joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102d270
Capabilities:
Get mac address on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2804
call fcn.011217d0
push esi
push 0x2800
lea eax, [ebp - 0x2804]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x2804]
push edx
xor esi, esi
mov dword [ebp - 4], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x102d2f5
lea eax, [ebp - 0x2804]
lea esp, [esp]
test esi, esi
jne 0x102d2ef
movzx esi, byte [eax + 0x196]
movzx ecx, byte [eax + 0x197]
movzx edx, byte [eax + 0x198]
shl esi, 8
add esi, ecx
movzx ecx, byte [eax + 0x199]
shl esi, 8
add esi, edx
shl esi, 8
add esi, ecx
mov eax, dword [eax]
test eax, eax
jne 0x102d2c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x102d3d0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push 0x11c
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
add esp, 0xc
push 3
mov ecx, 2
xor edx, edx
push ecx
push edx
push edx
mov dword [ebp - 0x11c], 0x11c
mov dword [ebp - 0x118], 5
mov dword [ebp - 0x114], 1
mov word [ebp - 8], cx
mov word [ebp - 6], dx
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_VerifyVersionInfoW]
pop esi
test eax, eax
je 0x102d47b
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x26a8c], 5
jne 0x102d47b
cmp dword [ecx + 0x26a90], 2
jne 0x102d47b
cmp word [ecx + 0x26b1c], 1
jae 0x102d47b
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1032270
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10322c9
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push fcn.01032200
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x10322bf
push esi
call fcn.01032200
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [edi + 0x1bc]
push eax
call edx
pop edi
pop esi
pop ebp
ret 8

Function at 0x1034e30
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x1034e40
xor eax, eax
jmp 0x1034e5d
cmp word [ecx], 0
mov eax, ecx
je 0x1034e59
jmp 0x1034e50
add eax, 2
cmp word [eax], 0
jne 0x1034e50
sub eax, ecx
sar eax, 1
push esi
push eax
push ecx
call fcn.0101e7a0
mov esi, eax
test esi, esi
je 0x1034e93
push 0x5c
push esi
call fcn.0101e680
test eax, eax
je 0x1034e83
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebp
ret 8
Function at 0x1039570
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x470]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 4
push 0x1000
add eax, 0x1b8
push eax
push 0
push edi
mov dword [ebp - 4], 0
call ecx
mov esi, eax
test esi, esi
je 0x1039691
push 0x40
lea edx, [ebp - 0x44]
push 0
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x40
lea edx, [ebp - 0x44]
push edx
mov eax, 0x5a4d
push esi
mov word [ebp - 0x44], ax
mov eax, dword [ebx + 0x408]
push edi
mov dword [ebp - 8], 0x40
call eax
test eax, eax
je 0x1039691
cmp dword [ebp - 4], 0x40
jne 0x1039691
push 0xf8
lea edx, [ebp - 0x13c]
lea ecx, [esi + 0x40]
push 0
push edx
mov dword [ebp + 0xc], ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0xe0
mov word [ebp - 0x128], ax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0x408]
mov ecx, 0x2000
push 0xf8
mov word [ebp - 0x126], cx
mov edx, 1
lea ecx, [ebp - 0x13c]
mov word [ebp - 0x136], dx
mov edx, dword [ebp + 0xc]
push ecx
push edx
push edi
mov dword [ebp - 0x13c], 0x4550
call eax
test eax, eax
je 0x1039691
cmp dword [ebp - 4], 0xf8
jne 0x1039691
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push esi
add ecx, 0xf8
push ecx
push edi
push ebx
call fcn.01039480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1039780
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [esi + 0x45c]
add esp, 0xc
push 0
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push edi
push ebx
call edx
test eax, eax
je 0x1039825
mov eax, 0x5a4d
cmp word [ebp - 0x40], ax
jne 0x1039825
push 0xf8
lea ecx, [ebp - 0x138]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0x45c]
add esp, 0xc
push 0
push 0xf8
lea edx, [ebp - 0x138]
push edx
add eax, edi
push eax
push ebx
call ecx
test eax, eax
je 0x1039825
cmp dword [ebp - 0x138], 0x4550
jne 0x1039825
test dword [ebp - 0x122], 0x2000
jne 0x1039825
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x103ae90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push 0x105
lea eax, [ebp - 0x108]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push 0x103
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.0103a5d0
push 0x11
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x103af6b
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push edi
mov dword [esi], eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
push 0x103ad80
push 0
lea ecx, [ebp - 0x108]
lea ebx, [esi + 0xc]
push 0
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x103af59
cmp edi, 0xffffffff
je 0x103af59
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0xc8
push edi
call esi
cmp eax, 0x102
jne 0x103af49
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
je 0x103af49
push 0xffffffffffffffff
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10410f0
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x24
push ebx
push esi
mov esi, dword [eax + 8]
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x1041202
push edi
push 8
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push ebx
mov edi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push ebx
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
push esi
call ebx
push 0
push 0x100c00c
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10411f8
lea edx, [ebp - 0x24]
push edx
push eax
call ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, edi
cdq
sub eax, edx
sub ebx, ecx
sar eax, 1
cmp ebx, eax
jg 0x104118c
test ecx, ecx
je 0x104118c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub ecx, eax
sub eax, dword [ebp - 8]
push 1
push ecx
mov ecx, dword [ebp - 0x14]
sub edx, ecx
push edx
sub eax, ebx
jmp 0x10411b0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
sub edx, ecx
cmp ecx, eax
push 1
jge 0x10411ca
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, edx
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x14]
sub ebx, ecx
push ebx
sub eax, edx
add eax, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
push eax
add ecx, edi
push ecx
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
sub eax, ecx
sub ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
sub ebx, eax
sub eax, dword [ebp - 0xc]
push ebx
sub eax, edx
push ecx
add eax, edi
push eax
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.01041060
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1041800
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push eax
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x1041871
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0x403
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x104186f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x1c]
push 0x1ff
push esi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test edi, edi
je 0x1041863
mov eax, dword [ebp + 0x14]
dec eax
push eax
push esi
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
pop edi
pop ebp
ret 0x10
Function at 0x1047380
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
xor esi, esi
add esp, 8
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
jle 0x10474a0
push ebx
mov ebx, dword [ebp + 0xc]
push 0x40001
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1047487
lea eax, [esi - 1]
cmp eax, 4
ja case.default.0x10473db
lea ecx, [esi - 1]
jmp dword [ecx*4 + 0x10474ac]
push 0x40000
push 0xff
jmp 0x104741a
xor esi, esi
call dword [sym.imp.msvcrt.dll_rand]
mov byte [esi + edi], al
inc esi
cmp esi, 0x40000
jb 0x10473f0
mov esi, dword [ebp - 4]
jmp case.default.0x10473db
push 0x40000
push 0x52
jmp 0x104741a
push 0x40000
push 0xad
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
test esi, esi
je 0x104743a
mov eax, dword [ebp + 8]
push 1
push 0
mov edx, ebx
neg edx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor esi, esi
test ebx, ebx
jbe 0x1047474
mov eax, ebx
sub eax, esi
cmp eax, 0x40000
jbe 0x1047450
mov eax, 0x40000
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x1047474
add esi, dword [ebp - 0xc]
mov dword [ebp - 8], 1
cmp esi, ebx
jb 0x1047440
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov esi, dword [ebp - 4]
inc esi
cmp esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
jl 0x10473b2
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1048040
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea edi, [ebx + 0x323]
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x10480b1
cmp esi, 0xffffffff
je 0x10480b1
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push 0
lea eax, [ebp + 8]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push ebx
call fcn.01047fb0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 0x14
Function at 0x10481c0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
push 0x9c
lea eax, [ebp - 0xa0]
push 0
mov esi, 2
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
push 0x23c
lea ecx, [ebp - 0x2dc]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], 1
call fcn.0111e9f0
mov ebx, eax
test ebx, ebx
je 0x104829d
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], 0
mov edi, edi
lea ecx, [ebp - 0x2dc]
push ecx
push ebx
call fcn.011210e0
test eax, eax
jne 0x104828b
cmp dword [ebp - 0xcc], 0x1400000
jae 0x1048285
lea esi, [edi + 0x323]
push esi
push eax
push 2
push ebx
call fcn.011210b0
test eax, eax
jne 0x104827e
push 3
lea edx, [ebp - 0x1d8]
push edx
push edi
call fcn.01047fb0
mov dword [ebp - 4], eax
test eax, eax
je 0x104827e
mov dword [ebp + 0xc], 1
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [ebp + 0xc], 0
je 0x1048230
push ebx
call fcn.0111e000
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x104a370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
sub esp, 8
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x104a390
mov esp, ebp
pop ebp
ret 0x14
add dword [ebp + 0x10], 5
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], ebx
mov esi, dword [ebp + 8]
lea edi, [eax + esi]
cmp edi, ebx
jae 0x104a3bf
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x104a3bf
inc edi
cmp edi, ebx
jb 0x104a3b2
mov eax, edi
sub eax, esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp edi, ebx
jae 0x104a4e0
cmp ecx, 3
jbe 0x104a3dc
xor esi, esi
mov dword [ebp + 0xc], esi
jmp 0x104a41f
dec ecx
shl edx, cl
and edx, 7
mov dword [ebp + 0xc], edx
je 0x104a41c
mov ecx, edx
movzx edx, byte [ecx + 0x1008df8]
mov esi, edi
sub esi, edx
cmp byte [ecx + 0x1008df0], 0
mov dl, byte [esi + 4]
je 0x104a409
test dl, dl
je 0x104a409
cmp dl, 0xff
jne 0x104a41c
and ecx, 3
add ecx, ecx
or ecx, 1
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
inc eax
mov edx, ecx
jmp 0x104a3a8
mov esi, dword [ebp + 0xc]
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x104a441
cmp cl, 0xff
je 0x104a441
and esi, 3
add esi, esi
or esi, 1
mov dword [ebp + 0xc], esi
inc eax
mov edx, esi
jmp 0x104a3a8
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
nop
cmp dword [ebp + 0x18], 0
je 0x104a46e
lea ebx, [edx + eax]
add ebx, dword [ebp + 0x10]
jmp 0x104a475
sub edx, eax
sub edx, dword [ebp + 0x10]
mov ebx, edx
test esi, esi
je 0x104a4b0
movzx esi, byte [esi + 0x1008df8]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x104a49a
cmp dl, 0xff
jne 0x104a4b0
mov ecx, 0x20
sub ecx, esi
mov esi, dword [ebp + 0xc]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x104a460
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
mov ecx, ebx
shr edx, 8
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [ebp + 0xc]
mov byte [edi + 1], bl
mov ebx, dword [ebp - 8]
mov byte [edi + 3], cl
add eax, 5
jmp 0x104a3a8
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x104a4f5
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 0x14
dec ecx
shl edx, cl
mov ecx, dword [ebp + 0x14]
and edx, 7
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x104dd60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x104ddc7
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x802
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x104ddc0
push 0x802
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x104ddb7
push 0x3ff
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 8

Function at 0x104e630
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0x3a6
cmp byte [edi], 0
mov dword [ebp - 4], 0xffffffff
je 0x104e67c
xor ebx, ebx
mov esi, 0x11258d0
mov eax, dword [esi]
push eax
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
je 0x104e674
add esi, 0x20
inc ebx
cmp esi, 0x1125a50
jl 0x104e655
jmp 0x104e67c
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
jne 0x104e6b2
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx edi, ax
test edi, edi
je 0x104e6b2
xor esi, esi
mov edx, 0x11258dc
xor eax, eax
mov ecx, edx
cmp dword [ecx], edi
je 0x104e6a3
inc eax
add ecx, 4
cmp eax, 5
jl 0x104e694
jmp 0x104e6a6
mov dword [ebp - 4], esi
add edx, 0x20
inc esi
cmp edx, 0x1125a5c
jl 0x104e690
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x104e8f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x4064], edi
jne 0x104e9be
push ebx
lea ebx, [esi + 0x1c]
test ebx, ebx
je 0x104e9bd
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x4060]
cmp eax, 0x1000
jge 0x104e9b2
mov ecx, dword [ebp + 0x10]
shl eax, 5
mov dword [eax + esi + 0x40b4], ecx
mov edx, dword [esi + 0x4060]
mov ecx, dword [ebp + 0xc]
shl edx, 5
mov dword [edx + esi + 0x40b8], 1
mov eax, dword [esi + 0x4060]
shl eax, 5
lea eax, [eax + esi + 0x40a4]
push eax
push edi
push eax
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x104e99e
cmp edi, 0xffffffff
je 0x104e99e
mov edx, dword [esi + 0x4060]
mov dword [esi + edx*4 + 0x60], edi
mov eax, dword [esi + 0x4060]
inc eax
and eax, 0x80000fff
jns 0x104e996
dec eax
or eax, 0xfffff000
inc eax
mov dword [esi + 0x4060], eax
jmp 0x104e9b2
mov ecx, dword [esi + 0x4060]
shl ecx, 5
mov dword [ecx + esi + 0x40b8], 0
test ebx, ebx
je 0x104e9bd
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1052dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc0], 0
jne 0x1052e00
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x32
call ebx
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x1052dff
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc0], 0
je 0x1052de4
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1056700
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x28344], 0
je 0x1056775
mov ecx, dword [edi + 8]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1056775
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x105676e
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov edx, dword [edi]
mov eax, dword [edx + 0x28344]
add esp, 0xc
test eax, eax
je 0x1056765
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4

Function at 0x1056780
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10567e7
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10567e0
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
add eax, 0x284ac
je 0x10567d7
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4
Function at 0x1059ee0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebx + 0x24740]
je 0x1059f27
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1059fbd
mov eax, dword [edi + 0x1c]
push 0x1ff
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1059f29
xor esi, esi
test esi, esi
je 0x1059fbd
mov ecx, dword [ebx + 0x24744]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.01041630
mov ebx, eax
test ebx, ebx
je 0x1059fa4
mov ecx, ebx
mov eax, esi
jmp 0x1059f50
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1059f76
test dx, dx
je 0x1059f72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1059f76
add eax, 4
add ecx, 4
test dx, dx
jne 0x1059f50
xor eax, eax
jmp 0x1059f7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1059fbd
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_HeapFree]
push eax
call esi
push ebx
push 0
call edi
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x105a090
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x24750]
mov eax, dword [eax + 0x1c]
push edi
push 0
push 0
push 0x147
push eax
call ebx
mov edi, dword [ebp + 0x10]
push 0
mov dword [edi + 0x1fc], eax
mov eax, dword [esi + 0x24754]
mov ecx, dword [eax + 0x1c]
push 0
push 0x147
push ecx
call ebx
mov ebx, dword [ebp + 8]
push 0x3f
lea edx, [edi + 0x308]
mov dword [edi + 0x1f8], eax
mov eax, dword [esi + 0x24764]
push edx
push eax
push ebx
call fcn.01041800
mov edx, dword [esi + 0x24760]
push 0x3f
lea ecx, [edi + 0x286]
push ecx
push edx
push ebx
call fcn.01041800
push 0x3f
lea eax, [edi + 0x204]
push eax
mov eax, dword [esi + 0x24758]
push eax
push ebx
call fcn.01041800
lea eax, [edi + 0x204]
push eax
push esi
call fcn.01059fd0
mov esi, dword [esi + 0x2475c]
test ebx, ebx
je 0x105a192
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x105a192
mov ecx, dword [esi + 0x1c]
push 0x1ff
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
call dword [sym.imp.msvcrt.dll__wtoi]
add esp, 4
cmp eax, 0xffff
mov dword [edi + 0x200], eax
jle 0x105a17c
mov eax, 0xffff
push ebx
push 0
mov dword [edi + 0x200], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc