joyce8/EMBER2024-capa huggingface dataset:
Function at 0x861b68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404fe4
lea ebx, [ebp - 0x158]
xor eax, eax
push ebp
push 0x861dca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15c]
push eax
mov eax, dword [ebp - 8]
call fcn.00404dfc
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00405054
mov eax, dword [ebp - 0x15c]
mov edx, 0x861de0
call fcn.00404f40
jne 0x861c0c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00404dfc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405054
mov eax, dword [ebp + 8]
call fcn.00404b34
mov byte [ebp - 0x15], 1
push ebx
lea eax, [ebp - 0x160]
mov ecx, 0x861dec
mov edx, dword [ebp - 8]
call fcn.00404e48
mov eax, dword [ebp - 0x160]
call fcn.00404ff4
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x861d8c
xor eax, eax
push ebp
push 0x861d42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404dac
mov eax, dword [ebp - 0x164]
mov edx, 0x861df8
call fcn.00404f40
je 0x861d19
lea eax, [ebp - 0x168]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404dac
mov eax, dword [ebp - 0x168]
mov edx, 0x861e04
call fcn.00404f40
je 0x861d19
push dword [ebp - 8]
push 0x861de0
lea eax, [ebp - 0x16c]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404dac
push dword [ebp - 0x16c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ebc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040ab84
test eax, eax
je 0x861d19
cmp byte [ebp - 0x15], 0
je 0x861cf8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00861e08
test al, al
jne 0x861cfc
xor eax, eax
jmp 0x861cfe
mov al, 1
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x861d19
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404b88
call fcn.004045a0
jmp 0x861d8c
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x861c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x861d49
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x861dd1
lea eax, [ebp - 0x170]
mov edx, 4
call fcn.00404b58
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.00404b58
lea eax, [ebp - 0x14]
call fcn.00404b34
lea eax, [ebp - 8]
call fcn.00404b34
ret
Function at 0x8626fc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404fe4
xor eax, eax
push ebp
push 0x862973
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404dfc
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.00405054
mov eax, dword [ebp - 0x14c]
mov edx, 0x86298c
call fcn.00404f40
jne 0x8627a6
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404dfc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405054
mov eax, dword [ebp - 4]
mov edx, edi
call fcn.00404f40
je 0x862938
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x862998
mov edx, dword [ebp - 4]
call fcn.00404e48
mov eax, dword [ebp - 0x150]
call fcn.00404ff4
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x862938
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404dac
mov eax, dword [ebp - 0x154]
mov edx, 0x8629a4
call fcn.00404f40
je 0x8628cb
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404dac
mov eax, dword [ebp - 0x158]
mov edx, 0x8629b0
call fcn.00404f40
je 0x8628cb
push dword [ebp - 4]
push 0x86298c
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404dac
push dword [ebp - 0x15c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404ebc
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 8]
call fcn.0040aabc
mov eax, dword [ebp - 0x160]
push eax
lea edx, [ebp - 0x164]
mov eax, edi
call fcn.0040aabc
mov edx, dword [ebp - 0x164]
pop eax
call fcn.00404f40
je 0x8628cb
mov eax, dword [ebp - 0x148]
and eax, 0x10
cmp eax, 0x10
jne 0x8628c0
lea eax, [ebp - 8]
mov edx, 0x862998
call fcn.00404e04
mov edx, dword [ebp - 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x8627ec
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404bcc
lea edx, [ebp - 8]
mov eax, esi
call fcn.008624a4
mov edx, dword [ebp - 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jle 0x862916
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00404b88
jmp 0x862938
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.0040b5bc
mov edx, dword [ebp - 0x168]
mov ecx, dword [ebp - 4]
mov eax, esi
call fcn.008626fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x86297a
lea eax, [ebp - 0x168]
mov edx, 6
call fcn.00404b58
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00404b58
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b58
ret
Function at 0x862dec
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 0x144]
xor eax, eax
push ebp
push 0x862f24
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x148]
mov ecx, 0x862f3c
mov edx, esi
call fcn.00404e48
mov eax, dword [ebp - 0x148]
call fcn.00404ff4
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x862efb
xor eax, eax
push ebp
push 0x862ef4
push dword fs:[eax]
mov dword fs:[eax], esp
test dword [edi], 0x10
jbe 0x862eba
cmp byte [edi + 0x2c], 0x2e
jne 0x862e7c
mov al, byte [edi + 0x2d]
test al, al
je 0x862ecf
sub al, 0x2e
je 0x862ecf
push esi
lea eax, [ebp - 0x150]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00404dac
push dword [ebp - 0x150]
push 0x862f48
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.00404ebc
mov edx, dword [ebp - 0x14c]
mov eax, ebx
call fcn.00862dec
jmp 0x862ecf
mov eax, dword [edi + 0x1c]
mov edx, eax
neg eax
add eax, dword [edi + 0x20]
xor edx, edx
add dword [ebx + 0x38], eax
adc dword [ebx + 0x3c], edx
inc dword [ebx + 0x40]
push edi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x862e63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x862efb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x862f2b
lea eax, [ebp - 0x150]
call fcn.00404b34
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00404b58
ret
Function at 0x8765c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x87662b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x8aa39c]
cmp dword [eax], 1
jne 0x8765f6
mov eax, dword [ebp - 4]
call fcn.0047c0d8
mov ebx, eax
jmp 0x876621
mov eax, dword [ebp - 4]
call fcn.004054c8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x87660d
test al, 0x10
je 0x876611
xor ebx, ebx
jmp 0x876613
mov bl, 1
test bl, bl
jne 0x876621
mov eax, dword [ebp - 4]
call fcn.0047c0d8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87663f
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x8775a4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x877688
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x8775cd
push 9
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x8775df
mov byte [ebp - 1], 1
jmp 0x87767e
mov eax, dword [0x8aa39c]
cmp dword [eax], 2
jne 0x8775f3
mov eax, dword [0x8a9644]
cmp dword [eax], 4
jg 0x87761b
mov eax, dword [0x8aa39c]
cmp dword [eax], 1
jne 0x877667
mov eax, dword [0x8a9644]
cmp dword [eax], 4
jg 0x87761b
mov eax, dword [0x8a9644]
cmp dword [eax], 4
jne 0x877667
mov eax, dword [0x8a9e64]
cmp dword [eax], 0
jle 0x877667
mov byte [ebp - 1], 0
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x877673
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
jmp 0x877673
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x877692
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x877de0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x877e1b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf0], 0x80
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x877e25
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x877e30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x877e6b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf1], 0x80
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x877e75
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x877e80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x877ebb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xef], 0x80
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x877ec5
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x877ed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x877f6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xef], 0x80
jne 0x877f09
test byte [ebp - 0x5d], 0x80
jne 0x877f09
xor eax, eax
jmp 0x877f0b
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x877f60
test byte [ebp - 0xf0], 0x80
je 0x877f21
mov byte [ebp - 1], 0
test byte [ebp - 0x5f], 0x80
je 0x877f2b
mov byte [ebp - 1], 0
test byte [ebp - 0x5e], 0x80
je 0x877f35
mov byte [ebp - 1], 0
test byte [ebp - 0xf1], 0x80
je 0x877f42
mov byte [ebp - 1], 0
test byte [ebp - 0x61], 0x80
je 0x877f4c
mov byte [ebp - 1], 0
test byte [ebp - 0x60], 0x80
je 0x877f56
mov byte [ebp - 1], 0
test byte [ebp - 0x5c], 0x80
je 0x877f60
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x877f74
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8782f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405880
xor eax, eax
push ebp
push 0x878445
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x878425
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004034fc
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.004034fc
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], si
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004054c8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x878390
mov dword [ebp - 8], 0xffffffff
jmp 0x87841b
test bl, bl
je 0x87841b
xor eax, eax
mov dword [ebp - 8], eax
push 0x32
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x8783bd
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
jmp 0x87839d
xor edx, edx
push ebp
push 0x8783e2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x8783d8
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8783ec
xor edx, edx
push ebp
push 0x878411
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x878407
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87841b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87842f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87844c
lea eax, [ebp - 4]
call fcn.00405268
ret

Function at 0x8789a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00405880
xor eax, eax
push ebp
push 0x878a49
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x878a21
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x878a60
push dword [ebp - 4]
push 0x878a60
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004055a8
push esi
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004054c8
push eax
push 0x878a64
push ebx
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x878a2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x878a50
lea eax, [ebp - 0xc]
call fcn.00405268
lea eax, [ebp - 4]
call fcn.00405268
ret
Function at 0x878d9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x878e10
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x878e24]
mov byte [ebp - 1], al
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf0], 0x80
je 0x878dde
mov al, byte [0x878e28]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
test byte [ebp - 0xf1], 0x80
je 0x878df2
mov al, byte [0x878e2c]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
test byte [ebp - 0xef], 0x80
je 0x878e06
mov al, byte [0x878e30]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x878e1a
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x87c490
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x87c55f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x87c53a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405268
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
call sub.kernel32.dll_GetComputerNameW
cmp dword [ebp - 4], 0
jbe 0x87c530
cmp dword [ebp - 4], 0x3e8
jae 0x87c530
mov edx, dword [ebp - 4]
inc edx
lea eax, [ebp - 8]
call fcn.0040583c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.004054c8
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x87c530
mov eax, dword [ebp - 8]
call fcn.004054c8
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004053d0
mov eax, dword [ebp - 0xc]
call fcn.004054d8
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040583c
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004052a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87c544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87c566
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405280
ret

Function at 0x87c570
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x87c63f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x87c61a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405268
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
call sub.advapi32.dll_GetUserNameW
cmp dword [ebp - 4], 0
jbe 0x87c610
cmp dword [ebp - 4], 0x3e8
jae 0x87c610
mov edx, dword [ebp - 4]
inc edx
lea eax, [ebp - 8]
call fcn.0040583c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.004054c8
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x87c610
mov eax, dword [ebp - 8]
call fcn.004054c8
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004053d0
mov eax, dword [ebp - 0xc]
call fcn.004054d8
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040583c
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004052a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87c624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87c646
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405280
ret
Function at 0x87e414
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0xbc]
mov edx, dword [0x86a46c]
call fcn.004058a0
xor eax, eax
push ebp
push 0x87e4fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
test eax, eax
je 0x87e4dd
cmp dword [ebp - 8], 0
jbe 0x87e4dd
lea eax, [ebp - 0xbc]
mov edx, 0xb4
call fcn.00408750
xor eax, eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xac], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xb0], eax
mov edx, 0x14
lea eax, [ebp - 0xa8]
xor ecx, ecx
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 0x50], ecx
add eax, 4
dec edx
jne 0x87e490
lea eax, [ebp - 0xbc]
push eax
push 0x87e358
call sub.user32.dll_EnumWindows
mov esi, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x58]
mov edx, 0x13
lea eax, [ebp - 0x54]
mov edi, dword [eax]
cmp ecx, edi
jge 0x87e4cc
mov esi, dword [eax - 0x50]
mov ecx, edi
add eax, 4
dec edx
jne 0x87e4c1
test ecx, ecx
jle 0x87e4dd
test esi, esi
jbe 0x87e4dd
mov dword [ebp - 4], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87e503
lea eax, [ebp - 0xbc]
mov edx, dword [0x86a46c]
call fcn.00405970
ret
Function at 0x87eabc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404fe4
xor eax, eax
push ebp
push 0x87eb30
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x87eb10
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404ff4
push eax
push 0x87eb40
push ebx
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87eb1a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x87eb37
lea eax, [ebp - 4]
call fcn.00404b34
ret

Function at 0x87f124
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x87f16c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.0041d124
push 0
push 0x87f17c
call sub.user32.dll_FindWindowA
test eax, eax
je 0x87f162
push ebx
push eax
call sub.user32.dll_GetWindowRect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x87f176
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x882d18
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x882d45
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x882d54
mov edx, ebx
mov eax, 1
call fcn.004326fc
mov edx, eax
mov eax, 5
call fcn.00432610
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8846d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405880
xor eax, eax
push ebp
push 0x88480c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x8847d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, 0x884820
call fcn.004052c8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp dword [eax + 0x7e4], 6
jl 0x88478e
lea eax, [ebp - 0x10]
mov edx, 0x884830
call fcn.004052c8
lea eax, [ebp - 8]
mov edx, 0x884854
call fcn.004052c8
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x884874
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004055a8
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.004054c8
push eax
mov eax, dword [ebp - 8]
call fcn.004054c8
push eax
mov eax, dword [ebp - 0x14]
call fcn.004054c8
push eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00455b24
push eax
call sub.shell32.dll_ShellExecuteW
mov bl, 1
test bl, bl
jne 0x8847cd
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0047bdec
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404dc4
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404ff4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00455b24
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8847e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x884813
lea eax, [ebp - 0x1c]
call fcn.00405268
lea eax, [ebp - 0x18]
call fcn.00404b34
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405280
ret

Function at 0x884878
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405880
xor eax, eax
push ebp
push 0x884913
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x8848ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x884928
call fcn.004052c8
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004054c8
push eax
mov eax, dword [ebp - 8]
call fcn.004054c8
push eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00455b24
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8848f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x88491a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405280
ret