joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
push 0
mov esi, eax
push esi
mov edi, ecx
mov ebx, edx
push edi
push ebx
call ebp
cmp eax, 0xffffffff
je 0x4066e4
lea esp, [esp]
cmp eax, esi
je 0x4066fe
push 0
sub esi, eax
push esi
add edi, eax
push edi
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x4066d0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edi, str.send__:
call fcn.00406290
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x406710
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, eax
xor edi, edi
mov edx, dword [esp + 0x14]
push 0
mov eax, ebp
sub eax, edi
push eax
lea ecx, [edi + esi]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x406751
test eax, eax
je 0x40676b
cmp dword [esp + 0x1c], 0
je 0x40674c
add edi, eax
cmp edi, ebp
jne 0x406722
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edi, str.recv__:
call fcn.00406290
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40678b
mov edi, dword [esp + 0x24]
push str.The_other_host_terminated_the_connection.
push edi
push esi
call fcn.0040722a
add esp, 0xc
mov byte [esi + edi - 1], 0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x4067a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x8008
call fcn.00413ba0
mov eax, dword [0x418a28]
xor eax, esp
mov dword [esp + 0x8004], eax
mov eax, dword [esp + 0x8010]
push ebx
push ebp
mov ebp, dword [esp + 0x8014]
push esi
mov esi, ecx
cmp esi, 0x8000
push edi
mov dword [esp + 0x10], eax
jle 0x40680d
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov edi, edi
xor edi, edi
push 0
mov ecx, 0x8000
sub ecx, edi
push ecx
lea edx, [esp + edi + 0x1c]
push edx
push ebp
call ebx
cmp eax, 0xffffffff
je 0x40684e
test eax, eax
je 0x406868
add edi, eax
cmp edi, 0x8000
jne 0x4067e2
sub esi, edi
cmp esi, edi
jg 0x4067e0
test esi, esi
je 0x406833
mov eax, dword [esp + 0x8024]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 1
push esi
push ebp
lea eax, [esp + 0x28]
call fcn.00406710
add esp, 0x14
cmp eax, 0xffffffff
je 0x40688b
xor eax, eax
mov ecx, dword [esp + 0x8014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004075d7
add esp, 0x8008
ret
mov ebx, dword [esp + 0x8024]
mov esi, dword [esp + 0x10]
mov edi, str.recv__:
call fcn.00406290
or eax, 0xffffffff
jmp 0x406835
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40688b
mov edi, dword [esp + 0x8024]
push str.The_other_host_terminated_the_connection.
push edi
push esi
call fcn.0040722a
add esp, 0xc
mov byte [esi + edi - 1], 0
or eax, 0xffffffff
jmp 0x406835

Function at 0x4075d7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418a28]
jne 0x4075e1
repz ret
jmp fcn.0040ae73
Function at 0x40bf7a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x418b60]
je 0x40bf95
inc edi
cmp edi, 0x17
jb 0x40bf86
cmp edi, 0x17
jae 0x40c115
push ebp
push 3
call fcn.004110ac
cmp eax, 1
pop ecx
je 0x40c0e1
push 3
call fcn.004110ac
test eax, eax
pop ecx
jne 0x40bfc9
cmp dword [0x4183f8], 1
je 0x40c0e1
cmp ebx, 0xfc
je 0x40c114
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x419610
push ebp
call fcn.004071c5
add esp, 0xc
test eax, eax
je 0x40bfff
push esi
push esi
push esi
push esi
push esi
call fcn.00409bce
add esp, 0x14
push 0x104
mov esi, 0x419629
push esi
push 0
mov byte [0x41972d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40c043
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004071c5
add esp, 0xc
test eax, eax
je 0x40c043
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00409bce
add esp, 0x14
push esi
call fcn.0040ce00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40c088
push esi
call fcn.0040ce00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x419924
push 0x414990
sub ecx, eax
push ecx
push eax
call fcn.004078c1
add esp, 0x14
test eax, eax
je 0x40c088
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00409bce
add esp, 0x14
jmp 0x40c08a
xor esi, esi
push 0x415928
push ebx
push ebp
call fcn.004075e6
add esp, 0xc
test eax, eax
je 0x40c0aa
push esi
push esi
push esi
push esi
push esi
call fcn.00409bce
add esp, 0x14
push dword [edi*8 + 0x418b64]
push ebx
push ebp
call fcn.004075e6
add esp, 0xc
test eax, eax
je 0x40c0cc
push esi
push esi
push esi
push esi
push esi
call fcn.00409bce
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00410eef
add esp, 0xc
jmp 0x40c114
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40c114
cmp ebp, 0xffffffff
je 0x40c114
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x418b64]
push dword [esi]
call fcn.0040ce00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x410eef
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040a8db
xor ebx, ebx
cmp dword [0x419a60], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x410fc5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4110a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x415414
push edi
call esi
cmp eax, ebx
je 0x4110a5
push eax
call fcn.0040a86d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419a60], eax
call esi
push eax
call fcn.0040a86d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419a64], eax
call esi
push eax
call fcn.0040a86d
mov dword [0x419a68], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004089f6
test eax, eax
pop ecx
pop ecx
je 0x410f93
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409bce
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x410fc5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040a86d
cmp eax, ebx
pop ecx
mov dword [0x419a70], eax
je 0x410fc5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a86d
pop ecx
mov dword [0x419a6c], eax
mov eax, dword [0x419a6c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41104a
cmp dword [0x419a70], ecx
je 0x41104a
push eax
call fcn.0040a8e4
push dword [0x419a70]
mov esi, eax
call fcn.0040a8e4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41104a
cmp edi, ebx
je 0x41104a
call esi
cmp eax, ebx
je 0x411017
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411017
test byte [ebp - 0x18], 1
jne 0x41104a
lea eax, [ebp - 0x10]
push eax
call fcn.00408a2d
test eax, eax
pop ecx
je 0x411032
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409bce
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x411041
or dword [ebp + 0x10], 0x200000
jmp 0x411085
or dword [ebp + 0x10], 0x40000
jmp 0x411085
mov eax, dword [0x419a64]
cmp eax, dword [ebp - 8]
je 0x411085
push eax
call fcn.0040a8e4
cmp eax, ebx
pop ecx
je 0x411085
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x411085
mov eax, dword [0x419a68]
cmp eax, dword [ebp - 8]
je 0x411085
push eax
call fcn.0040a8e4
cmp eax, ebx
pop ecx
je 0x411085
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419a60]
call fcn.0040a8e4
cmp eax, ebx
pop ecx
je 0x4110a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4110a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1033a73
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x126fe5c
call fcn.01160118
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
push 0
mov ecx, edi
call fcn.01032636
lea ebx, [esi + 0x54]
mov eax, dword [ebx]
test eax, eax
jne 0x1033aed
push 0x2000
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], 0x19d
call fcn.01032bcf
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0103364a
push 1
push 1
push 0xa020
push dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.01032c03
push 0
push dword [ebp - 0x10]
push dword [ebx]
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x1033aed
lea ecx, [ebp - 0x14]
call fcn.0103d737
lea ebx, [esi + 0x40]
cmp dword [ebx], 0
jne 0x1033b59
push 0x2000
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], 0x19f
call fcn.01032bcf
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0103364a
push 1
push 1
push 0xa020
push dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.01032c03
push 0
push dword [ebp - 0x14]
push dword [ebx]
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x1033b59
lea ecx, [ebp - 0x10]
call fcn.0103d737
mov ecx, esi
call fcn.010338ec
mov ecx, esi
call fcn.01033691
push 0x628
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
je 0x1033bad
lea eax, [esi + 0x44]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
lea eax, [esi + 0x44]
push eax
push dword [edi]
push dword [ebp - 0x10]
call ebx
push 0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x629
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1033bea
add esi, 0x58
push esi
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
push esi
push dword [edi]
push dword [ebp - 0x10]
call ebx
push 0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x103d38c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x12d1f58]
mov eax, dword [eax + 8]
push 2
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [0x12d1f58]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
cmp word [eax + 0xe], 0x20
sete cl
mov al, cl
pop ebp
ret 4

Function at 0x1040678
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1270aa4
call fcn.01160118
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [0x12d23c0]
push 0xf1
push ebx
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1040770
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1040770
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1040770
movzx eax, word [edi + 6]
mov dword [ebp - 0x10], eax
movzx eax, word [edi + 4]
push eax
movzx eax, word [edi + 2]
push eax
mov ecx, esi
call fcn.0103d84c
xor eax, eax
cmp dword [esi + 0x44], eax
jne 0x104070d
push ebx
call fcn.0103d38c
shl al, 5
lea ecx, [esi + 0x81]
xor al, byte [ecx]
and al, 0x20
xor byte [ecx], al
movzx eax, word [edi + 6]
push eax
mov ecx, esi
call fcn.0103d806
test al, al
je 0x1040770
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
je 0x1040732
push dword [ebp + 0x18]
movzx ecx, word [ebp + 0x10]
push dword [ebp + 0x14]
movsx eax, bx
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.0103d7d8
jmp 0x1040765
test byte [esi + 0x81], 0x20
je 0x1040755
push 0x2040
push eax
push eax
push eax
push ebx
push dword [0x12d23c0]
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp + 8], eax
jmp 0x1040765
push ecx
mov eax, esp
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], esp
mov dword [eax], ebx
call fcn.010a5b91
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x1040774
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x10407d7
push dword [esi + 0x9c]
push dword [ebp + 8]
push dword [esi + 0x44]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
jne 0x104078f
xor esi, esi
jmp 0x10407c9
cmp dword [ebp - 0x10], 0
jle 0x10407b6
xor eax, eax
mov ax, word [edi + ebx*2 + 8]
test ax, ax
je 0x10407b0
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x48]
call fcn.0103fbd0
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x1040795
push dword [esi + 0x44]
mov edi, dword [esi + 0x4c]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
xor esi, esi
cmp eax, edi
jne 0x10407c9
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0103d737
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x1042254
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x14]
and dword [edi], 0
mov esi, ecx
mov eax, dword [esi + 0xa4]
cmp eax, 0x12
je 0x1042288
cmp eax, 0x79
jne 0x104227f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1042288
cmp dword [esi + 0xa4], 0x20
jne 0x10422fa
cmp dword [ebp + 0xc], 0xf100
jne 0x10422fa
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x10422b7
mov ecx, esi
call fcn.010421d7
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10422fa
mov eax, dword [esi + 0xa4]
cmp eax, 0x20
je 0x10422fa
test byte [esi + 0x80], 0x40
jne 0x10422ef
mov al, byte [esi + 0x81]
test al, 2
je 0x10422e6
test al, 4
jne 0x10422e6
test al, 8
je 0x10422e6
push 1
mov ecx, esi
call fcn.01041aa6
mov ecx, esi
call fcn.010421a7
jmp 0x10422f4
cmp eax, 0x20
je 0x10422fa
mov dword [edi], 1
and byte [esi + 0x80], 0xbf
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x10447d1
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov esi, ecx
cmp eax, dword [esi + 4]
je 0x10447ef
mov eax, dword [ebp + 0x10]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x1044828
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
je 0x1044801
mov ecx, esi
call fcn.010421a7
mov eax, dword [edi + 0xc]
push 0
push eax
push 0x419
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x80], 0xcf
push 1
push eax
mov ecx, esi
call fcn.010445a9
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1045054
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 1
mov edi, ecx
call esi
push dword [edi]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
mov edi, eax
call esi
cmp edi, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x1045082
mov eax, 0x80004005
ret
xor eax, eax
ret
Function at 0x104665b
Capabilities:
Delete file

Disassembly:
mov eax, 0x1270fa7
call fcn.01160118
sub esp, 0x68c
mov eax, dword [0x12cf8c8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x698], eax
jne 0x104668d
mov eax, 0x80004003
jmp 0x10468b2
push esi
mov esi, 0x12d2398
push edi
mov ecx, esi
call fcn.0107d6ee
push eax
lea ecx, [ebp - 0x684]
call fcn.01045e8e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x684]
call fcn.0104502b
mov eax, dword [0x12d206c]
cmp dword [eax - 8], ebx
mov edi, 0x12d206c
jne 0x104686f
mov dword [ebp - 0x68c], ebx
mov byte [ebp - 4], 1
push 0xf003f
mov ecx, esi
call fcn.0107c3e1
push eax
push SysReAllocString
lea ecx, [ebp - 0x68c]
call fcn.01044a77
test eax, eax
jne 0x1046735
lea eax, [ebp - 0x688]
push eax
push dword [0x12ce320]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x68c]
mov word [ebp - 0x218], bx
mov dword [ebp - 0x688], 0x208
call fcn.01044ae6
test eax, eax
jne 0x1046735
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.01044f8b
mov eax, dword [0x12d206c]
cmp dword [eax - 8], ebx
jne 0x104674c
push dword [0x12ce324]
mov ecx, edi
call fcn.01044f8b
mov word [ebp - 0x224], 0x5c
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov byte [ebp - 4], 2
push dword [0x12ce32c]
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.01045c7c
mov byte [ebp - 4], 3
push dword [eax]
lea ecx, [ebp - 0x67c]
call fcn.01045d62
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x688]
call fcn.0103290a
cmp esi, ebx
je 0x1046852
lea eax, [ebp - 0x688]
push eax
lea ecx, [ebp - 0x67c]
call fcn.01045cfc
mov byte [ebp - 4], 4
push dword [0x12d206c]
push dword [eax]
call fcn.01044bb9
test eax, eax
setne byte [ebp - 0x67d]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x688]
call fcn.0103290a
cmp byte [ebp - 0x67d], bl
je 0x104683f
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x67c]
call fcn.01045cfc
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x690]
push eax
call fcn.01045c11
mov byte [ebp - 4], 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x690]
call fcn.0103290a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x694]
call fcn.0103290a
lea ecx, [ebp - 0x67c]
call fcn.01044d6e
cmp eax, ebx
jne 0x10467a8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x67c]
call fcn.01044d9a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68c]
call fcn.01044a59
push edi
lea ecx, [ebp - 0x684]
call fcn.01044d17
push dword [ebp - 0x684]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x698]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, 0x7fff0001
add eax, 0x8000ffff
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.0104508a
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret 4
Function at 0x105a89d
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1272712
call fcn.01160118
sub esp, 0x18
mov eax, dword [0x12cf8c8]
push ebx
push esi
push edi
push ecx
mov dword [ebp - 0x10], eax
mov esi, ecx
mov eax, esp
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esp
mov dword [eax], ebx
call fcn.0105a7cb
mov dword [ebp - 4], ebx
mov dword [esi], 0x1005670
mov dword [esi + 0x50], 0x100566c
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
lea ecx, [esi + 0x8c]
mov dword [esi + 0x88], ebx
call fcn.0105a812
mov byte [ebp - 4], 1
mov eax, dword [0x12ce0a0]
lea ecx, [esi + 0xec]
mov dword [ecx], eax
mov byte [ebp - 4], 2
mov eax, dword [0x12ce0a0]
mov dword [esi + 0xf0], eax
mov byte [ebp - 4], 3
push 0x100548c
mov byte [esi + 0xf4], bl
call fcn.01044f8b
xor eax, eax
mov word [ebp - 0x1c], bx
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jg 0x105a961
push 0x1005244
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esi + 0xec]
lea edi, [esi + 0xf0]
push eax
mov ecx, edi
call fcn.01044bd5
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.010524eb
push 0x1005660
mov ecx, edi
call fcn.010524eb
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
call fcn.0115fe1a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105bad7
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
push edi
mov ebx, ecx
je 0x105baf4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [esi], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x105bb09
push 0x100355c
jmp 0x105bb2f
lea eax, [edi + edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.011602e0
mov dword [ebp + 8], esp
inc edi
push edi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x105bb40
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x105c951
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.01045b16
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push dword [ebp + 0xc]
push ebx
call esi
push 0xf0
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], ecx
je 0x105c9ab
push eax
push ebx
call esi
push eax
mov dword [ebp - 4], eax
call edi
mov dword [ebp + 0xc], eax
cmp dword [ebp + 8], 0
je 0x105c9f9
push dword [ebp + 8]
push ebx
call esi
push eax
mov dword [ebp + 8], eax
call edi
push dword [ebp + 0xc]
mov esi, eax
push esi
call fcn.0105c04e
push dword [ebp + 0x18]
mov edi, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
cmp edi, esi
mov dword [ebp - 8], eax
je 0x105c9f0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
je 0x105ca11
cmp dword [ebp - 0xc], 0
je 0x105ca11
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
leave
ret 0x14

Function at 0x106190e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1061923
test al, 0x10
je 0x1061923
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x10619a9
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4

Function at 0x10622c1
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x800e
push 0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x10622f8
xor eax, eax
inc eax
jmp 0x1062356
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x14]
and dword [ebp - 0x234], 0
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x23c], 0x1005688
mov dword [ebp - 0x22c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0115fe1a
leave
ret 0x10