jge 0x10036637
and dword [ebp - 0x18], 0
jmp 0x1003660d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2fd9
jge 0x10036635
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x10079b38
call fcn.10006e46
jmp 0x10036606
jmp 0x100365f0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2f67
jge 0x10036657
mov edx, dword [ebp - 0x24]
mov ecx, 0x10079b38
call fcn.10009b61
jmp 0x10036673
or dword [ebp - 4], 0xffffffff
jmp 0x1003667d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100366d6
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x100366c1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x1a
jge 0x100366d4
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0xfffffffc
jmp 0x100366b6
jmp 0x100366f2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x100366f2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c9ec
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003ca18
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.1003ca90
add esp, 0xc
jmp 0x1003ca8c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003ca41
push 0x14cb
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1003ca8c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003ca6f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1003ca8c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10001d6f
mov dword [eax], 0x93c34f97
jmp 0x1003ca64
mov esp, ebp
pop ebp
ret

Function at 0x1003caaf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003cb35
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003cb26
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003cb07
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1003cb24
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10001d6f
mov dword [eax], 9
jmp 0x1003cafc
jmp 0x1003cb33
push 0x207c
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1003cbb1
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003cb64
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x1003cbb1
mov byte [ebp - 1], 0
push 0x720a
push 0x4d48
push 0x5c74
push 0x6da4
push 1
push 1
push 1
push 0x6c53
push 0x31e
push 0x75c4
push 0xa9
push 0x7aec
push 0x426e
lea eax, [ebp - 1]
push eax
push 0x2e6
call fcn.100355d9
add esp, 0x3c
mov esp, ebp
pop ebp
ret
Function at 0x4019e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x401bc0
mov edx, eax
lea esi, [ebp - 0x18]
cmp ebx, 0x11
je 0x401b70
mov eax, dword [0x410cb0]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], edx
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [ebp - 0x10], sym._stream_out_16
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x44a
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [ebp - 0x24], eax
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x410cb0]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
mov ecx, dword [ebp - 0x24]
sub esp, 4
test ecx, ecx
je 0x401b30
xor eax, eax
movzx edx, word [edi + eax]
add eax, 2
mov word [eax + 0x411a7e], dx
test dx, dx
jne 0x401aa0
mov eax, 0x411a80
call sym._set_caption
mov eax, dword [0x410cb0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call esi
mov dword [0x410c40], ebx
sub esp, 0x10
call sym._set_bar_states
call sym._set_default_font
mov eax, dword [0x410c40]
mov dword [esp], eax
call sym._reg_formatindex
mov eax, dword [eax*4 + 0x411860]
mov dword [esp + 4], eax
mov eax, dword [0x410cb8]
mov dword [esp], eax
call sym._target_device
mov ecx, 1
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [esp + 8], eax
mov eax, dword [0x410cb0]
mov dword [ebp - 0x1c], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call esi
mov ecx, dword [ebp - 0x24]
sub esp, 0x10
test eax, eax
je 0x401a9e
jmp 0x401b1c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x41c3c0
mov dword [esp], eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
cmp dword [ebp - 0x18], 2
je 0x401a40
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x41c470
movzx eax, al
add eax, 0x6ab
mov dword [esp + 4], eax
mov eax, dword [0x410cb8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
xor ecx, ecx
sub esp, 0x10
jmp 0x401b1c
Function at 0x4081f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x408248
cmp byte [esi + ebx - 1], 0xa
je 0x40821c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x410dd8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret