joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014f10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1017d9c0
push fcn.100ecb10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x101900e0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
test ebx, ebx
jne 0x10014f52
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10014f6d
push 0xc1
jmp 0x10015061
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp dword [ecx], 0x4550
je 0x10014f87
push 0xbf
jmp 0x10015061
movzx eax, word [ecx + 0x14]
test ax, ax
je 0x1001505c
lea edx, [eax + ecx]
mov dword [ebp - 0x1c], edx
lea edx, [eax + 0x18]
add edx, ecx
mov dword [ebp - 0x28], edx
xor esi, esi
mov dword [ebp - 0x20], esi
movzx eax, word [ecx + 6]
cmp esi, eax
jae 0x1001505c
lea edi, [esi + esi*4]
mov ecx, str..detour
lea eax, [edx + edi*8]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10014fe0
test dl, dl
je 0x10014fdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10014fe0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10014fc0
xor eax, eax
jmp 0x10014fe5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1001503a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + edi*8 + 0x24]
test eax, eax
je 0x1001505c
cmp dword [ecx + edi*8 + 0x28], 0
je 0x1001505c
lea esi, [eax + ebx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x1001505c
cmp dword [esi + 4], 0x727444
jne 0x1001505c
cmp dword [esi + 8], 0
jne 0x10015017
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
jmp 0x10014fa4
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10054060
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014758f
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
call fcn.1001e250
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x44]
add ecx, 0x18
call fcn.1001e250
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x44]
add eax, 0x30
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x48]
call fcn.1001dd10
mov ecx, dword [ebp - 0x44]
add ecx, 0x31
mov dword [ebp - 0x4c], ecx
push 0
mov ecx, dword [ebp - 0x4c]
call fcn.1001dd10
mov ecx, dword [ebp - 0x44]
add ecx, 0x34
call fcn.1001f0f0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
add ecx, 0x64
call fcn.10056000
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x44]
add edx, 0x68
mov dword [ebp - 0x50], edx
push 0
push 1
mov ecx, dword [ebp - 0x50]
call fcn.1005a5c0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x44]
add ecx, 0x6c
call fcn.1005a050
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x44]
add ecx, 0x74
call fcn.1005a070
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x7c], 0
lea ecx, [ebp - 0x28]
push ecx
call fcn.1005cd70
add esp, 4
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
push edx
mov ecx, dword [ebp - 0x44]
call fcn.1005ad80
lea ecx, [ebp - 0x28]
call fcn.1001fa50
lea eax, [ebp - 0x40]
push eax
call fcn.10052960
add esp, 4
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x18
call fcn.1005ad80
lea ecx, [ebp - 0x40]
call fcn.1001fa50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret

Function at 0x10054210
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101475c3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4c
push str.HookApp::uninitialize
push 0x3a
push 0x1015b89c
call fcn.10059450
add esp, 8
add eax, 0x1015b860
push eax
push 0x1015b8d8
lea ecx, [ebp - 0x38]
call fcn.1001eab0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
push str.uninit...
mov ecx, dword [ebp - 0x44]
call fcn.1002df00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100b7260
cmp dword [0x10195868], 0
je 0x100542cc
call fcn.100542f0
mov ecx, eax
call fcn.100543b0
push 0x3e8
mov edx, dword [0x10195868]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100542cc
push 0
mov eax, dword [0x10195868]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret
Function at 0x10054390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10055500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10054450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10147659
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
xor eax, eax
jne 0x1005447b
push 0x75
push str.HookApp::startHook
push 0x3a
push 0x1015b940
call fcn.10059450
add esp, 8
add eax, 0x1015b904
push eax
push 0x1015b97c
lea ecx, [ebp - 0x38]
call fcn.1001eab0
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x48], edx
push 0x1015b988
mov ecx, dword [ebp - 0x48]
call fcn.1002df00
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.10048d50
mov dword [ebp - 0x54], eax
push 0x1015b990
mov ecx, dword [ebp - 0x54]
call fcn.1002df00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100b7260
mov ecx, dword [ebp - 0x3c]
add ecx, 0x30
call fcn.10020ce0
movzx ecx, al
test ecx, ecx
jne 0x1005453c
push 1
mov ecx, dword [ebp - 0x3c]
add ecx, 0x30
call fcn.100203e0
push 0
push 0
push 0
push 0x100555b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret
Function at 0x10061f10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x424]
mov eax, dword [edx + 0x18]
call eax
test eax, eax
je 0x10061f50
mov al, 1
jmp 0x100620f4
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
je 0x100620b2
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x424]
call fcn.10068440
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x424]
call fcn.10068420
mov ecx, dword [ebp - 0x424]
call fcn.100681f0
push eax
lea ecx, [ebp - 0x41c]
call fcn.1001dd90
push 0x400
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.100e93c0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
call fcn.100246b0
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp + 0xc]
call fcn.100246b0
mov dword [ebp - 0x430], eax
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x430]
push eax
push str.__s___s
lea ecx, [ebp - 0x404]
push ecx
call fcn.10065b20
add esp, 0x10
push 0x44
push 0
lea edx, [ebp - 0x484]
push edx
call fcn.100e93c0
add esp, 0xc
mov dword [ebp - 0x484], 0x44
xor eax, eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x484]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10062096
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x1f4
push 0
mov eax, dword [ebp - 0x428]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [ebp - 0x41e], 1
lea ecx, [ebp - 0x41c]
call fcn.10015b70
mov al, byte [ebp - 0x41e]
jmp 0x100620f4
mov byte [ebp - 0x41f], 0
lea ecx, [ebp - 0x41c]
call fcn.10015b70
mov al, byte [ebp - 0x41f]
jmp 0x100620f4
mov edx, dword [ebp - 0x424]
push edx
mov ecx, dword [ebp - 0x428]
call fcn.10062380
mov byte [ebp - 0x41d], al
movzx eax, byte [ebp - 0x41d]
test eax, eax
jne 0x100620ee
push 0
push 0x3e8
push 0
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10062540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x10062da0
push 0
push 0
call fcn.10110508
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov esp, ebp
pop ebp
ret

Function at 0x10063550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x64], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x100641c0
push 0
push 0
call fcn.10110508
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x64], 0
mov esp, ebp
pop ebp
ret
Function at 0x100a52b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x100a52c6
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
jmp 0x100a52e9
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
xor eax, dword [ebp + 0xc]
mov ecx, 0x1000193
mul ecx
push eax
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.100a52b0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100ad900
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e8c4
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x290], ecx
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.100e93c0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x29
push 0x1016334c
push 0x38
push 0x101633a8
call fcn.100b2bc0
add esp, 8
add eax, 0x1016336c
push eax
push 0x101633e4
lea ecx, [ebp - 0x238]
call fcn.1001eab0
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x298], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x298]
mov dword [ebp - 0x29c], ecx
push str.window:
mov ecx, dword [ebp - 0x29c]
call fcn.1002df00
mov dword [ebp - 0x2a0], eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2a0]
call fcn.10051640
mov dword [ebp - 0x2a4], eax
push str.__title:
mov ecx, dword [ebp - 0x2a4]
call fcn.1002df00
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x2a8]
call fcn.100b3980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.100b7260
call fcn.100acb70
test eax, eax
je 0x100adaa4
call fcn.100acb70
cmp dword [ebp + 8], eax
je 0x100adaa4
push 0x2d
push 0x10163408
push 0x38
push 0x10163464
call fcn.100b2bc0
add esp, 8
add eax, 0x10163428
push eax
push 0x101634a0
lea ecx, [ebp - 0x260]
call fcn.1001eab0
mov dword [ebp - 0x2ac], eax
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], edx
push str.window____session::graphicsWindow
mov ecx, dword [ebp - 0x2b4]
call fcn.1002df00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.100b7260
xor al, al
jmp 0x100adb92
mov ecx, dword [ebp - 0x290]
add ecx, 0x54
call fcn.100ad350
cmp eax, dword [ebp + 8]
jne 0x100adabe
mov al, 1
jmp 0x100adb92
mov ecx, dword [ebp - 0x290]
add ecx, 0x54
call fcn.100ad350
test eax, eax
je 0x100adaeb
mov ecx, dword [ebp - 0x290]
call fcn.100ae4c0
push 0
mov ecx, dword [ebp - 0x290]
add ecx, 0x54
call fcn.100ad2f0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x290]
call fcn.100adbb0
mov byte [ebp - 0x289], al
push 0x3f
push str.UiApp::trySetupGraphicsWindow
push 0x38
push 0x1016352c
call fcn.100b2bc0
add esp, 8
add eax, 0x101634f0
push eax
push 0x10163568
lea ecx, [ebp - 0x288]
call fcn.1001eab0
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], ecx
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c0], edx
push str.setup_res:
mov ecx, dword [ebp - 0x2c0]
call fcn.1002df00
mov dword [ebp - 0x2c4], eax
movzx eax, byte [ebp - 0x289]
push eax
mov ecx, dword [ebp - 0x2c4]
call fcn.10048d80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
call fcn.100b7260
mov al, byte [ebp - 0x289]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret 4
Function at 0x100ae310
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014ea19
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
push 0x116
push str.UiApp::hookWindow
push 0x38
push 0x101635d0
call fcn.100b2bc0
add esp, 8
add eax, 0x10163594
push eax
push 0x1016360c
lea ecx, [ebp - 0x38]
call fcn.1001eab0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
push 0x10163618
mov ecx, dword [ebp - 0x54]
call fcn.1002df00
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
push edx
mov ecx, dword [ebp - 0x5c]
call fcn.10048d50
mov dword [ebp - 0x60], eax
push 0x10163620
mov ecx, dword [ebp - 0x60]
call fcn.1002df00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100b7260
mov eax, 1
test eax, eax
je 0x100ae413
push 0xfffffffffffffffc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x50], eax
push 0x100ae8d0
push 0xfffffffffffffffc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx + 0x50], 0
je 0x100ae3ff
mov dword [ebp - 0x44], 1
jmp 0x100ae406
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
jmp 0x100ae49b
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0x100ae720
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp - 0x40]
push edx
push 0
push 0x100ae7b0
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x48], eax
mov edx, dword [ebp - 0x40]
push edx
push 0
push 0x100ae840
push 0xc
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx + 0x44], 0
je 0x100ae491
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x48], 0
je 0x100ae491
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx + 0x4c], 0
je 0x100ae491
mov dword [ebp - 0x48], 1
jmp 0x100ae498
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret 4
Function at 0x100bb160
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101900e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 1
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bb1a6
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.100b8f80
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100e6bb9
mov esp, ebp
pop ebp
ret
Function at 0x100c0300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
mov edx, dword [eax + 0x18]
cmp edx, 0xffffffff
jne 0x100c0319
or eax, edx
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push esi
push edi
xor esi, esi
mov ecx, 0x2000000
push esi
push eax
cmp ebx, ecx
mov dword [ebp + 0xc], esi
mov eax, ebx
mov edi, ebx
cmova eax, ecx
push eax
push dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100c0398
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100c038d
add esi, eax
cmp esi, ebx
jge 0x100c038d
sub edi, eax
mov dword [ebp + 0xc], 0
push 0
lea eax, [ebp + 0xc]
cmp edi, 0x2000000
push eax
mov ecx, 0x2000000
mov eax, edi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100c0346
test esi, esi
je 0x100c0398
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100c0bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
mov edx, dword [eax + 0x18]
cmp edx, 0xffffffff
jne 0x100c0bc9
or eax, edx
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push esi
push edi
xor esi, esi
mov ecx, 0x2000000
push esi
push eax
cmp ebx, ecx
mov dword [ebp + 0xc], esi
mov eax, ebx
mov edi, ebx
cmova eax, ecx
push eax
push dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100c0c48
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100c0c3d
add esi, eax
cmp esi, ebx
jge 0x100c0c3d
sub edi, eax
mov dword [ebp + 0xc], 0
push 0
lea eax, [ebp + 0xc]
cmp edi, 0x2000000
push eax
mov ecx, 0x2000000
mov eax, edi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100c0bf6
test esi, esi
je 0x100c0c48
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100cd012
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100ccfee
pop esi
leave
ret 8
Function at 0x100e5f65
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1011d0c3
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100e5fa4
sub eax, 1
je 0x100e5f9f
sub eax, 1
je 0x100e5f9b
xor eax, eax
leave
ret
push 3
jmp 0x100e5fa6
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x10129a5c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1016df44
push 0x1016df3c
push 0x1016b4e8
push 0x1e
call fcn.1012972c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10129a90
push dword [ebp + 8]
mov ecx, esi
call dword [0x10154394]
call esi
jmp 0x10129a96
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10129ada
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1016df54
push 0x1016df4c
push 0x1016b50c
push 0x20
call fcn.1012972c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10129b11
push dword [ebp + 8]
mov ecx, esi
call dword [0x10154394]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]