joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ea97
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1002270
push 0x80000001
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ec32
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x100213c
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call esi
cmp eax, ebx
jne 0x100ebec
cmp dword [ebp - 4], edi
jne 0x100ebec
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x100211c
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebec
cmp dword [ebp - 4], 4
jne 0x100ebec
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10020f8
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebec
cmp dword [ebp - 4], 4
jne 0x100ebec
mov eax, dword [ebp - 8]
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10020d0
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebec
cmp dword [ebp - 4], 4
jne 0x100ebec
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x10020b0
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebec
cmp dword [ebp - 4], 4
jne 0x100ebec
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x1002090
push dword [ebp - 0xc]
call esi
cmp eax, ebx
jne 0x100ebec
cmp dword [ebp - 4], 4
jne 0x100ebec
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], 1
mov dword [edi + 4], eax
jmp 0x100ec27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100ec00
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ec27
test byte [eax + 0x1c], 4
je 0x100ec27
push ecx
push 0x1001ecc
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret 8
Function at 0x100f520
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x100f6a2
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x1002270
push 0x80000001
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100f6dd
push ebx
push edi
push 0xa
pop ecx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
push 2
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x34], 0x28
call dword [sym.imp.USER32.dll_MonitorFromRect]
push 4
cmp eax, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
je 0x100f625
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x100f5eb
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push ebx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x10020b0
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x24]
push ebx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x1002090
push dword [ebp - 8]
call esi
jmp 0x100f625
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100f5ff
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100f625
test byte [eax + 0x1c], bl
je 0x100f625
push ecx
push 0x1001ecc
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30]
je 0x100f632
sub eax, dword [ebp - 0x30]
jmp 0x100f635
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x44]
push ebx
add ecx, eax
lea eax, [ebp - 4]
push eax
push ebx
xor edi, edi
push edi
push 0x100213c
push dword [ebp - 8]
mov dword [ebp - 4], ecx
call esi
mov eax, dword [ebp - 0x40]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x100211c
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x3c]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x10020f8
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x38]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x10020d0
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
jmp 0x100f6dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100f6b6
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100f6dd
test byte [eax + 0x1c], 4
je 0x100f6dd
push ecx
push 0x1001ecc
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
pop esi
leave
ret

Function at 0x1010c57
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x10219b8], 0
jne 0x1010c7a
push 0
push dword [0x10218f8]
push 0x1010a92
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10219b8], eax
xor eax, eax
ret 0x10
Function at 0x10110ea
Capabilities:
Log keystrokes via application hook

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.01010c84
test eax, eax
jge 0x1011134
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1011134
test byte [ecx + 0x1c], 4
je 0x1011134
push eax
push 0x1001ecc
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010086d5
mov ecx, esi
call fcn.010118c5
movzx eax, ax
push eax
call fcn.01008762
call fcn.01008e29
call fcn.010089b2
test eax, eax
je 0x101115c
push dword [esi + 4]
mov ecx, esi
call fcn.0100ee28
push 0
push dword [esi + 4]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
mov ecx, esi
call fcn.010117b1
test eax, eax
jge 0x1011198
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1011198
test byte [ecx + 0x1c], 4
je 0x1011198
push eax
push 0x1001ecc
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010086d5
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x100
push ebx
lea eax, [esi + 0x34]
push eax
push 0x3e9
push dword [0x10218f8]
call edi
test eax, eax
jne 0x10111f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10111cd
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10111f4
test byte [eax + 0x1c], 4
je 0x10111f4
push ecx
push 0x1001ecc
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
mov ecx, esi
call fcn.01010f7f
push ebx
lea eax, [ebp - 0x204]
push eax
push 0x3ef
push dword [0x10218f8]
call edi
push 0x64
push dword [0x10218f8]
xor edi, edi
push 0xd1
push dword [esi + 4]
lea eax, [ebp - 0x204]
push edi
push edi
push edi
push edi
push 0x5003400b
push eax
push 0x1001cc4
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
cmp ebx, edi
je 0x1011255
call fcn.010088f6
push eax
push 0xfffffffffffffff4
push ebx
call dword [sym.imp.USER32.dll_SetClassLongW]
jmp 0x1011279
mov eax, dword [section..data]
cmp eax, section..data
je 0x1011279
test byte [eax + 0x1c], 4
je 0x1011279
push 0x1001ecc
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009390
mov ecx, esi
call fcn.0100f981
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [0x10218f8]
push 0x1010a92
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push edi
push 0xfffffffffffffffc
mov dword [0x10219b8], eax
push dword [esi + 4]
push 0x8002
call dword [sym.imp.USER32.dll_NotifyWinEvent]
cmp dword [0x1021784], edi
je 0x101130b
mov al, byte [0x1021788]
cmp al, 4
jae 0x10112ca
test al, al
jne 0x101130b
mov ecx, dword [0x1021774]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x101130b
mov ecx, dword [0x102177c]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x1021778]
jne 0x101130b
cmp eax, ecx
jne 0x101130b
push 0x10016d0
push dword [0x102175c]
push dword [0x1021758]
call fcn.0100db6f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0101a181
leave
ret 0x10
Function at 0x10117b1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x10117de
test byte [eax + 0x1c], 0x10
je 0x10117de
push 0x1002260
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009390
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x10117f3
mov ecx, eax
call fcn.010133ca
jmp 0x10117f5
xor eax, eax
mov dword [esi + 0x20], eax
test eax, eax
je 0x1011891
mov ecx, eax
call fcn.01013419
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x1011862
lea ecx, [esi + 0x270]
push ecx
push eax
push esi
push 0x100abbe
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x26c], eax
test eax, eax
jne 0x10118ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1011847
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x10118ba
test byte [eax + 0x1c], 4
je 0x10118ba
push ebx
push 0x1002260
push 0xb
jmp 0x10118af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1011876
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x10118ba
test byte [eax + 0x1c], 4
je 0x10118ba
push ebx
push 0x1002260
push 0xc
jmp 0x10118af
mov ecx, 0x8007000e
mov ebx, ecx
mov eax, dword [section..data]
cmp eax, edi
je 0x10118ba
test byte [eax + 0x1c], 4
je 0x10118ba
push ecx
push 0x1002260
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x10118c5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x410]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1002270
push 0x80000002
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x410], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1011a2a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 0x20
push 0x10022c8
push ebx
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], 0x200
call esi
cmp eax, ebx
jle 0x101194e
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x1011a1d
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push 2
push 0x10022fc
push ebx
push dword [ebp - 0x410]
mov dword [ebp - 0x414], 0x200
call esi
test eax, eax
jne 0x10119f9
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x418], ebx
call fcn.0100bd24
test eax, eax
je 0x10119f9
lea ecx, [ebp - 0x204]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x10119a9
sub eax, esi
jmp 0x10119f3
push 8
pop edx
cmp dx, word [ebp - 0x408]
jbe 0x1011a1d
cmp dword [ebp - 0x40c], ebx
jbe 0x1011a1d
inc dword [ebp - 0x408]
add eax, eax
push 0xfffffffffffffffe
pop edx
sub edx, eax
add dword [ebp - 0x40c], edx
lea ecx, [ecx + eax + 2]
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x10119e7
sub eax, edx
sar eax, 1
jne 0x10119b7
jmp 0x1011a1d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1011a1d
test byte [eax + 0x1c], 4
je 0x1011a1d
push 0x1002260
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009390
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x408]
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret
Function at 0x101267a
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x101277e
xor eax, eax
mov dword [ebp - 0x62c], esi
lea edi, [ebp - 0x628]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x66c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x670], 0x44
mov eax, 0x10024a8
cmp ebx, esi
jne 0x10126ec
mov eax, 0x1002498
push ebx
push 0x100237c
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.01008459
add esp, 0x18
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x101274c
push dword [ebp - 0x628]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x62c]
call edi
jmp 0x10127b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1012760
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10127b9
test byte [eax + 0x1c], 4
je 0x10127b9
push esi
push 0x10023b0
push 0xd
jmp 0x10127ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1012792
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10127b9
test byte [eax + 0x1c], 4
je 0x10127b9
push esi
push 0x10023b0
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret 4

Function at 0x1013e88
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
je 0x1013f01
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x41e
push ebx
call esi
mov dword [ebp + 8], eax
cmp eax, edi
je 0x1013f00
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
push eax
push edi
push 0x419
push ebx
call esi
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push 1
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
push eax
push edi
push 0x412
push dword [ebp + 8]
call esi
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x10146ba
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, 0xca
cmp dword [esi + 0x28], eax
jne 0x1014862
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov dword [ebp - 0x40c], ebx
test ebx, ebx
je 0x1014877
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x408], eax
test eax, eax
je 0x1014877
push edi
call fcn.010088e0
push eax
push dword [ebp - 0x408]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x410], eax
mov edi, 0x100
push edi
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebx, [esi + 0x430]
push ebx
push edi
lea eax, [ebp - 0x204]
push eax
call fcn.0100a692
test eax, eax
jne 0x101484d
push 2
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
call fcn.01008a72
mov edi, eax
push 7
add edi, edi
call fcn.01008a72
sub eax, edi
push 7
mov dword [ebp - 0x418], eax
call fcn.01008e4c
push 0x18400
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x420]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.USER32.dll_DrawTextW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
test eax, eax
je 0x101483b
lea eax, [ebp - 0x204]
push eax
push ebx
call edi
test eax, eax
je 0x1014806
mov eax, dword [section..data]
cmp eax, section..data
je 0x1014806
test byte [eax + 0x1c], 4
je 0x1014806
push ebx
push 0x100254c
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a4cd
lea eax, [ebp - 0x204]
push eax
push 0xca
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, dword [esi + 0x20]
test esi, esi
je 0x101483b
push 0
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x40c]
mov ecx, esi
push 1
call fcn.0100e5ca
push dword [ebp - 0x410]
push dword [ebp - 0x408]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x408]
push dword [ebp - 0x40c]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
jmp 0x1014877
lea eax, [esi + 0x430]
push eax
push 0xcd
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret
Function at 0x1014ba5
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1014c6a
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x62c], esi
lea edi, [ebp - 0x628]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x66c]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1002580
lea eax, [ebp - 0x61c]
push 0x208
push eax
mov dword [ebp - 0x670], 0x44
call fcn.01008459
add esp, 0x20
test eax, eax
jne 0x1014c68
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x61c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1014c68
push dword [ebp - 0x628]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x62c]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret 4
Function at 0x1016923
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x208], edi
test ebx, ebx
je 0x1016a98
cmp dword [ebx + 8], 0xfffffff4
jne 0x1016a98
mov eax, dword [ebx + 4]
cmp eax, 0xca
je 0x1016a34
cmp eax, 0xcc
je 0x1016a34
cmp eax, 0xc9
jne 0x10169b6
call fcn.010089a7
test eax, eax
je 0x101698d
cmp dword [ebx + 0xc], 1
jne 0x1016a98
mov eax, dword [ebx + 0x28]
push 4
pop esi
mov ecx, eax
and ecx, esi
push ecx
mov ecx, eax
and ecx, 0x200
push ecx
and eax, 0x10
push eax
push dword [ebx]
mov ecx, edi
push dword [ebx + 0x10]
call fcn.010161bb
jmp 0x1016a98
cmp eax, 0xd0
jne 0x1016a98
call fcn.010089a7
test eax, eax
je 0x1016a98
call fcn.010089b2
test eax, eax
je 0x1016a98
push 0
push 0x102153c
push 0x1021044
push 0
push edi
call sub.msvcrt.dll___RTDynamicCast
add esp, 0x14
test eax, eax
jne 0x1016a98
mov eax, dword [ebx + 0xc]
cmp eax, 1
jne 0x1016a09
push 0x10
jmp 0x1016a97
cmp eax, 2
jne 0x1016a98
lea eax, [ebp - 0x218]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x218]
push eax
push dword [ebx + 0x10]
mov ecx, edi
call fcn.010155de
jmp 0x1016a98
call fcn.010089a7
test eax, eax
je 0x1016a98
call fcn.010089b2
test eax, eax
je 0x1016a98
cmp dword [ebx + 0xc], 1
jne 0x1016a98
push 0x100
lea eax, [ebp - 0x204]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebx + 0x28]
mov ecx, eax
and ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x208]
and eax, 0x200
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebx + 4]
lea esi, [ebx + 0x14]
sub esp, 0x10
mov edi, esp
push dword [ebx + 0x10]
movsd dword es:[edi], dword [esi]
push dword [ebx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.010163ea
push 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret 0x10
Function at 0x1019b53
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01019ae8
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1019bc6
cmp dword [ebp - 0x94], 5
jb 0x1019be7
jmp 0x1019be3
cmp dword [ebp - 0x88], 1
jne 0x1019be7
cmp dword [ebp - 0x94], 4
ja 0x1019be3
jne 0x1019be7
cmp dword [ebp - 0x90], 0
jbe 0x1019be7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1002abc
call fcn.010199b0
test eax, eax
jge 0x1019c08
mov byte [0x1021754], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0101a181
leave
ret

Function at 0x1019e09
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1021cbc], 0
push esi
jne 0x1019d77
call fcn.01019c6e
test eax, eax
je 0x1019dba
mov eax, dword [0x1021cbc]
cmp eax, 1
jne 0x1019d98
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1019dba
pop esi
ret
push eax
call dword [0x1021cc4]
test eax, eax
jne 0x1019e02
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1019dbe
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1021cbc]
call dword [0x1021cc4]
mov edi, eax
test edi, edi
je 0x1019de3
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1019dff
mov edi, esi
add esi, 0xff0
push edi
push dword [0x1021cbc]
call dword [0x1021cc0]
add edi, 0x10
cmp edi, esi
jb 0x1019deb
mov eax, edi
pop edi
pop esi
ret
jmp 0x1019d64