joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011eba
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10012032
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001202a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
cmp dword [eax], 0
je 0x10011f78
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
imul eax, dword [eax], 0xffff
cmp eax, 0xd018
jne 0x10011f63
mov dword [ebp - 8], 1
jmp 0x10011f67
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add eax, 4
je 0x10011f78
mov dword [ebp - 0xc], 1
jmp 0x10011f7c
and dword [ebp - 0xc], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax]
jg 0x10011f96
mov dword [ebp - 0x10], 1
jmp 0x10011f9a
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [eax]
jne 0x10011fb9
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
cmp dword [eax], 0
jne 0x10011fb9
and dword [ebp - 0x18], 0
jmp 0x10011fc0
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x10011fd3
mov dword [ebp - 0x1c], 1
jmp 0x10011fd7
and dword [ebp - 0x1c], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
jg 0x10011ff1
mov dword [ebp - 0x20], 1
jmp 0x10011ff5
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0xf12a83a0
ja 0x10012007
mov dword [ebp - 0x40], 1
jmp 0x1001200b
and dword [ebp - 0x40], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
push 0
mov ecx, dword [ebp - 4]
call fcn.100179fa
mov eax, dword [ebp - 0x44]
mov dword [eax], 0xc5ec62bb
jmp 0x10012030
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1001206f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
push 0x46a5
push dword [ebp - 0x48]
push 0x1a73
push 1
push dword [ebp - 0x4c]
push 0x45a7
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call fcn.1000f6a5
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x100120ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012101
push 1
call fcn.10012142
pop ecx
jmp 0x1001213e
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10012125
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001213e
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x3ba2
push 1
push 0
call fcn.1000deda
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10012ac2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10012b1c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10012b10
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10012b0e
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10012b1a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x10012b3d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push 0x7a42
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.1000ffda
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10012fb3
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10013026
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001301e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001301c
push 0x6e62
push 0x6b9c
push 1
push 0x3be7
push 0x15ee
push 0x138f
push 0x5821
push 0x5d39
push 0
call fcn.10011eba
add esp, 0x24
jmp 0x10013024
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1001303e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x6c86
push dword [ebp - 0x14]
push 0
call fcn.1001060a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001c47a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001c4e3
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c4b8
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001c4e1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x24]
mov dword [ecx], eax
jmp 0x1001c521
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001c519
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001c517
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1001c521
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esp, ebp
pop ebp
ret

Function at 0x1001c573
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c5c7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c5a4
push 0xc20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1001c5c5
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001c5c5
push 0xaf5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1001c5e4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x6c25
push 0x2597
push 0
call fcn.10023e67
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1001c750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001c799
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c781
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001c797
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1001c7ab
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0
call fcn.1001f265
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001c7af
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c7cd
push 1
push 0x4830
call fcn.1001c819
pop ecx
pop ecx
jmp 0x1001c815
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c7eb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1001c815
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001c815
push 0x1746
push 0
push 0x64a3
call fcn.1001e4e3
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1001e477
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e4a3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
call fcn.1001e4e3
add esp, 0xc
jmp 0x1001e4df
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001e4d9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001e4d7
push 0
call fcn.10026651
pop ecx
jmp 0x1001e4df
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret

Function at 0x1001e500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001e595
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001e57b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001e55c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001e579
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100179fa
mov dword [eax], 2
jmp 0x1001e551
jmp 0x1001e593
push 0x16fb
push 0
push 0
push 0
push 0
push 0xdeb
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001e5a7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x20]
call fcn.1001c525
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001e5c3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070d81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001e771
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001e624
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001e76f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x288
mov dword [ebp - 0x44], 0x10007f08
cmp dword [ebp - 0x28], 0x3e4
jle 0x1001e6fd
and dword [ebp - 0x18], 0
jmp 0x1001e65e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfd6
jge 0x1001e6fd
and dword [ebp - 0x1c], 0
jmp 0x1001e678
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3eee
jge 0x1001e6f8
and dword [ebp - 0x20], 0
jmp 0x1001e68e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2723
jge 0x1001e6f3
and dword [ebp - 0x24], 0
jmp 0x1001e6a4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1079
jge 0x1001e6f1
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000a64e
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.10017622
push eax
call fcn.10058109
pop ecx
lea ecx, [ebp - 0x68]
call fcn.10017618
jmp 0x1001e69d
jmp 0x1001e687
jmp 0x1001e671
jmp 0x1001e657
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0xde
jge 0x1001e719
push dword [ebp - 0x44]
call fcn.10058109
pop ecx
jmp 0x1001e735
or dword [ebp - 4], 0xffffffff
jmp 0x1001e73f
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001e755
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x1001e76f
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.100179fa
or dword [eax], 0xffffffff
jmp 0x1001e74a
jmp 0x1001e785
push 1
push 0x601a
push 0x72ef
call fcn.1001c45d
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e7bb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001e845
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001e819
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001e817
push 0x2621
push 0x2f6
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1001e843
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
jmp 0x1001e861
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call fcn.1001e5ab
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1001ee9f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ef16
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001eef8
push 0x1fb5
push 0x250f
push 0xa9f
push 0x18a0
push 0x2f6
push 0x1426
push 0x24ba
push 0x15a2
push 0x1be8
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x1001ef14
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001ef14
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1001ef33
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x57b7
push 0
push 0x4283
push dword [ebp - 0x14]
call fcn.10020ee2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1001ef37
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070d8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f0ec
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001ef9e
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1001ef99
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1001f0ea
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 0x1450
mov dword [ebp - 0x48], 0x10007f50
cmp dword [ebp - 0x2c], 0x1462
jle 0x1001f075
and dword [ebp - 0x1c], 0
jmp 0x1001efd8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2255
jge 0x1001f075
and dword [ebp - 0x20], 0
jmp 0x1001eff2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x616f
jge 0x1001f070
and dword [ebp - 0x24], 0
jmp 0x1001f008
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x124f
jge 0x1001f06b
and dword [ebp - 0x28], 0
jmp 0x1001f01e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x74da
jge 0x1001f069
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x28]
or eax, ecx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.1000a64e
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.10017622
push eax
call fcn.10058109
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10017618
jmp 0x1001f017
jmp 0x1001f001
jmp 0x1001efeb
jmp 0x1001efd1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x13b0
jge 0x1001f091
push dword [ebp - 0x48]
call fcn.10058109
pop ecx
jmp 0x1001f0ad
or dword [ebp - 4], 0xffffffff
jmp 0x1001f0b7
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x1001f0cd
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jge 0x1001f0ea
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.100179fa
mov dword [eax], 0x849f845
jmp 0x1001f0c2
jmp 0x1001f10d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x50]
push 0
push dword [ebp - 0x54]
push 0x329
call fcn.10023ba2
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fcc3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001fd4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001fd35
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1001fd09
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfffffff1
jg 0x1001fd33
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001fd31
push 0x5ee2
push 0x7593
push 0
call fcn.1002bc92
add esp, 0xc
jmp 0x1001fcfe
jmp 0x1001fd47
push 0x1a27
push 0
push 0xf99
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1001fdff
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001fdc7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001fda8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1001fdc5
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.100179fa
mov dword [eax], 0x8670fc24
jmp 0x1001fd9d
jmp 0x1001fdff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100200ca
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100200f7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x7967
push 0x57c5
push dword [ebp - 8]
push 1
call fcn.1002016a
add esp, 0x10
jmp 0x10020166
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002011b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10020166
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10020149
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10020166
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100179fa
mov dword [eax], 3
jmp 0x1002013e
mov esp, ebp
pop ebp
ret