joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043cd
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push esi
mov ch, byte [eax + 3]
mov esi, dword [ebp + 8]
mov cl, byte [eax + 2]
push edi
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
xor edi, edi
movzx edx, byte [eax]
movzx ebx, byte [eax + 5]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dh, byte [eax + 7]
mov dl, byte [eax + 6]
movzx eax, byte [eax + 4]
shl edx, 8
or edx, ebx
shl edx, 8
or eax, edx
cmp dword [ebp + 0x14], edi
jne 0x40446a
mov edx, dword [esi]
test edx, edx
jle 0x4044c3
mov dword [ebp + 8], edx
mov edx, eax
mov ebx, eax
shr edx, 5
shl ebx, 4
xor edx, ebx
mov ebx, edi
and ebx, 3
add edx, eax
mov ebx, dword [esi + ebx*4 + 4]
add ebx, edi
sub edi, 0x61c88647
xor edx, ebx
add ecx, edx
mov edx, ecx
mov ebx, ecx
shr edx, 5
shl ebx, 4
xor edx, ebx
mov ebx, edi
shr ebx, 0xb
and ebx, 3
add edx, ecx
mov ebx, dword [esi + ebx*4 + 4]
add ebx, edi
xor edx, ebx
add eax, edx
dec dword [ebp + 8]
jne 0x404420
jmp 0x4044c3
mov edi, dword [esi]
mov edx, edi
imul edx, edx, 0x9e3779b9
test edi, edi
jle 0x4044c3
mov dword [ebp + 8], edi
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
add edi, ecx
mov ebx, dword [esi + ebx*4 + 4]
add ebx, edx
add edx, 0x61c88647
xor edi, ebx
sub eax, edi
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
and ebx, 3
add edi, eax
mov ebx, dword [esi + ebx*4 + 4]
add ebx, edx
xor edi, ebx
sub ecx, edi
dec dword [ebp + 8]
jne 0x40447b
mov esi, dword [ebp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [esi + 1], dl
mov byte [esi], cl
mov edx, ecx
mov byte [esi + 4], al
shr ecx, 0x18
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 8
mov byte [esi + 5], cl
mov ecx, eax
shr edx, 0x10
shr ecx, 0x10
shr eax, 0x18
mov byte [esi + 2], dl
mov byte [esi + 6], cl
mov byte [esi + 7], al
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xdd7440
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd744a
pushal
call 0xdd7450
pop ebp
sub ebp, 0x10
sub ebp, 0x9d7440
jmp 0xdd7466
mov eax, 0x9d7440
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c0
mov edx, 0x4af5efbf
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd747d
jmp 0xdd7490
xor al, 0x72
xor al, 0x36
cmp dword [edi + 0x7e3ebfbf], 0x47
mov edi, 0x72bcbfbf
pop es
mov ecx, 0x5bfbfbf
xchg edi, eax
mov edi, 0x5d48bfbf
mov esp, 0xb33e3477
mov edi, 0x7abcbfbf
out dx, eax
xor bl, bl
wait
inc ebx
mov ebx, 0x2ee3d79b
sahf
mov edi, 0xc45d5bd7
mov edi, 0xd79b93be
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4969f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c5dd0]
jne 0x496a00
repz ret
jmp fcn.0049af86

Function at 0x499190
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c5dd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004938d2
and dword [ebp - 0x14], 0
cmp dword [0x4c8cd4], 0
mov dword [ebp - 0x18], eax
jne 0x499243
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4992eb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a3020
push ebx
call edi
test eax, eax
je 0x4992eb
mov esi, dword [fcn.0048fc80]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c8cd4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c8cd8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c8cdc], eax
call edi
push eax
call esi
mov dword [0x4c8ce4], eax
test eax, eax
je 0x499243
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c8ce0], eax
mov eax, dword [0x4c8ce0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048fc84]
cmp eax, ecx
je 0x49929c
cmp dword [0x4c8ce4], ecx
je 0x49929c
push eax
call esi
push dword [0x4c8ce4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49929c
test ebx, ebx
je 0x49929c
call edi
test eax, eax
je 0x499293
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x499293
test byte [ebp - 8], 1
jne 0x49929c
or dword [ebp + 0x10], 0x200000
jmp 0x4992cf
mov eax, dword [0x4c8cd8]
cmp eax, dword [ebp - 0x18]
je 0x4992cf
push eax
call esi
test eax, eax
je 0x4992cf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4992cf
mov eax, dword [0x4c8cdc]
cmp eax, dword [ebp - 0x18]
je 0x4992cf
push eax
call esi
test eax, eax
je 0x4992cf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c8cd4]
call esi
test eax, eax
je 0x4992eb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4992ed
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004969f6
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001881
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001898
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x100018cd
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x100018c9
cmp edi, eax
jae 0x100018cd
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x100018bb
cmp edi, eax
jb 0x100018d1
xor eax, eax
jmp 0x100018db
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x10001b45
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10042058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
add edi, 4
mov eax, dword [edi]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x18], edi
je 0x10001b71
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [edi], esi
push 0x20
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.1001a850
add esp, 0xc
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], esi
call dword [section..data]
cmp dword [ebp + 8], esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], esi
mov ebx, closesocket
je 0x10001bd0
push dword [ebp + 8]
call edi
push esi
inc eax
cdq
push 2
push edx
push eax
call fcn.1002a6a0
mov ecx, eax
add eax, ebx
adc edx, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
jne 0x10001bd0
cmp eax, 0xffffffff
jbe 0x10001bd5
mov dword [ebp - 0xc], esi
jmp 0x10001c14
cmp ecx, 0x400
jg 0x10001bf4
push ecx
call fcn.1000244e
test al, al
pop ecx
je 0x10001bf4
mov eax, dword [ebp - 0x10]
call fcn.10022970
mov eax, esp
jmp 0x10001bff
push dword [ebp - 0x10]
lea esi, [ebp - 8]
call fcn.100023f4
push dword [ebp - 0x14]
mov esi, eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.100024c3
mov dword [ebp - 0xc], eax
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x10001c3a
push dword [ebp + 0xc]
call edi
push esi
inc eax
cdq
push 2
push edx
push eax
call fcn.1002a6a0
mov edi, eax
add eax, ebx
adc edx, esi
mov dword [ebp - 0x1c], edx
jne 0x10001c3a
cmp eax, 0xffffffff
jbe 0x10001c3e
xor eax, eax
jmp 0x10001c75
cmp edi, 0x400
jg 0x10001c5c
push edi
call fcn.1000244e
test al, al
pop ecx
je 0x10001c5c
mov eax, edi
call fcn.10022970
mov eax, esp
jmp 0x10001c65
push edi
lea esi, [ebp - 8]
call fcn.100023f4
push dword [ebp - 0x14]
mov esi, eax
push edi
push dword [ebp + 0xc]
call fcn.100024c3
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x10001cad
cmp eax, esi
je 0x10001cad
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
push ecx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x10001ca9
mov eax, dword [ebp - 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 8], edi
call fcn.10019940
cmp edi, esi
pop ecx
jne 0x10001c96
mov eax, ebx
jmp 0x10001cd0
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [ebp - 8], esi
je 0x10001ccd
mov eax, dword [ebp - 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 8], edi
call fcn.10019940
cmp edi, esi
pop ecx
jne 0x10001cba
or eax, 0xffffffff
lea esp, [ebp - 0x4c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019691
leave
ret 8
Function at 0x10001d32
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push edi
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.10002395
mov ecx, edi
call fcn.100023a9
xor ebx, ebx
cmp eax, ebx
jge 0x10001d51
push eax
call fcn.10001653
lea edi, [esi + 0x28]
mov ecx, edi
call fcn.10002395
mov ecx, edi
call fcn.100023a9
cmp eax, ebx
jl 0x10001d4b
or dword [esi + 0x40], 0xffffffff
mov dword [esi], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x2710
cmp dword [0x10044c48], ebx
je 0x10001da0
push 0x10044ab8
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x10044c48], eax
pop edi
mov eax, esi
pop ebx
ret

Function at 0x10001ea4
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x10001eb6
mov al, 1
jmp 0x10001f2a
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
mov byte [ebp - 1], 1
jne 0x10001ec6
xor al, al
jmp 0x10001f2a
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x10001f24
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10001f1e
push 0x2710
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10001f21
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.1001a850
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x10001f24
mov dword [esi + 0x48], eax
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
mov byte [esi + 0x44], al
pop ebx
leave
ret 8
Function at 0x10001f2f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x10001f56
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x10001ffc
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x10001f74
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x10001ffb
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x10001fbb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x10001fed
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x10001ff0
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 8], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x10001fe7
mov bl, 1
jmp 0x10001ff0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 8
Function at 0x10002001
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10002025
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x100020ed
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x10002047
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x100020ec
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [edi], ebx
mov dword [ebp - 4], ebx
call fcn.1001a850
lea eax, [esi + 0x10]
add esp, 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x100020aa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x100020de
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100020e1
lea eax, [ebp - 4]
push eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x100020d8
mov bl, 1
jmp 0x100020e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
leave
ret 4

Function at 0x10003cae
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor esi, esi
push esi
push esi
push 1
push esi
call edi
push esi
push esi
push 1
push esi
mov dword [ebp - 4], eax
call edi
mov edi, eax
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x10003d4e
cmp edi, esi
je 0x10003d47
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0x40]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x10003de9
push esi
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
call fcn.1001aa41
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x10003d32
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
mov esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10003d43
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov esi, dword [ebp - 8]
mov eax, esi
jmp 0x10003d5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
je 0x10003d59
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10008813
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edi, edi
push edi
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 2
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x1000884c
call fcn.1000888f
jmp 0x10008889
mov ecx, dword [ebp - 0xc]
push 4
pop edx
push edi
push ecx
push edi
push edi
push edx
push eax
mov dword [esi + 4], ecx
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
cmp eax, edi
mov dword [esi], eax
jne 0x10008887
call fcn.1000888f
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
mov eax, ebx
jmp 0x10008889
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x1000cf48
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x10042058]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x150], 0
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
lea ecx, [ebp - 0x148]
push ecx
push eax
mov dword [ebp - 0x14c], eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x150], eax
push 0x80
lea eax, [ebp - 0x108]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
lea eax, [ebp - 0x160]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x170]
push eax
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x170]
push eax
push dword [esi + 4]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x168]
push 1
push dword [ebp - 0x150]
mov dword [ebp - 0x160], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0x150]
call esi
push 0x826
mov ebx, eax
lea eax, [ebp - 0x160]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x150]
call dword [sym.imp.USER32.dll_DrawTextW]
push ebx
push dword [ebp - 0x150]
call esi
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x14c]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10019691
leave
ret

Function at 0x1000fb29
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x10042058]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.1001a850
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000fb82
cmp dword [ebp - 0x7c], 5
jae 0x1000fb7e
cmp dword [ebp - 0x7c], 4
jne 0x1000fb82
cmp dword [ebp - 0x78], 0x5a
jb 0x1000fb82
xor eax, eax
jmp 0x1000fb85
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.10019691
add ebp, 0x98
leave
ret
Function at 0x100109be
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x10042058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x100
lea eax, [ebp - 0x204]
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x3b
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x10010a1c
cmp dword [esi + 0x20], 0
je 0x10010a08
add eax, 2
jmp 0x10010a12
and word [eax], 0
lea eax, [ebp - 0x204]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, esi
call fcn.10010daf
push 0xffffffffffffffff
push 0
mov ebx, esi
call fcn.100108ac
call fcn.10010c21
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10019691
leave
ret

Function at 0x100119b9
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x10035c48
call fcn.10033558
mov ebx, ecx
cmp byte [ebx + 0x84], 0
jne 0x10011a81
xor esi, esi
push esi
push 1
push 3
push esi
push esi
push closesocket
push dword [ebx + 0x5c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x10011a81
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x10011a78
lea eax, [edi + 2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10011a78
push 2
lea eax, [esi + edi]
push 0
push eax
call fcn.1001a850
add esp, 0xc
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10011a68
and dword [ebp - 4], 0
mov dword [ebx + 0x80], esi
mov byte [ebx + 0x84], 1
add ebx, 0x60
push ebx
push esi
call fcn.100102e3
pop ecx
pop ecx
jmp 0x10011a78
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100335fd
ret
Function at 0x10012563
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov esi, eax
lea eax, [esi - 0x20]
neg esi
sbb esi, esi
and esi, eax
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], 1
je 0x100125e2
push dword [ebp + 8]
push dword [esi + 4]
call ebx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
or dword [ebp - 8], 0xffffffff
mov dword [ebp + 0xc], eax
push eax
mov eax, edi
call fcn.10008737
test eax, eax
je 0x100125d4
mov ecx, dword [ebp + 0xc]
inc ecx
push ecx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 8], eax
mov eax, dword [edi]
test eax, eax
je 0x100125cd
push eax
call fcn.1001a3a9
pop ecx
mov edx, edi
call fcn.1000166b
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
jge 0x1001261c
and dword [ebp - 4], 0
jmp 0x100125f7
push dword [edi]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1001261c
push 0xffffffffffffffff
add esi, 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebp + 8]
mov eax, esi
add esi, 0xffffffe0
neg eax
sbb eax, eax
and eax, esi
push dword [eax + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8