joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eb390
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x100eb3a2
lea eax, [edx + 0xd]
pop esi
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x100eb3b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100eb3b0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x100eb3e0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x100eb3f4
pop ebp
lea eax, [ebx + 0xd]
pop ebx
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
lea ebx, [ebx]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100eb405
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x100eb400
push esi
push ebx
push 7
push 0
push dword [esp + 0x24]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x100eb440
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x1034303b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebp
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov ebp, ecx
mov ecx, dword [esp + 0x244]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x23c], 0
mov eax, dword [ebp + 4]
or eax, 0x2001f
push eax
push ecx
push dword [ebp]
lea ecx, [esp + 0x1c]
call fcn.100eb320
mov esi, eax
test esi, esi
jne 0x100eb55a
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x24]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x100
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x2c]
call edi
test eax, eax
jne 0x100eb52e
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call fcn.100eb440
mov esi, eax
test esi, esi
jne 0x100eb55a
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x100eb4f5
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100eb545
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
push dword [esp + 0x20]
mov ecx, ebp
mov dword [esp + 0x18], 0
call fcn.100eb210
mov esi, eax
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100eb57c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov eax, esi
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.1033d458
add esp, 0x230
ret 4
Function at 0x100ebc10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x10343190
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x105be7d0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x410]
mov eax, dword [ebp + 0x414]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x100ebcb8
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x100ebcb8
call fcn.100eacc0
mov edi, eax
jmp 0x100ebdc2
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100ebcd5
call fcn.100eacc0
jmp 0x100ebdb5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x100ebcf0
call fcn.100eacc0
jmp 0x100ebdb5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x18], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x100ebd0e
mov edi, 0x8007000e
jmp 0x100ebdb7
mov byte [ebp - 4], 2
xor eax, eax
shld eax, ecx, 1
add ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x100ebd52
cmp ecx, 0xffffffff
ja 0x100ebd52
cmp ecx, 0x400
jbe 0x100ebd43
push ecx
lea ecx, [ebp]
call fcn.100f00d0
mov dword [ebp - 4], 1
jmp 0x100ebd72
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x100ebd72
push 0x80070216
call fcn.100dac60
mov eax, 0x100ebd62
ret
mov eax, dword [ebp]
test eax, eax
jne 0x100ebd80
mov edi, 0x8007000e
jmp 0x100ebdb7
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x100ebd9b
call fcn.100eacc0
jmp 0x100ebdb5
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.100ecb40
mov edi, eax
test esi, esi
je 0x100ebdc2
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x100ebdd6
lea ecx, [ebp]
call fcn.100effa0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.1033d458
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
Function at 0x100ee690
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x103436f6
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x450], eax
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x460]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x100ee841
cmp dword [esp + 0x10], 2
jl 0x100ee83a
push dword [edi + 4]
lea ecx, [esp + 0x30]
call fcn.100cd5c0
mov dword [esp + 0x468], 0
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [esp + 0x1c], ax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
push eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
call fcn.100cd9d0
mov byte [esp + 0x468], 1
mov edx, 4
lea ecx, [esp + 0x14]
call fcn.1014e520
lea ecx, [esp + 0x14]
call fcn.10151f70
test al, al
je 0x100ee7d3
xor eax, eax
push 0x410
push eax
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [esp + 0x44]
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push 0x208
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x100ee7be
cmp eax, dword [esp + 0x24]
je 0x100ee7be
lea eax, [esp + 0x44]
push eax
lea ecx, [esi + 0x4c]
call fcn.100cd6c0
jmp 0x100ee7d3
lea ecx, [esi + 0x4c]
lea eax, [esp + 0x14]
cmp ecx, eax
je 0x100ee7d3
push 0xffffffffffffffff
push 0
push eax
call fcn.100cd9d0
mov byte [esp + 0x468], 0
cmp dword [esp + 0x28], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x100ee7f1
push dword [esp + 0x14]
call esi
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x468], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x100ee823
push dword [esp + 0x2c]
call esi
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x460]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.1033d458
add esp, 0x460
ret
Function at 0x100f24b0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x103442b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
lea eax, [esp + 0x44]
push eax
lea ebx, [ecx + 8]
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.100d5c30
mov esi, dword [esp + 0x10]
cmp esi, dword [ebx]
je 0x100f259d
mov edi, dword [esi + 0x14]
test edi, edi
je 0x100f2590
sub esp, 8
mov ecx, edi
mov eax, esp
mov dword [esp + 0x18], esp
push eax
call fcn.1012b2b0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.1012b340
mov byte [esp + 0x44], 1
push eax
mov byte [esp + 0x48], 2
call fcn.100f1630
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x100f255d
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
push eax
push dword [edi + 4]
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
push esi
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.100dbcf0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1033d458
add esp, 0x30
ret 4

Function at 0x100f6c00
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
call fcn.100f8800
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x100f6c6e
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x10]
cmp dword [eax], 0
jne 0x100f6c5c
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100d5c30
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 0x10]
je 0x100f6c49
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x10]
call fcn.100d0260
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 8
ret 4
push eax
lea eax, [esp + 0x10]
push eax
call fcn.100f7100
mov ecx, eax
call fcn.100d0ca0
pop edi
pop esi
add esp, 8
ret 4
Function at 0x100f90b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push edi
mov edi, dword [ecx]
mov dword [esp + 8], ecx
cmp edi, dword [esp + 0x10]
je 0x100f9160
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x10]
push esi
cmp eax, edx
je 0x100f90e2
nop
mov esi, dword [eax]
test esi, esi
je 0x100f90db
cmp dword [esi + 0x18], edi
je 0x100f90e4
add eax, 4
cmp eax, edx
jne 0x100f90d0
xor esi, esi
test esi, esi
je 0x100f9159
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x100f9159
push ebx
push ebp
push eax
call fcn.10101eb0
mov ecx, eax
call fcn.10102080
push dword [esi + 0x18]
mov dword [esp + 0x14], eax
call fcn.100f2300
mov ecx, eax
call fcn.100f25c0
push dword [esi + 0x18]
mov ebp, eax
call fcn.10101190
mov ecx, eax
call fcn.101013c0
push dword [esi + 0x18]
mov ebx, eax
call fcn.100f04a0
mov ecx, eax
call fcn.100f0640
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 0
push dword [esp + 0x14]
call esi
push 0
push ebp
call esi
push 0
push ebx
call esi
push 0
push edi
call esi
mov ecx, dword [esp + 0x14]
pop ebp
pop ebx
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
pop esi
pop edi
add esp, 8
ret 4
Function at 0x100f9270
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0xc]
sub esp, 0x10
mov edx, dword [ecx]
mov ecx, dword [ecx + 0x10]
push edi
cmp eax, ecx
je 0x100f9292
mov edi, dword [eax]
test edi, edi
je 0x100f928b
cmp dword [edi + 0x18], edx
je 0x100f9294
add eax, 4
cmp eax, ecx
jne 0x100f9280
xor edi, edi
cmp edx, 0xffffffff
je 0x100f9469
test edi, edi
je 0x100f9469
mov eax, dword [edi + 0x18]
push ebx
push esi
mov dword [esp + 0x10], eax
call fcn.10101eb0
lea esi, [eax + 4]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.100d5c30
mov eax, dword [esp + 0xc]
cmp eax, dword [esi]
je 0x100f92df
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x100f92df
mov ebx, dword [ebx + 4]
mov dword [esp + 0xc], ebx
jmp 0x100f92e7
mov dword [esp + 0xc], 0
mov eax, dword [edi + 0x18]
mov dword [esp + 0x10], eax
call fcn.100f2300
lea esi, [eax + 8]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100d5c30
mov eax, dword [esp + 0x14]
cmp eax, dword [esi]
je 0x100f931f
mov ebx, dword [eax + 0x14]
test ebx, ebx
je 0x100f931f
mov ebx, dword [ebx + 4]
mov dword [esp + 0x10], ebx
jmp 0x100f9327
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0x18]
push ebp
mov dword [esp + 0x18], eax
call fcn.10101190
lea esi, [eax + 0x14]
lea eax, [esp + 0x18]
mov ecx, esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.100d5c30
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi]
je 0x100f935c
mov ebp, dword [eax + 0x14]
test ebp, ebp
je 0x100f935c
mov ebp, dword [ebp + 4]
jmp 0x100f935e
xor ebp, ebp
mov eax, dword [edi + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100f04a0
mov esi, eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.100d5c30
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esi]
je 0x100f9391
mov ebx, dword [ecx + 0x14]
test ebx, ebx
je 0x100f9391
mov ebx, dword [ebx + 4]
jmp 0x100f9393
xor ebx, ebx
mov eax, dword [edi + 0x1c]
cmp eax, 4
ja case.default.0x100f939f
jmp dword [eax*4 + 0x100f9470]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x18]
call esi
push 0
push ebp
call esi
push 0
push ebx
call esi
pop ebp
pop esi
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x18]
call esi
push 0
push ebp
call esi
push 0
push ebx
call esi
pop ebp
pop esi
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esp + 0x14]
call esi
push 5
push dword [esp + 0x18]
call esi
push 0
push ebp
call esi
push 0
push ebx
call esi
pop ebp
pop esi
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x18]
call esi
push 5
push ebp
call esi
push 0
push ebx
call esi
pop ebp
pop esi
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x18]
call esi
push 0
push ebp
call esi
push 5
push ebx
call esi
pop ebp
pop esi
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x100fa010
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10345898
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x100fa1f9
push 0x14d
call fcn.1014ca80
mov ebx, eax
test ebx, ebx
je 0x100fa1f9
xor eax, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x54], eax
mov edx, 0x13bf
lea ecx, [esp + 0x2c]
call fcn.10145cd0
mov byte [esp + 0x54], 1
cmp dword [eax + 0x14], 8
jb 0x100fa0a7
mov eax, dword [eax]
mov esi, dword [esp + 0x5c]
push esi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1014db00
add esp, 0xc
mov byte [esp + 0x54], 0
cmp dword [esp + 0x40], 8
mov ebp, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x100fa0d5
push dword [esp + 0x2c]
call ebp
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
test esi, esi
jne 0x100fa139
mov edx, 0x13a8
lea ecx, [esp + 0x2c]
call fcn.10145cd0
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x14]
push eax
call fcn.100cd650
mov byte [esp + 0x54], 0
cmp dword [esp + 0x40], 8
jb 0x100fa122
push dword [esp + 0x2c]
call ebp
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
mov esi, dword [esp + 0x24]
cmp esi, 6
jbe 0x100fa155
lea eax, [esi - 6]
push eax
push 6
lea ecx, [esp + 0x1c]
call fcn.100cded0
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x28], 8
lea edi, [ebx + 0x64]
mov ebp, dword [edi + 0x10]
lea edx, [esp + 0x14]
cmovae edx, dword [esp + 0x14]
cmp dword [edi + 0x14], 8
jb 0x100fa173
mov ecx, dword [edi]
jmp 0x100fa175
mov ecx, edi
cmp ebp, esi
mov eax, esi
cmovb eax, ebp
test eax, eax
je 0x100fa18d
push eax
call fcn.100cc860
add esp, 4
test eax, eax
jne 0x100fa19f
cmp ebp, esi
jae 0x100fa196
or eax, 0xffffffff
jmp 0x100fa19d
xor eax, eax
cmp ebp, esi
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x100fa1c6
lea eax, [esp + 0x14]
cmp edi, eax
je 0x100fa1bf
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.100cd9d0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x68]
mov dword [esp + 0x54], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x100fa1e2
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1033d458
add esp, 0x44
ret 4
Function at 0x100faf50
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.100fcce0
mov ebx, eax
test ebx, ebx
je 0x100fafe6
push 0x138c
mov ecx, edi
call fcn.100fdbb0
push 0x138d
mov ecx, edi
mov esi, eax
call fcn.100fdbb0
cmp byte [esp + 0x14], 0
mov ebp, eax
je 0x100faf9c
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 0
push ebp
call esi
push 5
jmp 0x100fafae
push 5
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 5
push ebp
call esi
push 0
push dword [ebx + 4]
call esi
mov ecx, edi
call fcn.100fce80
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x100fafe6
push 0x6a
call fcn.1014ca80
test eax, eax
je 0x100fafe6
cmp byte [esp + 0x14], 0
mov edx, dword [eax]
sete cl
movzx ecx, cl
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], ecx
mov ecx, eax
jmp dword [edx + 0x20]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100fb770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1033ffb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100f8800
mov edx, eax
mov ecx, dword [edx + 0x10]
sub ecx, dword [edx + 0xc]
mov edi, dword [edx + 4]
sar ecx, 2
cmp ecx, edi
jg 0x100fb8e7
mov eax, dword [edx + 0x10]
sub eax, dword [edx + 0xc]
sar eax, 2
cmp eax, edi
jne 0x100fb7d5
cmp dword [edx + 8], 0
je 0x100fb8e7
call fcn.100f8800
mov eax, dword [eax + 8]
test eax, eax
je 0x100fb81d
mov ecx, dword [esi + 0xc]
mov ebx, dword [eax + 0x18]
test ecx, ecx
je 0x100fb8f7
push 0x71
call fcn.1014ca80
mov edi, eax
test edi, edi
je 0x100fb8f7
push ebx
mov ecx, edi
call fcn.10126e30
push eax
mov ecx, edi
call fcn.10126900
push ebx
mov ecx, esi
call fcn.100fc230
jmp 0x100fb8f7
call fcn.100f8800
mov ecx, eax
call fcn.100f8cf0
mov edi, eax
test edi, edi
je 0x100fb8f7
call fcn.100f6a40
push 0
push 0
push 0x41d
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi + 0x18]
call fcn.100f8800
mov ecx, eax
call fcn.100f90b0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100fb8f7
push 0x71
call fcn.1014ca80
mov ebx, eax
test ebx, ebx
je 0x100fb8a3
mov edx, 0x13ad
lea ecx, [esp + 0x14]
call fcn.10145cd0
mov dword [esp + 0x38], 0
mov ecx, ebx
push dword [edi + 0x18]
push eax
call fcn.101266e0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.100cd690
mov ecx, esi
call fcn.100fcbe0
push 1
mov ecx, esi
call fcn.100faf50
call fcn.101033e0
push 0
push 0
push 0x41b
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [esi + 0x1c]
mov ecx, esi
push eax
call fcn.100fdf60
mov ecx, esi
call fcn.100fd8f0
jmp 0x100fb8f7
push 0
push 1
call fcn.100f6080
mov ecx, eax
call fcn.100f61d0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1033d458
add esp, 0x2c
ret
Function at 0x100fcaf0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x218
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x138f
call fcn.100fdbb0
push 0x1388
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100fcb3e
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1033d458
add esp, 0x218
ret
xor eax, eax
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [esp + 8]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
lea ecx, [esp + 8]
call fcn.1014d190
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
call fcn.1033d458
add esp, 0x218
ret

Function at 0x100fe780
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x10345ebe
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov eax, dword [0x105e8478]
mov esi, dword [esp + 0x22c]
test al, 1
jne 0x100fe80f
or eax, 1
mov dword [0x105e8478], eax
mov dword [esp + 0x224], 0
xor eax, eax
push 0x10365b80
mov dword [0x105e8514], 7
mov dword [0x105e8510], 0
mov word [0x105e8500], ax
call fcn.1033d620
add esp, 4
mov dword [esp + 0x224], 0xffffffff
cmp dword [0x105e8510], 0
jne 0x100fe87f
xor eax, eax
push 0x208
push eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp word [esp + 0xc], 0
jne 0x100fe856
xor ecx, ecx
jmp 0x100fe86f
lea ecx, [esp + 0xc]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100fe860
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x10]
mov ecx, 0x105e8500
push eax
call fcn.100cdd90
cmp esi, 0x105e8500
je 0x100fe897
push 0xffffffffffffffff
push 0
push 0x105e8500
mov ecx, esi
call fcn.100cd9d0
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1033d458
add esp, 0x220
ret 4
Function at 0x10103e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10346999
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.RC::RCTextSearchCallBack.0
mov dword [esp + 0x14], 0
push 0x18
mov dword [esi], vtable.RC::RCSearch.0
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x14], 1
mov dword [esi + 8], 0
mov byte [esp + 0x14], 2
xor eax, eax
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], 0
mov word [esi + 0xc], ax
mov byte [esp + 0x14], 3
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], eax
mov byte [esi + 0x2c], al
mov byte [esi + 0x2d], 1
mov byte [esi + 0x2e], al
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret