joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x100cb018]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov dword [esp + 0x10], edi
call fcn.10003b50
test eax, eax
je 0x100066bb
mov ecx, ebx
call fcn.10017af0
lea esi, [ebx + 0x48]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
movsx ecx, byte [esi + 0x10]
sar ecx, 0x1f
and ecx, 0x10000
mov edx, ecx
or edx, 0x20000
test byte [esi + 0x14], 1
cmove edx, ecx
mov eax, edx
or eax, 0x40000
cmp byte [esi + 0x11], 0
cmovge eax, edx
mov edx, dword [ebp + 0xc]
mov ecx, eax
or ecx, 0x80000
cmp byte [esi + 0x12], 0
cmovge ecx, eax
mov eax, ecx
or eax, 0x40000000
test edx, edx
cmovns eax, ecx
mov ecx, dword [ebp + 8]
mov esi, eax
mov dword [esp + 0xc], esi
cmp ecx, 0x14
jne 0x10006516
mov dword [esp + 0xc], esi
test edx, edx
js 0x10006516
xor esi, 0x20000
mov dword [esp + 0xc], esi
push edx
call fcn.10005fd0
add esp, 4
test eax, eax
je 0x10006528
movzx eax, ax
jmp 0x10006572
push 0
push 0
push 8
push 0x100d071c
push 0x100d0730
push edx
push dword [ebp + 8]
mov ecx, 0x40
lea esi, [ebx + 0x48]
mov edi, 0x100d0730
rep movsd dword es:[edi], dword [esi]
mov word [0x100d0741], 0
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x100066b1
movzx eax, word [0x100d071c]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebx + 0x190]
or esi, eax
cmp dword [ecx + 0x3c], 0xffffffff
je 0x100065a4
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x100065a4
push dword [ecx + 4]
push dword [ecx]
push 0
push esi
push 0x8004
call fcn.10019fb0
or eax, edx
je 0x100065a4
mov eax, 1
jmp 0x100065a6
xor eax, eax
mov dword [edi], eax
cmp esi, 0xffe5
je 0x10006640
cmp esi, 0x4002ffe5
jne 0x10006653
mov ecx, dword [ebx + 0x1ec]
mov eax, ecx
shr eax, 0x10
test al, 1
je 0x10006653
push 0x1c
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
and ecx, 0xfffeffff
mov dword [esp + 0x20], 0x140014
push 2
mov dword [ebx + 0x1ec], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0x140014
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call dword [sym.imp.USER32.dll_SendInput]
jmp 0x10006653
cmp dword [ebx + 0x174], 0
je 0x10006653
or dword [ebx + 0x1ec], 0x10000
cmp dword [edi], 0
jne 0x100066bb
cmp byte [ebx + 0x18a], 0
jne 0x100066bb
test dword [ebp + 0xc], 0x80000000
jne 0x100066bb
movzx esi, si
push esi
call fcn.10069100
add esp, 4
test eax, eax
jne 0x10006687
push esi
call fcn.10069220
add esp, 4
test eax, eax
je 0x100066bb
or dword [ebx + 0x1ec], 0x40000
mov dword [ebx + 0x208], esi
mov dword [edi], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10059b70
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10059b70
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000a6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100cb018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
mov ebx, ecx
lea eax, [ebp - 0x238]
push 0
mov dword [ebp - 0x240], ebx
push eax
mov dword [ebp - 0x240], ebx
call fcn.1005f9c0
movups xmm0, xmmword [str.SoftwareRimeWeasel]
mov ax, word [0x100b7b88]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 8], ax
movups xmm0, xmmword [0x100b7b70]
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x248], 0
movq xmm0, qword [0x100b7b80]
movq qword [ebp - 0x10], xmm0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
mov dword [ebp - 0x23c], eax
call edi
push eax
call esi
mov esi, eax
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x1000a786
lea ecx, [ebp - 0x248]
push ecx
call eax
lea eax, [ebp - 0x244]
push eax
push 0x101
push 0
lea eax, [ebp - 0x30]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000a83d
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], 0x208
push eax
lea eax, [ebp - 0x23c]
push eax
push 0
push str.WeaselRoot
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x244]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000a7fd
push dword [ebp - 0x248]
call esi
test edi, edi
jne 0x1000a83d
cmp dword [ebp - 0x23c], 1
jne 0x1000a83d
cmp word [ebp - 0x238], di
je 0x1000a83d
xorps xmm0, xmm0
lea ecx, [ebp - 0x238]
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], edi
lea edx, [ecx + 2]
mov dword [ebx + 0x14], edi
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000a830
jmp 0x1000a86b
xorps xmm0, xmm0
lea ecx, [ebp - 0x238]
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
lea edx, [ecx + 2]
mov dword [ebx + 0x14], 0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000a860
sub ecx, edx
lea eax, [ebp - 0x238]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10003280
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10059b70
mov esp, ebp
pop ebp
ret
Function at 0x10015d10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x100cb018]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], 0x100
lea ecx, [esp + 0xc]
mov eax, edx
push ecx
push eax
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x10015d65
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.10059b70
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
xor esi, esi
lea eax, [esp + 0x14]
push esi
push esi
push esi
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x10015dd0
nop word [eax + eax]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x20]
mov byte [esp + 0x11f], 0
call fcn.10015d10
mov esi, eax
test esi, esi
jne 0x10015dd0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x10015d90
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10015deb
push dword [esp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov ecx, dword [esp + 0x124]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10059b70
mov esp, ebp
pop ebp
ret
Function at 0x10017f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x10017fbb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10017fa4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x10019850
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x100cb018]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov esi, ecx
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], esi
mov dword [esp + 0xc], esi
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esp + 8]
test eax, eax
je 0x100198c5
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005a36d
add esp, 4
mov edi, eax
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [esp + 8], 0
ja 0x100198fa
push edi
call fcn.1005a368
add esp, 4
xorps xmm0, xmm0
mov ecx, esi
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
push 0x100b79c0
mov dword [esi + 0x14], 0
call fcn.10003280
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10059b70
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
movaps xmmword [esp + 0x10], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10019917
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.10003280
push edi
call fcn.1005a368
mov ecx, dword [esp + 0x40]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
add esp, 4
mov dword [esi + 0x10], 0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 0x14], 0
mov eax, esi
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [esp + 0x1c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.10059b70
mov esp, ebp
pop ebp
ret
Function at 0x10019fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088a00
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100cb018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], ecx
lea ecx, [esi + 0x24]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
call fcn.1001d2e0
lea eax, [ebp - 0x34]
push eax
push dword [esi + 0x3c]
lea ecx, [esi + 0x24]
call fcn.1001a5c0
mov ebx, dword [esi + 0x3c]
lea eax, [ebp + 8]
push 0
push eax
push 8
lea eax, [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001a067
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1001a0a3
push dword [esi + 0x44]
push 0
push dword [esi + 0x48]
call fcn.1005f9c0
add esp, 0xc
lea eax, [ebp + 8]
push 0
push eax
push dword [esi + 0x44]
push dword [esi + 0x48]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001a0b4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov byte [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x100c74e0
push eax
call fcn.1005f3cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x100c74e0
push eax
call fcn.1005f3cb
int3
Function at 0x1001a5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088a50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100cb018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0x1c]
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edi
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
cmp byte [edi], 0
je 0x1001a619
mov eax, dword [esi + 0x20]
jmp 0x1001a61e
mov eax, 0x18
push 0
lea edx, [ebp - 0x18]
mov dword [ebp + 0xc], eax
push edx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001a6ba
cmp dword [ebp - 0x18], 0
jbe 0x1001a6ba
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x1001a67b
mov ecx, dword [esi + 0x28]
mov byte [edi], 0
test ecx, ecx
je 0x1001a6a6
mov dword [esi + 0x28], 0
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x28], 0
test ecx, ecx
je 0x1001a6a6
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x100c74e0
push eax
call fcn.1005f3cb
int3
Function at 0x1001bb20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088ba8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100cb018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.100194d0
push 8
call fcn.10059b7e
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 2
call fcn.10044854
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push eax
call fcn.1001bf40
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx eax, ax
mov ecx, esi
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
mov eax, dword [esi]
call dword [eax + 8]
test eax, eax
je 0x1001bc43
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [edi + 0x38], 0
mov eax, dword [ebp + 8]
mov word [edi + 0x40], ax
jne 0x1001bc60
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.100194d0
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax + 0x10], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx + 0xc], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001be70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088c20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100cb018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10059b7e
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10044854
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029fa0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100cb018]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push 0
mov dword [ebp - 0x30], esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_OffsetRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1002a0b1
test edi, edi
je 0x1002a08e
test ebx, ebx
je 0x1002a08e
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1002a08e
mov ecx, dword [ebx]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
sub esi, ecx
mov ebx, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x28], ecx
sub ebx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push esi
push dword [ebp - 0x1c]
mov edi, eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edi
call esi
push 0xcc0020
push ebx
mov edi, eax
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push ebx
mov ebx, dword [ebp - 0x2c]
push eax
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
push edi
push ebx
call esi
push ebx
mov esi, eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call ebx
mov edi, dword [ebp - 0x1c]
jmp 0x1002a096
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call ebx
mov esi, dword [ebp - 0x30]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10059b70
mov esp, ebp
pop ebp
ret 4

Function at 0x10034070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x100340a1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10034090
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x10034480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x100344b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100344a0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10059b27
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.10071d55
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x10059b66
sub eax, 1
je 0x10059b61
sub eax, 1
je 0x10059b5d
xor eax, eax
leave
ret
push 3
jmp 0x10059b68
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x1005c180
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c67d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x100cb018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.10044607
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x1008dd64
push eax
call fcn.10044951
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 8
push eax
call fcn.10044a96
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 9
push eax
call fcn.1004499c
add esp, 0x10
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1005c260
push eax
call fcn.100693c4
add esp, 4
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x1005c27b
push eax
call fcn.100693c4
add esp, 4
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1005c296
push eax
call fcn.100693c4
add esp, 4
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1005c2b1
push eax
call fcn.100693c4
add esp, 4
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1005c2cc
push eax
call fcn.100693c4
add esp, 4
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x1005c2e7
push eax
call fcn.100693c4
add esp, 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], 0
call fcn.1004465f
mov dword [esi], vtable.boost::archive::codecvt_null_wchar_t_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4