joyce8/EMBER2024-capa huggingface dataset:
Function at 0x115e444
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x12853b2
call fcn.01160168
sub esp, 0xa8
mov eax, dword [0x12cf8c8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0xb4], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [ebp - 4], 1
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], edi
mov byte [ebp - 0xac], bl
call fcn.0105d49a
mov byte [ebp - 4], 3
mov ecx, 0x12d2398
mov dword [ebp - 0xa8], ebx
call fcn.0107c455
push eax
lea ecx, [ebp - 0xa0]
call fcn.0103966b
mov byte [ebp - 4], 4
push dword [0x12cf8a4]
lea ecx, [ebp - 0xa0]
call fcn.010524f5
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 4], 5
push 0xf003f
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x9c]
push 0x80000001
call fcn.010449e2
test eax, eax
jne 0x115e59f
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x28
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0xa4], ebx
push ebx
jmp 0x115e571
inc dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
call fcn.0115c981
mov byte [ebp - 4], 6
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0115cd5c
test eax, eax
jl 0x115e556
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.0115d809
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x98]
call fcn.0115c9af
push 0x28
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
call edi
test eax, eax
je 0x115e51d
push dword [0x12cf8bc]
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x9c]
call fcn.01044a1e
test eax, eax
je 0x115e59f
mov dword [ebp - 0xa8], ebx
push ebx
push dword [ebp - 0xa8]
mov ecx, esi
call fcn.0115dcae
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c]
call fcn.010449c4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
call fcn.010328fa
mov byte [ebp - 4], 2
cmp byte [ebp - 0xac], bl
je 0x115e5e2
lea ecx, [ebp - 0xb0]
call fcn.0105d4cd
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret

Function at 0x115e651
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
push 0xd
xor eax, eax
mov edx, ecx
pop ecx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
push 0x1073
push dword [edx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
leave
ret 0x10
Function at 0x115f87c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1012
push dword [esi + 4]
mov dword [ebp - 0x14], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x115f8cf
cmp dword [ebp - 0xc], 8
jne 0x115f8cf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x115f8cf
push dword [ebp - 8]
mov ecx, esi
call fcn.0115f8e2
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
inc eax
pop esi
leave
ret 0x10
Function at 0x115ff8b
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x100fbc8
call fcn.011605e4
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x115ffc8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x115ffc8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x115ffe0
cmp eax, 0x20b
je 0x115ffcd
mov dword [ebp - 0x1c], ebx
jmp 0x115fff4
cmp dword [ecx + 0x84], 0xe
jbe 0x115ffc8
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x115ffee
cmp dword [ecx + 0x74], 0xe
jbe 0x115ffc8
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x12d53b4], 0xffffffff
or dword [0x12d53b8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x12d3290]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x12d328c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x12d53b0], eax
call fcn.01195a58
cmp dword [0x12cf8d0], ebx
jne 0x116004f
push fcn.01195a58
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.011605cb
push 0x12ce09c
push 0x12ce098
call sub.msvcrt.dll__initterm
mov eax, dword [0x12d3288]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x12d3284]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x12ce094
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x11600e5
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x11600b9
cmp al, 0x22
jne 0x11600ab
cmp byte [esi], 0x22
jne 0x11600c2
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x11600cc
cmp al, 0x20
jbe 0x11600be
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x11600f0
movzx eax, word [ebp - 0x50]
jmp 0x11600f3
cmp byte [esi], 0x20
jbe 0x11600c2
inc esi
mov dword [ebp - 0x20], esi
jmp 0x11600e5
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1160110
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1160145
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0116061f
ret
Function at 0x116098f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x12d3294], 0
push esi
jne 0x11608fd
call fcn.011607f4
test eax, eax
je 0x1160940
mov eax, dword [0x12d3294]
cmp eax, 1
jne 0x116091e
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1160940
pop esi
ret
push eax
call dword [0x12d329c]
test eax, eax
jne 0x1160988
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1160944
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x12d3294]
call dword [0x12d329c]
mov edi, eax
test edi, edi
je 0x1160969
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1160985
mov edi, esi
add esi, 0xff0
push edi
push dword [0x12d3294]
call dword [0x12d3298]
add edi, 0x10
cmp edi, esi
jb 0x1160971
mov eax, edi
pop edi
pop esi
ret
jmp 0x11608ea
Function at 0x116d3e3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x12cf8c8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
mov dword [ebp - 4], eax
jne 0x116d402
mov eax, 0x80004003
jmp 0x116d465
mov ecx, esi
call fcn.010477a3
fld qword [ebp + 8]
push ecx
push ecx
fstp qword [esp]
push 0x1010cb8
push 0x100
mov ecx, esi
call fcn.0103299e
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
push 0xffffffffffffffff
mov ecx, esi
call fcn.01032a0b
push 4
lea eax, [ebp - 0xc]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x116d453
mov eax, 0x80004005
jmp 0x116d465
push 0x1005244
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.010753ce
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.0115fe73
leave
ret 0xc

Function at 0x116f6bd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1e0
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], eax
je 0x116f7f1
mov dword [ebp - 0x1c0], esi
call fcn.0115c723
test eax, eax
je 0x116f6fc
mov dword [ebp - 0x1c0], 0x20
lea eax, [ebp - 0x1e0]
push eax
push ebx
mov word [edi], si
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x116f7f1
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x1e0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x116f7f1
cmp word [ebp - 0x1d0], 0x76c
jb 0x116f7f1
push 0x50
lea eax, [ebp - 0x1bc]
push eax
mov word [edi], si
push 0x1f
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
je 0x116f784
push dword [ebp + 0xc]
lea eax, [ebp - 0x1bc]
push edi
push eax
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x1c0]
push esi
call ebx
test eax, eax
jne 0x116f79e
push dword [ebp + 0xc]
lea eax, [ebp - 0x1d0]
push edi
push 0
push eax
mov eax, dword [ebp - 0x1c0]
or eax, 1
push eax
push esi
call ebx
cmp byte [ebp + 0x14], 0
je 0x116f7f1
push 0x50
lea eax, [ebp - 0x11c]
push eax
push 0x1003
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
push 0x3b
lea eax, [ebp - 0x7a]
mov word [ebp - 0x7c], 0x20
push eax
je 0x116f7d2
lea eax, [ebp - 0x11c]
push eax
jmp 0x116f7d4
push 0
lea eax, [ebp - 0x1d0]
push eax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.0118c2ac
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0115fe73
leave
ret 0x10
Function at 0x116f805
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
je 0x116f8f9
push edi
xor edi, edi
call fcn.0115c723
test eax, eax
je 0x116f837
push 0x20
pop edi
and word [ebx], 0
lea eax, [ebp - 0x1cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x116f8f8
cmp word [ebp - 0x1cc], 0x76c
jb 0x116f8f8
push 0x50
lea eax, [ebp - 0x11c]
push eax
push 0x1f
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
push dword [ebp + 0xc]
push ebx
je 0x116f891
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x1cc]
push eax
push 0
jmp 0x116f89e
push 0
lea eax, [ebp - 0x1cc]
push eax
or edi, 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
cmp byte [ebp + 0x14], 0
je 0x116f8f8
push 0x50
lea eax, [ebp - 0x1bc]
push eax
push 0x1003
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
push 0x3b
lea eax, [ebp - 0x7a]
mov word [ebp - 0x7c], 0x20
push eax
je 0x116f8d9
lea eax, [ebp - 0x1bc]
push eax
jmp 0x116f8db
push 0
lea eax, [ebp - 0x1cc]
push eax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.0118c2ac
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0115fe73
leave
ret 0x10
Function at 0x116fa33
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1285f68
call fcn.01160168
sub esp, 0x1c
mov eax, dword [0x12cf8c8]
push ebx
push esi
xor ebx, ebx
test byte [0x12d3328], 1
mov dword [ebp - 0x10], eax
push edi
jne 0x116fa79
or dword [0x12d3328], 1
mov dword [ebp - 4], ebx
mov eax, dword [0x12ce0a0]
push 0x1298541
mov dword [0x12d3324], eax
call fcn.011602a8
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x116fa8c
mov eax, dword [0x12d3324]
cmp dword [eax - 8], ebx
jne 0x116fb4c
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov word [ebp - 0x24], bx
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa
lea eax, [ebp - 0x24]
push eax
push 0x1e
mov edi, 0x400
push edi
call esi
test eax, eax
jle 0x116fac4
push 0xa
lea eax, [ebp - 0x24]
push eax
call fcn.0116f9b9
test eax, eax
jne 0x116fad3
push 0x1010df0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 2
lea eax, [ebp - 0x28]
push eax
push 0x25
push edi
call esi
test eax, eax
je 0x116fb47
mov esi, 0x12d3324
push 0x1010c40
mov ecx, esi
call fcn.01032977
cmp word [ebp - 0x28], 0x30
je 0x116fb06
push 0x1010e10
mov ecx, esi
call fcn.010524f5
push 0x1010e08
mov ecx, esi
call fcn.010524f5
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.010524f5
mov edi, 0x1010dfc
push edi
mov ecx, esi
call fcn.010524f5
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.010524f5
push edi
mov ecx, esi
call fcn.010524f5
mov eax, dword [0x12d3324]
cmp dword [eax - 8], ebx
jne 0x116fb4c
mov eax, 0x100355c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret 4
Function at 0x116fb6a
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1285f85
call fcn.01160168
sub esp, 0x30
mov eax, dword [0x12cf8c8]
push ebx
xor ebx, ebx
test byte [0x12d3330], 1
mov dword [ebp - 0x10], eax
push esi
jne 0x116fbaf
or dword [0x12d3330], 1
mov dword [ebp - 4], ebx
mov eax, dword [0x12ce0a0]
push 0x1298550
mov dword [0x12d332c], eax
call fcn.011602a8
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x116fbc2
mov eax, dword [0x12d332c]
cmp dword [eax - 8], ebx
jne 0x116fccb
push edi
xor eax, eax
mov word [ebp - 0x24], bx
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
mov word [ebp - 0x38], bx
lea edi, [ebp - 0x36]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 5
lea eax, [ebp - 0x24]
push eax
push 0x1e
mov edi, 0x400
push edi
call esi
test eax, eax
jle 0x116fc0a
push 0xa
lea eax, [ebp - 0x24]
push eax
call fcn.0116f9b9
test eax, eax
jne 0x116fc19
push 0x1010df0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 5
lea eax, [ebp - 0x38]
push eax
push 0xe
push edi
call esi
test eax, eax
jg 0x116fc37
push 0x1005244
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 2
lea eax, [ebp - 0x3c]
push eax
push 0x25
push edi
call esi
test eax, eax
pop edi
je 0x116fcc6
mov esi, 0x12d332c
push 0x1010e4c
mov ecx, esi
call fcn.01032977
cmp word [ebp - 0x3c], 0x30
je 0x116fc6b
push 0x1010e10
mov ecx, esi
call fcn.010524f5
push 0x1010e44
mov ecx, esi
call fcn.010524f5
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.010524f5
push 0x1010e34
mov ecx, esi
call fcn.010524f5
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.010524f5
push 0x1010e24
mov ecx, esi
call fcn.010524f5
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.010524f5
push 0x1010e14
mov ecx, esi
call fcn.010524f5
mov eax, dword [0x12d332c]
cmp dword [eax - 8], ebx
jne 0x116fccb
mov eax, 0x100355c
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret 4
Function at 0x116fdcf
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1285fd7
call fcn.01160168
sub esp, 0x9c
mov eax, dword [0x12cf8c8]
and word [ebp - 0x1c], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jl 0x116fec4
and word [ebp - 0xa0], 0
push 0x20
xor eax, eax
pop ecx
lea edi, [ebp - 0x9e]
rep stosd dword es:[edi], eax
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0xa4], eax
and dword [ebp - 4], 0
push dword [ebp + 0x14]
lea eax, [ebp - 0xa4]
push 0x1010ebc
push eax
call fcn.01032a3e
fld qword [ebp + 8]
add esp, 4
fstp qword [esp]
push dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0103966b
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
push eax
push 0x1005244
lea ecx, [ebp - 0xa8]
call fcn.010753ce
lea eax, [ebp - 0xa8]
push eax
mov ecx, esi
call fcn.01044b40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.010328fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.010328fa
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0115fe73
leave
ret 0x10
Function at 0x117002f
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1286021
call fcn.01160168
sub esp, 0xac
mov eax, dword [0x12cf8c8]
push ebx
xor ebx, ebx
test byte [0x12d3340], 1
mov dword [ebp - 0x10], eax
jne 0x1170076
or dword [0x12d3340], 1
mov dword [ebp - 4], ebx
mov eax, dword [0x12ce0a0]
push 0x1298523
mov dword [0x12d333c], eax
call fcn.011602a8
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [0x12d333c]
cmp dword [eax - 8], ebx
jne 0x11701ae
push edi
call fcn.0116f90c
push eax
lea ecx, [ebp - 0xb4]
call fcn.0103966b
mov dword [ebp - 4], 1
push 0x27
pop ecx
xor eax, eax
mov word [ebp - 0xb0], bx
lea edi, [ebp - 0xae]
rep stosd dword es:[edi], eax
push 0x50
stosw word es:[edi], ax
lea eax, [ebp - 0xb0]
push eax
push 0x1003
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jg 0x117011e
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 2
push dword [ebp - 0xb4]
lea eax, [ebp - 0xb8]
push 0x1010ee8
push eax
call fcn.01032a3e
add esp, 0xc
lea eax, [ebp - 0xb8]
push eax
mov ecx, 0x12d333c
call fcn.01044b40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.010328fa
jmp 0x117019e
push esi
lea eax, [ebp - 0xb0]
mov esi, 0x12d333c
push eax
mov ecx, esi
call fcn.01032977
mov edi, 0x100355c
push edi
push 0x1006808
mov ecx, esi
call fcn.010753ce
push edi
push 0x1010ee0
mov ecx, esi
call fcn.010753ce
push 0x1010edc
push 0x1010ed8
mov ecx, esi
call fcn.010753ce
push edi
push 0x1010ee4
mov ecx, esi
call fcn.010753ce
push ebx
push dword [ebp - 0xb4]
mov ecx, esi
call fcn.01044ca4
cmp eax, ebx
jle 0x117019d
inc eax
push eax
push dword [ebp - 0xb4]
mov ecx, esi
call fcn.01044ca4
cmp eax, ebx
jle 0x117019d
push ebx
push eax
mov ecx, esi
call fcn.01061742
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.010328fa
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x12d333c]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret
Function at 0x1171b7d
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
add ecx, 0xffffffe4
neg esi
sbb esi, esi
and esi, ecx
cmp dword [ebp + 0x14], 0
mov dword [ebp - 4], 1
je 0x1171bee
push ebx
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [ebp + 0xc]
or dword [ebp - 8], 0xffffffff
mov edi, eax
push edi
call fcn.01055a45
test eax, eax
je 0x1171be1
lea ecx, [edi + 1]
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
call fcn.01032a0b
cmp dword [ebp - 8], edi
pop edi
pop ebx
jge 0x1171c15
and dword [ebp - 4], 0
jmp 0x1171c05
mov eax, dword [ebp + 0xc]
push dword [eax]
lea ecx, [esi + 4]
push dword [ebp + 8]
call fcn.0103260a
test eax, eax
mov dword [ebp - 4], eax
jne 0x1171c3e
push dword [ebp + 0x14]
lea ecx, [esi + 0x1c]
push dword [ebp + 8]
call fcn.0117166f
jmp 0x1171c3e
cmp dword [ebp + 0x18], 0
je 0x1171c3e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax - 8]
cmp eax, dword [ebp + 0x1c]
jle 0x1171c3e
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x14]
lea ecx, [esi + 0x1c]
push dword [ebp + 8]
call fcn.011716a7
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop esi
leave
ret 0x18
Function at 0x1171cff
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1286239
call fcn.01160168
push ecx
mov eax, dword [0x12ce0a0]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call dword [eax + 0x14]
push dword [ebp - 0x10]
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi]
lea ebx, [esi + 0x28]
push ebx
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push 0x66f
lea ecx, [esi + 0x1c]
call fcn.01171b7d
mov eax, dword [esi + 0x40]
cmp eax, 1
je 0x1171d69
cmp eax, 3
je 0x1171d69
cmp eax, 4
je 0x1171d69
xor eax, eax
jmp 0x1171d6c
xor eax, eax
inc eax
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esi + 0x34], eax
jne 0x1171d88
push 0
push 2
push dword [edi]
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x40]
cmp eax, 3
je 0x1171d99
cmp eax, 4
je 0x1171d99
xor eax, eax
jmp 0x1171d9c
xor eax, eax
inc eax
test eax, eax
mov dword [esi + 0x38], eax
push 0
jne 0x1171da9
push 6
jmp 0x1171dab
push 1
push dword [edi]
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x40]
cmp eax, 3
je 0x1171dc7
cmp eax, 4
je 0x1171dc7
xor eax, eax
jmp 0x1171dca
xor eax, eax
inc eax
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x1171ddf
push eax
push 7
push dword [edi]
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x44]
cmp eax, 0x10
mov ecx, 0x7f04
jne 0x1171df1
add ecx, 0xfffffffd
jmp 0x1171e07
cmp eax, 0x20
jne 0x1171dfd
mov ecx, 0x7f02
jmp 0x1171e07
cmp eax, 0x30
jne 0x1171e07
mov ecx, 0x7f03
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x671
push dword [edi]
mov dword [esi + 0x48], eax
call ebx
push 0
push dword [esi + 0x48]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
mov ecx, edi
call fcn.01061666
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fa
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x117a1d8
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], edi
je 0x117a203
test edi, edi
je 0x117a203
test ebx, ebx
jne 0x117a20d
mov eax, 0x80004003
jmp 0x117a2d5
and dword [ebp - 0x30], 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x20
shl eax, 1
mov dword [ebp - 0x40], esi
pop esi
mov dword [ebp - 0x44], eax
push esi
lea eax, [ebp - 0x24]
push eax
call fcn.0117a19a
test eax, eax
jl 0x117a2d5
lea eax, [ebp - 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x100355c
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x3c], esi
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x117a2ad
cmp dword [ebp - 0x28], 0
je 0x117a2ad
push dword [ebp - 0x2c]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
jne 0x117a282
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x8007000e
jmp 0x117a2d5
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x28]
mov dword [edx], ecx
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x117a2d2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x117a2bd
call esi
jmp 0x117a2c9
call esi
and eax, 0xffff
or eax, 0x80070000
and dword [edi], 0
and dword [ebx], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0115fe73
leave
ret 0xc