joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004e5e0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x234
mov eax, dword [0x100d90a4]
xor eax, esp
mov dword [esp + 0x230], eax
mov ecx, dword [esp + 0x23c]
mov eax, dword [esp + 0x238]
cmp ecx, 3
ja case.default.0x1004e60b
jmp dword [ecx*4 + 0x1004e7e8]
push 0x104
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [0x142ebc1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x1004e63b
lea edx, [esp + 0x30]
push edx
mov ecx, 0x100cfccc
call fcn.10005a40
push 0x2c
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0
call fcn.10062920
mov eax, dword [0x100cfcd0]
add esp, 0xc
cmp dword [0x100cfce4], 0x10
jae 0x1004e667
mov eax, 0x100cfcd0
push esi
push 0x100b7a50
push eax
call fcn.10064eb9
mov esi, eax
add esp, 8
test esi, esi
je 0x1004e6e9
lea ecx, [esp + 4]
push ecx
push esi
call fcn.1006f0c5
add esp, 4
push eax
call fcn.10065564
add esp, 8
test eax, eax
jne 0x1004e6e0
lea edx, [esp + 0x24]
push edx
call fcn.1006553d
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x10]
push edx
mov edx, dword [eax + 0x14]
inc ecx
push ecx
add edx, 0x76c
push edx
lea eax, [esp + 0x50]
push str._02d__02d__02d__02d:_02d:_02d
push eax
call fcn.10062bc7
add esp, 0x24
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x100cfce8
call fcn.10005a40
push esi
call fcn.10064d01
add esp, 4
push 0
push 0
push 0
push 0
call fcn.10054160
mov ecx, 0x100da508
call fcn.10016600
pop esi
test eax, eax
je 0x1004e71e
xor eax, eax
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10062252
add esp, 0x234
ret 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100cfc90], eax
cmp eax, 0xffffffff
je 0x1004e705
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10062252
add esp, 0x234
ret 0xc
mov edx, dword [0x100cfc90]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10062252
add esp, 0x234
ret 0xc
call fcn.1004e5b0
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10062252
add esp, 0x234
ret 0xc
call fcn.1004e5b0
test eax, eax
je 0x1004e705
mov eax, dword [0x100cfc90]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x100cfc90], 0xffffffff
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10062252
add esp, 0x234
ret 0xc
mov ecx, dword [esp + 0x230]
xor ecx, esp
mov eax, 1
call fcn.10062252
add esp, 0x234
ret 0xc
Function at 0x10053390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10080e48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100d90a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x7bc], 0
je 0x100533c9
cmp dword [edi + 0x7c0], 0
jne 0x100533ec
mov eax, dword [esp + 0x30]
push eax
call fcn.10050090
mov eax, 0x138f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
cmp byte [esp + 0x34], 0
je 0x1005348c
lea esi, [edi + 0x7a0]
mov ecx, esi
call fcn.100531f0
test al, al
je 0x1005348c
push str._WARNING:
push 0xd2
push 0x1f84
push str.FlashToolLib_source_common_handle_src_flashtool_handle_internal.cpp
lea ecx, [esp + 0x1c]
call fcn.10055020
cmp dword [esi + 0x18], 0x10
mov dword [esp + 0x28], 0
jb 0x1005343c
mov esi, dword [esi + 4]
jmp 0x1005343f
add esi, 4
mov ecx, dword [0x100da500]
push esi
push edi
push str.AUTH_HANDLE_0x_08X_::IsReady__:_AUTH___s___has_been_updated_
push ecx
push eax
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10055070
mov edx, dword [esp + 0x30]
push edx
mov ecx, edi
call fcn.10050090
mov eax, 0x138e
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8

Function at 0x100534b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10080e48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100d90a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x274], 0
je 0x100534e9
cmp dword [edi + 0x278], 0
jne 0x1005350c
mov eax, dword [esp + 0x30]
push eax
call fcn.100504e0
mov eax, 0x138f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
cmp byte [esp + 0x34], 0
je 0x100535ac
lea esi, [edi + 0x258]
mov ecx, esi
call fcn.100531f0
test al, al
je 0x100535ac
push str._WARNING:
push 0xd2
push 0x208c
push str.FlashToolLib_source_common_handle_src_flashtool_handle_internal.cpp
lea ecx, [esp + 0x1c]
call fcn.10055020
cmp dword [esi + 0x18], 0x10
mov dword [esp + 0x28], 0
jb 0x1005355c
mov esi, dword [esi + 4]
jmp 0x1005355f
add esi, 4
mov ecx, dword [0x100da500]
push esi
push edi
push str.SCERT_HANDLE_0x_08X_::IsReady__:_SCERT___s___has_been_updated_
push ecx
push eax
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10055070
mov edx, dword [esp + 0x30]
push edx
mov ecx, edi
call fcn.100504e0
mov eax, 0x138e
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x10056150
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10080e48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100d90a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push 0
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10056205
push str._ERROR:
push 0xff
push 0x9b
push str.FlashToolLib_host_windows_NewCOMUtil.cpp
lea ecx, [esp + 0x1c]
call fcn.10055020
mov edi, eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
mov edx, dword [0x100da500]
push eax
push ecx
push str.NewCOMUtil::WriteComm__:_Write_fail__Handle__p___Err__u_.
push edx
push edi
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10055070
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x1005d9d0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1008168b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100d90a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi]
mov eax, dword [eax]
xor ebx, ebx
mov dword [esp + 0x30], ebx
lea edi, [ebx + 0x10]
cmp eax, ebx
je 0x1005da9f
cmp byte [eax + 0x1c], bl
je 0x1005da9f
cmp byte [esi + 0x20], bl
je 0x1005db10
cmp byte [esi + 0x22], bl
je 0x1005da90
push 0x100c2d07
push ebx
push 0x1a7
push str.FlashToolLib_host_windows_rwlock.cpp
lea ecx, [esp + 0x24]
call fcn.10055020
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov byte [esp + 0x30], 1
cmp ecx, ebx
je 0x1005da5d
cmp dword [ecx + 0x18], edi
jb 0x1005da58
mov ecx, dword [ecx + 4]
jmp 0x1005da5f
add ecx, 4
jmp 0x1005da5f
xor ecx, ecx
cmp dword [esi + 0x1c], edi
jb 0x1005da69
mov edx, dword [esi + 8]
jmp 0x1005da6c
lea edx, [esi + 8]
push ecx
mov ecx, dword [0x100da500]
push edx
push str._s_srwlock:_READ_UNLOCK.
push ecx
push eax
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.10055070
mov eax, dword [esi]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x1005db10
call fcn.1005d700
jmp 0x1005db10
cmp byte [esi + 0x22], bl
je 0x1005db10
push str._ERROR:
push 0xff
push 0x1ae
push str.FlashToolLib_host_windows_rwlock.cpp
lea ecx, [esp + 0x24]
call fcn.10055020
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov byte [esp + 0x30], 2
cmp ecx, ebx
je 0x1005dadd
cmp dword [ecx + 0x18], edi
jb 0x1005dad8
mov ecx, dword [ecx + 4]
jmp 0x1005dadf
add ecx, 4
jmp 0x1005dadf
xor ecx, ecx
cmp dword [esi + 0x1c], edi
jb 0x1005dae9
mov edx, dword [esi + 8]
jmp 0x1005daec
lea edx, [esi + 8]
push ecx
push edx
mov edx, dword [0x100da500]
push str._s_srwlock:_rwlock_class::ok____FALSE_
push edx
push eax
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.10055070
cmp dword [esi + 0x1c], edi
jb 0x1005db21
mov eax, dword [esi + 8]
push eax
call fcn.10061d87
add esp, 4
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov byte [esi + 8], bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x1005db50
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1008168b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100d90a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi]
mov eax, dword [eax]
xor ebx, ebx
mov dword [esp + 0x30], ebx
lea edi, [ebx + 0x10]
cmp eax, ebx
je 0x1005dc1f
cmp byte [eax + 0x1c], bl
je 0x1005dc1f
cmp byte [esi + 0x20], bl
je 0x1005dc90
cmp byte [esi + 0x22], bl
je 0x1005dc10
push 0x100c2d07
push ebx
push 0x1dc
push str.FlashToolLib_host_windows_rwlock.cpp
lea ecx, [esp + 0x24]
call fcn.10055020
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov byte [esp + 0x30], 1
cmp ecx, ebx
je 0x1005dbdd
cmp dword [ecx + 0x18], edi
jb 0x1005dbd8
mov ecx, dword [ecx + 4]
jmp 0x1005dbdf
add ecx, 4
jmp 0x1005dbdf
xor ecx, ecx
cmp dword [esi + 0x1c], edi
jb 0x1005dbe9
mov edx, dword [esi + 8]
jmp 0x1005dbec
lea edx, [esi + 8]
push ecx
mov ecx, dword [0x100da500]
push edx
push str._s_srwlock:_WRITE_UNLOCK.
push ecx
push eax
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.10055070
mov eax, dword [esi]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x1005dc90
call fcn.1005d830
jmp 0x1005dc90
cmp byte [esi + 0x22], bl
je 0x1005dc90
push str._ERROR:
push 0xff
push 0x1e3
push str.FlashToolLib_host_windows_rwlock.cpp
lea ecx, [esp + 0x24]
call fcn.10055020
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov byte [esp + 0x30], 2
cmp ecx, ebx
je 0x1005dc5d
cmp dword [ecx + 0x18], edi
jb 0x1005dc58
mov ecx, dword [ecx + 4]
jmp 0x1005dc5f
add ecx, 4
jmp 0x1005dc5f
xor ecx, ecx
cmp dword [esi + 0x1c], edi
jb 0x1005dc69
mov edx, dword [esi + 8]
jmp 0x1005dc6c
lea edx, [esi + 8]
push ecx
push edx
mov edx, dword [0x100da500]
push str._s_srwlock:_rwlock_class::ok____FALSE_
push edx
push eax
call fcn.100555e0
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.10055070
cmp dword [esi + 0x1c], edi
jb 0x1005dca1
mov eax, dword [esi + 8]
push eax
call fcn.10061d87
add esp, 4
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov byte [esi + 8], bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x100600a0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x80]
xor eax, eax
cmp esi, eax
jne 0x100600b6
mov esi, 0x143fa4dc
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x7c]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
mov dword [esp + 0x7c], 0x20
call fcn.1005fce0
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1005fdc0
add esp, 0x14
mov eax, esi
pop esi
add esp, 0x70
ret

Function at 0x10060220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, dword [0x100cfc90]
cmp esi, 0xffffffff
jne 0x10053a85
mov eax, 1
pop esi
ret 4
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x10053ac4
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10053a9e
pop ebx
pop esi
ret 4
push eax
call fcn.10063744
mov eax, dword [0x100cfc90]
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
and eax, 0xfffffffe
pop ebx
add eax, 2
pop esi
ret 4
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10053ad0
sub eax, edx
push edi
mov edi, eax
cmp edi, 0x80
jbe 0x10053aef
pop edi
pop ebx
mov eax, 3
pop esi
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10053b31
push 0x81
call fcn.10061220
mov ecx, dword [0x100cfc90]
add esp, 4
mov esi, eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10053b31
push esi
call fcn.10063744
add esp, 4
pop edi
pop ebx
mov eax, 4
pop esi
ret 4
inc edi
push edi
push ebx
push esi
call fcn.10063550
add esp, 0xc
pop edi
pop ebx
xor eax, eax
pop esi
ret 4
jmp 0x10053a70
Function at 0x100611b0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10061167
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10061185
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100611e3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
jge 0x100611c2
jge 0x100611c2
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100611ca
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100611d3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100611dd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100611bf
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
js 0x100611e9
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x10061149
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x10061338
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x10061350
call fcn.10060a55
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
invalid
movsd dword es:[edi], dword [esi]

Function at 0x100619af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
invalid
xor esi, eax
invalid
Function at 0x10061e0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.10060aa0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10060a55
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x10062c23
push 5
invalid
invalid

Function at 0x10062c44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x10062c54
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10060a90
push ebp
out 0xe2, al
lahf
mov edi, eax
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.10060a90
push edx
push esp
shl dword [ebx], 0x49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10062c7d
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10062c7d
call fcn.10060a90
mov bl, 0x98
push edx
and byte [ebx - 0x20fcdba6], cl
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.10060a90
fnstcw word [edi + 0x75ff88a4]
or bh, bh
jne 0x10062cc6
push dword [ebp]
call fcn.10061290
jo 0x10062cce
invalid
jne 0x10062ce2
or dword [eax + 0x70], 2
mov byte [esi + 0xc], 1
jmp 0x10062ce2
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10062c62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x10062c54
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10060a90
push ebp
out 0xe2, al
lahf
mov edi, eax
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.10060a90
push edx
push esp
shl dword [ebx], 0x49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10062c7d
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10062c7d
call fcn.10060a90
mov bl, 0x98
push edx
and byte [ebx - 0x20fcdba6], cl
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.10060a90
fnstcw word [edi + 0x75ff88a4]
or bh, bh
jne 0x10062cc6
push dword [ebp]
call fcn.10061290
jo 0x10062cce
invalid
jne 0x10062ce2
or dword [eax + 0x70], 2
mov byte [esi + 0xc], 1
jmp 0x10062ce2
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1007710f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10069aba
and dword [ebp - 4], 0
cmp dword [0x143fe98c], 0
mov ebx, eax
jne 0x100771c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10077271
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10077271
push eax
call fcn.10069a48
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x143fe98c], eax
call esi
push eax
call fcn.10069a48
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x143fe990], eax
call esi
push eax
call fcn.10069a48
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x143fe994], eax
call esi
push eax
call fcn.10069a48
pop ecx
mov dword [0x143fe99c], eax
test eax, eax
je 0x100771c0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10069a48
pop ecx
mov dword [0x143fe998], eax
mov eax, dword [0x143fe998]
cmp eax, ebx
je 0x10077218
cmp dword [0x143fe99c], ebx
je 0x10077218
push eax
call fcn.10069ac3
push dword [0x143fe99c]
mov esi, eax
call fcn.10069ac3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10077218
test edi, edi
je 0x10077218
call esi
test eax, eax
je 0x1007720f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1007720f
test byte [ebp - 0xc], 1
jne 0x10077218
or dword [ebp + 0x10], 0x200000
jmp 0x10077251
mov eax, dword [0x143fe990]
cmp eax, ebx
je 0x10077251
push eax
call fcn.10069ac3
pop ecx
test eax, eax
je 0x10077251
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10077251
mov eax, dword [0x143fe994]
cmp eax, ebx
je 0x10077251
push eax
call fcn.10069ac3
pop ecx
test eax, eax
je 0x10077251
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x143fe98c]
call fcn.10069ac3
pop ecx
test eax, eax
je 0x10077271
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10077273
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x403ecd
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x403e87
push edi
mov ecx, esi
call fcn.00403df0
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x403eae
mov ecx, dword [esi]
test ecx, ecx
je 0x403eb2
push dword [ecx - 8]
push ecx
call fcn.00587fe0
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x403ecd
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x403ecd
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00403f50
int3