joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8095f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x80f4cc]
cmp dword [eax + 0x28], 0
jne 0x809608
xor eax, eax
jmp 0x809737
mov ecx, dword [0x80f43c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x80f430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x80f42c], eax
push 0
call dword [0x80d138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x80d138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x80f430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x80f42c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x80f4b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x80d680
push 0x80d6d0
push 0x88
call dword [0x80d134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x80f428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x80d10c]
push eax
call fcn.00809530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x80d148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x80d12c]
push 0x8095c0
mov edx, dword [0x80f4cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x80d13c]
mov dword [0x80f434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x80d130]
test eax, eax
je 0x809737
cmp dword [ebp - 0x38], 0x12
jne 0x80972b
mov dword [0x80f444], 0
call fcn.00809740
xor eax, eax
jmp 0x809737
lea edx, [ebp - 0x3c]
push edx
call dword [0x80d140]
jmp 0x8096fc
mov esp, ebp
pop ebp
ret 4

Function at 0x80ab00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.0080d0dc]
call dword [fcn.0080d124]
call dword [fcn.0080d128]
call dword [fcn.0080d094]
call dword [fcn.0080d0fc]
call dword [fcn.0080d0f4]
call dword [fcn.0080d150]
call dword [fcn.0080d00c]
call dword [fcn.0080d000]
call dword [fcn.0080d160]
call fcn.0080c644
mov eax, 1
pop ebp
ret 4
Function at 0x80b69c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x80d168
sub eax, eax
test esi, esi
je 0x80b774
sub eax, 1
test ecx, ecx
je 0x80b772
test esi, 3
je 0x80b6da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x80b6bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x80b759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x80b6e4
mov ecx, edx
test ecx, ecx
je 0x80b772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x80b75f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x80b77c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0080b7ff
jae 0x80b78a
xor ecx, ecx
call fcn.0080b7ff
jae 0x80b7b9
xor eax, eax
call fcn.0080b7ff
jae 0x80b7c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0080b7ff
adc al, al
jae 0x80b7ab
jne 0x80b7f5
stosb byte es:[edi], al
jmp 0x80b78d
call fcn.0080b80b
sub ecx, ebx
jne 0x80b7d2
call fcn.0080b809
jmp 0x80b7f1
lodsb al, byte [esi]
shr eax, 1
je 0x80b81b
adc ecx, ecx
jmp 0x80b7ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0080b809
cmp eax, 0x7d00
jae 0x80b7ee
cmp ah, 5
jae 0x80b7ef
cmp eax, 0x7f
ja 0x80b7f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x80b78d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x80c14c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80f000]
jne 0x80c156
repz ret
jmp fcn.0080c3fd
Function at 0x1000a4f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a79b
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x47c], 0
mov ecx, dword [ebp + 0xc]
call fcn.10008350
cmp eax, 0xc8
jbe 0x1000a559
push 0x10074d80
mov ecx, dword [ebp + 8]
call fcn.100082b0
mov eax, dword [ebp - 0x47c]
or eax, 1
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp + 8]
jmp 0x1000a6ac
xor ecx, ecx
mov word [ebp - 0x424], cx
push 0x40e
push 0
lea edx, [ebp - 0x422]
push edx
call fcn.100552a0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x424]
push eax
mov ebx, str.cachekvstore
xor ecx, ecx
call fcn.1003f752
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x45c]
push edx
call fcn.10007290
add esp, 8
mov dword [ebp - 0x480], eax
mov ecx, dword [ebp - 0x480]
call fcn.10002760
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x45c]
call fcn.10002740
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a68b
push 2
lea edx, [ebp - 0x440]
push edx
call fcn.1000a490
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.10002670
movzx eax, al
test eax, eax
jne 0x1000a679
push 0x208
lea ecx, [ebp - 0x440]
call fcn.10002760
push eax
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push str.cachekvstore
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x478]
push ecx
call fcn.10007290
add esp, 8
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x484]
call fcn.10002760
push eax
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x478]
call fcn.10002740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.10002740
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp + 8]
call fcn.100082b0
mov ecx, dword [ebp - 0x47c]
or ecx, 1
mov dword [ebp - 0x47c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret
Function at 0x1000a6d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aca8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 0xc]
call fcn.10008350
cmp eax, 0xc8
jbe 0x1000a72c
push 0x1007558d
mov ecx, dword [ebp + 8]
call fcn.10002590
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
jmp 0x1000a7b0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.1000a4f0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10002760
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a780
push 0x1007558d
mov ecx, dword [ebp + 8]
call fcn.10002590
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002740
mov eax, dword [ebp + 8]
jmp 0x1000a7b0
lea ecx, [ebp - 0x2c]
call fcn.10002760
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000a4c0
add esp, 8
mov edx, dword [ebp - 0x30]
or edx, 1
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002740
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret

Function at 0x10015480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
call fcn.100153d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100154a9
xor eax, eax
jmp 0x10015594
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.100552a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
mov ebx, dword [ebp - 4]
mov ecx, dword [0x100833c4]
call fcn.1003f752
lea eax, [ebp - 0x210]
push eax
push str.sys_path:_ls
call fcn.10050c4d
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001555c
movzx edx, word [0x100831b8]
test edx, edx
je 0x1001553a
push 0x104
push 0x100831b8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001555c
push str.file_not_find
call fcn.10050c4d
add esp, 4
xor eax, eax
jmp 0x10015594
push 3
push 0x10073f40
lea ecx, [ebp - 0x210]
push ecx
xor eax, eax
call fcn.10040a05
test eax, eax
jne 0x1001558f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.install_service_err:_d
call fcn.10050c4d
add esp, 8
xor eax, eax
jmp 0x10015594
mov eax, 1
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret
Function at 0x100155b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b636
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x134], 0x11c
push 0x118
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.100552a0
add esp, 0xc
call fcn.1003f813
test eax, eax
je 0x10015701
push 0x10073f80
call fcn.10040bd0
test eax, eax
je 0x10015701
push 0x10073f90
call fcn.10040c88
test eax, eax
jne 0x10015701
lea esi, [ebp - 0x134]
call fcn.1003f867
test eax, eax
je 0x10015701
cmp dword [ebp - 0x130], 6
jne 0x10015701
push 0x10073fa0
push str.SYSTEMCurrentControlSetServices_s
lea esi, [ebp - 0x150]
call fcn.10040762
add esp, 8
mov dword [ebp - 4], 0
push str.ImagePath
lea ecx, [ebp - 0x150]
call fcn.10002760
push 0x80000002
mov edx, eax
lea ecx, [ebp - 0x16c]
call fcn.10040883
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x16c]
call fcn.10008350
test eax, eax
je 0x100156e0
push 0x10074010
lea ecx, [ebp - 0x16c]
call fcn.10002760
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x100156e0
push str.powfp643_win7.sys
push str.powfp643.sys
push str.upgrade_service__s___s
call fcn.100511b4
add esp, 0xc
push 0x100740a4
call fcn.10040c33
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x16c]
call fcn.10002740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10002740
push 0x100740b4
call fcn.10040bd0
test eax, eax
je 0x10015752
push 0x100740c4
call fcn.10040ac7
test eax, eax
je 0x10015724
mov eax, 1
jmp 0x10015785
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
je 0x10015742
cmp dword [ebp - 0x170], 3
jne 0x1001574e
push 0x100740d4
call fcn.10040c33
jmp 0x10015752
xor eax, eax
jmp 0x10015785
call fcn.10015480
test eax, eax
je 0x10015775
push 0x100740e4
call fcn.10040ac7
test eax, eax
je 0x10015775
mov dword [ebp - 0x174], 1
jmp 0x1001577f
mov dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret
Function at 0x10017f80
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a136
mov eax, dword fs:[0]
push eax
mov eax, 0x20050
call fcn.1005e830
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20054], 0
lea ecx, [ebp - 0x2002c]
call fcn.10002780
mov dword [ebp - 4], 0
mov dword [ebp - 0x20034], 0x20000
lea eax, [ebp - 0x20014]
mov dword [ebp - 0x20030], eax
lea ecx, [ebp - 0x20034]
push ecx
mov edx, dword [ebp - 0x20030]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x10018071
cmp dword [ebp - 0x20030], 0
je 0x10018071
mov eax, dword [ebp - 0x20030]
cmp dword [eax + 0x190], 6
jne 0x10018061
push 6
mov ecx, dword [ebp - 0x20030]
add ecx, 0x194
push ecx
lea ecx, [ebp - 0x20050]
call fcn.10018970
mov dword [ebp - 0x20058], eax
mov edx, dword [ebp - 0x20058]
mov dword [ebp - 0x2005c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2005c]
push eax
lea ecx, [ebp - 0x2002c]
call fcn.10002990
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20050]
call fcn.10002610
mov ecx, dword [ebp - 0x20030]
mov edx, dword [ecx]
mov dword [ebp - 0x20030], edx
jmp 0x10017ff8
lea eax, [ebp - 0x2002c]
push eax
mov ecx, dword [ebp + 8]
call fcn.100027f0
mov ecx, dword [ebp - 0x20054]
or ecx, 1
mov dword [ebp - 0x20054], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2002c]
call fcn.100028f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret

Function at 0x10018290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10081d98], 0
je 0x100182c5
mov dword [0x10081d98], 0
push 0
push 0
push 0
push 0x10018160
push 0x20000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x1001f450
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006cc03
mov eax, dword fs:[0]
push eax
mov eax, 0x1658
call fcn.1005e830
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], 0
xor eax, eax
mov word [ebp - 0x634], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.100552a0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x634]
push edx
push 0x403
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
movzx ecx, word [ebp - 0x634]
test ecx, ecx
je 0x1001f4e4
lea edx, [ebp - 0x634]
push edx
call fcn.10023100
jmp 0x1001f4e9
call fcn.10023480
mov byte [ebp - 0x22c], 0
push 0x1ff
push 0
lea eax, [ebp - 0x22b]
push eax
call fcn.100552a0
add esp, 0xc
mov byte [ebp - 0x22c], 0
lea ecx, [ebp - 0x24]
call fcn.10002780
mov dword [ebp - 4], 0
push 0x200
lea ecx, [ebp - 0x22c]
push ecx
push 0x406
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx eax, byte [ebp - 0x22c]
test eax, eax
je 0x1001f636
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x165c]
push edx
mov ebx, 0x10073344
call fcn.1004058d
add esp, 8
mov dword [ebp - 0x1660], eax
mov eax, dword [ebp - 0x1660]
mov dword [ebp - 0x1664], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1664]
push ecx
lea ecx, [ebp - 0x24]
call fcn.1000bec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x165c]
call fcn.100028f0
lea ecx, [ebp - 0x163c]
call fcn.1001cae0
mov dword [ebp - 0x230], 0
jmp 0x1001f5c2
mov edx, dword [ebp - 0x230]
add edx, 1
mov dword [ebp - 0x230], edx
lea ecx, [ebp - 0x24]
call fcn.100265c0
cmp dword [ebp - 0x230], eax
jae 0x1001f628
mov dword [ebp - 0x1644], 0
mov dword [ebp - 0x1640], 0
lea eax, [ebp - 0x1640]
push eax
lea ecx, [ebp - 0x1644]
push ecx
mov edx, dword [ebp - 0x230]
push edx
lea ecx, [ebp - 0x24]
call fcn.10002960
push eax
call fcn.1001d820
add esp, 0xc
mov eax, dword [ebp - 0x1640]
push eax
mov ecx, dword [ebp - 0x1644]
push ecx
lea edx, [ebp - 0x163c]
push edx
call fcn.100235d0
jmp 0x1001f5b3
lea eax, [ebp - 0x163c]
push eax
call fcn.100236b0
jmp 0x1001f63b
call fcn.100236e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.100028f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret
Function at 0x1001f990
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.100552a0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0x100833dc]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx eax, byte [ebp - 0x108]
test eax, eax
jne 0x1001f9e6
jmp 0x1001fa07
lea ecx, [ebp - 0x108]
push ecx
call fcn.100533d1
add esp, 4
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
call fcn.10023f70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret
Function at 0x1001ffb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov word [ebp - 4], ax
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x207]
push ecx
call fcn.100552a0
add esp, 0xc
movzx edx, word [ebp - 4]
cmp edx, 0x3ec
jne 0x10020011
call fcn.10015810
call fcn.100246a0
jmp 0x100201d2
movzx eax, word [ebp - 4]
cmp eax, 0x3ea
jne 0x10020026
call fcn.10015820
jmp 0x100201d2
movzx ecx, word [ebp - 4]
cmp ecx, 0x3f4
jne 0x1002003c
call fcn.10015840
jmp 0x100201d2
movzx edx, word [ebp - 4]
cmp edx, 0x3fc
jne 0x1002005e
push 0x10071b9f
mov eax, dword [0x100833cc]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x100201d2
movzx ecx, word [ebp - 4]
cmp ecx, 0x3f2
jne 0x100200a8
push 0x200
lea edx, [ebp - 0x208]
push edx
mov eax, dword [0x100833d0]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x208]
push ecx
call fcn.100533d1
add esp, 4
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
push edx
call fcn.100222d0
jmp 0x100201d2
movzx eax, word [ebp - 4]
cmp eax, 0x3ee
jne 0x100200c4
mov ecx, dword [ebp + 8]
push ecx
call fcn.1001d930
add esp, 4
jmp 0x100201d2
movzx edx, word [ebp - 4]
cmp edx, 0x3f6
jne 0x10020117
push 0x200
lea eax, [ebp - 0x208]
push eax
push 0x3f9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx edx, byte [ebp - 0x208]
test edx, edx
je 0x1002010d
push 1
lea eax, [ebp - 0x208]
push eax
call fcn.10023b40
jmp 0x10020112
call fcn.10023c70
jmp 0x100201d2
movzx ecx, word [ebp - 4]
cmp ecx, 0x3fa
jne 0x1002012d
call fcn.10023c70
jmp 0x100201d2
movzx edx, word [ebp - 4]
cmp edx, 0x402
jne 0x1002014a
mov eax, dword [ebp + 8]
push eax
call fcn.1001f450
add esp, 4
jmp 0x100201d2
movzx ecx, word [ebp - 4]
cmp ecx, 0x404
jne 0x10020162
call fcn.100236e0
call fcn.10023480
jmp 0x100201d2
movzx edx, word [ebp - 4]
cmp edx, 0x3fd
jne 0x10020175
call fcn.1001e160
jmp 0x100201d2
movzx eax, word [ebp - 4]
cmp eax, 0x3ed
jne 0x10020189
push 1
call fcn.10023df0
jmp 0x100201d2
movzx ecx, word [ebp - 4]
cmp ecx, 0x407
jne 0x1002019c
call fcn.1001f670
jmp 0x100201d2
movzx edx, word [ebp - 4]
cmp edx, 0x409
jne 0x100201af
call fcn.1001f990
jmp 0x100201d2
movzx eax, word [ebp - 4]
cmp eax, 0x3f3
jne 0x100201c1
call fcn.10025e80
jmp 0x100201d2
movzx ecx, word [ebp - 4]
cmp ecx, 0x3ef
jne 0x100201d2
call fcn.1001fa20
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret
Function at 0x10022ea0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ac0c
mov eax, dword fs:[0]
push eax
mov eax, 0x10b4
call fcn.1005e830
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10c0], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1060]
push ecx
mov ebx, 0x10072950
call fcn.10040518
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1048]
call fcn.1000be70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x82c]
call fcn.100270d0
mov byte [ebp - 4], 2
mov dword [ebp - 0x1064], 0
jmp 0x10022f33
mov edx, dword [ebp - 0x1064]
add edx, 1
mov dword [ebp - 0x1064], edx
lea ecx, [ebp - 0x1060]
call fcn.100265c0
cmp dword [ebp - 0x1064], eax
jae 0x1002302b
xor eax, eax
mov word [ebp - 0x814], ax
push 0x400
lea ecx, [ebp - 0x814]
push ecx
mov edx, dword [ebp - 0x1064]
push edx
lea ecx, [ebp - 0x1060]
call fcn.10002960
mov ecx, eax
call fcn.10002760
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [ebp - 0x102c], ax
push 0x400
lea ebx, [ebp - 0x102c]
lea ecx, [ebp - 0x814]
call fcn.1003f9ab
lea edi, [ebp - 0x814]
call fcn.10040818
lea edi, [ebp - 0x102c]
call fcn.10040818
lea ecx, [ebp - 0x10bc]
call fcn.100230a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1064]
push ecx
lea ecx, [ebp - 0x1060]
call fcn.10002960
push eax
lea ecx, [ebp - 0x10bc]
call fcn.1000bea0
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x10a0]
call fcn.100264f0
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x1084]
call fcn.100264f0
lea ecx, [ebp - 0x10bc]
push ecx
lea ecx, [ebp - 0x82c]
call fcn.10027300
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10bc]
call fcn.100230d0
jmp 0x10022f24
lea edx, [ebp - 0x82c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10027140
mov eax, dword [ebp - 0x10c0]
or eax, 1
mov dword [ebp - 0x10c0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x82c]
call fcn.10027240
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1048]
call fcn.10002740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1060]
call fcn.100265a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052989
mov esp, ebp
pop ebp
ret