joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4410a2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51fc
call fcn.00443570
push 0x43f9ac
call fcn.0043ffa6
pop ecx
mov dword [ebp - 0x51e8], eax
push 0x43f9dc
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
add eax, 7
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x50e0]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x43f9e0
mov eax, dword [ebp + 8]
add eax, 7
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x51e4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x190]
push eax
push 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x50e4], eax
cmp dword [ebp - 0x50e4], 0
je 0x44121b
mov word [ebp - 0x51f8], 2
lea eax, [ebp - 0x50e0]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x51fc], eax
cmp dword [ebp - 0x51fc], 0
je 0x44121b
mov eax, dword [ebp - 0x51fc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x51f4], eax
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x51f6], ax
push 0x10
lea eax, [ebp - 0x51f8]
push eax
push dword [ebp - 0x50e4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x44121b
push dword [ebp + 0xc]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x50e0]
push eax
lea eax, [ebp - 0x51e4]
push eax
push 0x43f9e4
lea eax, [ebp - 0x4fe0]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 0x4fe0]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x4fe0]
push eax
push dword [ebp - 0x50e4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x44121b
push dword [ebp - 0x50e4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 1
pop eax
jmp 0x44122f
push dword [ebp - 0x50e4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
leave
ret

Function at 0x441c34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x441cf4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jle 0x441d36
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441d1e
cmp dword [ebp - 4], 0xffffffff
jne 0x441d22
xor al, al
jmp 0x441d38
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
jmp 0x441cf8
mov al, 1
leave
ret
Function at 0x441d3a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jle 0x441d7c
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441d64
cmp dword [ebp - 4], 0xffffffff
jne 0x441d68
xor al, al
jmp 0x441d7e
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
jmp 0x441d3e
mov al, 1
leave
ret

Function at 0x441d80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x400
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441dad
cmp dword [ebp - 4], 0xffffffff
jne 0x441db2
jmp 0x441e39
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
movsx eax, byte [eax]
and eax, 1
test eax, eax
je 0x441de4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
mov al, byte [eax]
or al, 2
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x40c]
mov byte [ecx], al
xor eax, eax
jmp 0x441edf
push dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.00441cf4
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x441e22
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
mov al, byte [eax]
or al, 2
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x40c]
mov byte [ecx], al
xor eax, eax
jmp 0x441edf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
movsx eax, byte [eax]
and eax, 1
test eax, eax
je 0x441d84
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
movsx eax, byte [eax]
and eax, 1
test eax, eax
je 0x441e66
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
mov al, byte [eax]
or al, 2
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x40c]
mov byte [ecx], al
jmp 0x441edd
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
mov al, byte [eax]
or al, 1
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x40c]
mov byte [ecx], al
push 2
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_shutdown]
push 2
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40c]
movsx eax, byte [eax]
and eax, 2
test eax, eax
jne 0x441ed2
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x441eb2
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
xor eax, eax
leave
ret 4
Function at 0x441f23
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x441f57
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00441ee3
add esp, 0x14
jmp 0x441fb2
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.00441c5d
pop ecx
pop ecx
mov word [ebp - 0x14], 2
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x441fb2
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 5
push dword [ebp + 8]
call fcn.00441ee3
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
leave
ret
Function at 0x441fe1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x442005
xor al, al
jmp 0x4421fd
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 5
jne 0x44201b
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 2]
test eax, eax
je 0x442022
xor al, al
jmp 0x4421fd
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov cl, byte [ecx + 1]
mov byte [eax], cl
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 3]
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x18], al
cmp byte [ebp - 0x18], 1
je 0x442057
cmp byte [ebp - 0x18], 3
je 0x44207a
cmp byte [ebp - 0x18], 4
je 0x442171
jmp 0x4421e9
push 4
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x442075
xor al, al
jmp 0x4421fd
jmp 0x4421ed
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x442099
xor al, al
jmp 0x4421fd
movsx eax, byte [ebp - 4]
test eax, eax
jne 0x4420a8
xor al, al
jmp 0x4421fd
movsx eax, byte [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x4420c9
xor al, al
jmp 0x4421fd
movsx eax, byte [ebp - 4]
mov ecx, dword [ebp + 0xc]
and byte [ecx + eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4420ec
cmp dword [ebp - 0x10], 0
jne 0x442160
push 2
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x44210a
xor al, al
jmp 0x4421fd
mov dword [ebp - 0xc], 0x3000405
mov al, byte [ebp - 4]
mov byte [ebp + 8], al
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00441cf4
add esp, 0xc
movzx eax, al
test eax, eax
je 0x442159
movsx eax, byte [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00441cf4
add esp, 0xc
movzx eax, al
test eax, eax
je 0x442159
push 2
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.00441cf4
add esp, 0xc
xor al, al
jmp 0x4421fd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x4421ed
mov dword [ebp - 0xc], 0x4000805
push 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4421e5
push 2
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4421e5
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00441cf4
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4421e5
push 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00441cf4
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4421e5
push 2
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.00441cf4
add esp, 0xc
xor al, al
jmp 0x4421fd
xor al, al
jmp 0x4421fd
push 2
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.00441d3a
add esp, 0xc
leave
ret
Function at 0x44309d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
jmp 0x4430ad
push 0x4430a5
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 4]
push eax
push 0x43fbb3
push reloc.WS2_32.dll_accept
call sub.ADVAPI32.dll_RegCreateKeyA
test eax, eax
jne 0x443322
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x400
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x41cdf4
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x44331a
push 0x43fb40
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
jmp 0x443122
push 0x41cdf4
push 0x43fbb3
push 0x44311c
push 0x424df4
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x424df4
push reloc.WS2_32.dll_accept
call sub.ADVAPI32.dll_RegCreateKeyA
test eax, eax
jne 0x443302
jmp 0x443164
push 0x424df4
push 0x43fbec
push 0x44315b
push 0x42cdf4
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x42cdf4
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x41cdf4
lea eax, [ebp - 0x14]
push eax
push 0
push 0x43fbd2
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4431e3
push 0x41cdf4
push 0x43fbd2
push 0x44315b
push 0x42cdf4
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x42cdf4
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x41cdf4
lea eax, [ebp - 0x14]
push eax
push 0
push 0x43fbdb
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x443289
push 0x41cdf4
push 0x43fbdb
push 0x44315b
push 0x42cdf4
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x42cdf4
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x41cdf4
lea eax, [ebp - 0x14]
push eax
push 0
push 0x43fbe7
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x443289
push 0x41cdf4
push 0x43fbe7
push 0x44315b
push 0x42cdf4
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x42cdf4
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x41cdf4
lea eax, [ebp - 0x14]
push eax
push 0
push 0x43fb56
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4432fa
push 0x41cdf4
call sub.KERNEL32.DLL_lstrlenA
test eax, eax
je 0x4432fa
push eax
push 0x424df4
push 0x41cdf4
call fcn.00442bd9
push 0x424df4
push 0x43fb56
push 0x44315b
push 0x42cdf4
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x42cdf4
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
push 0x43fb4c
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
inc dword [ebp - 0xc]
jmp 0x4430df
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
leave
ret
Function at 0x443324
Capabilities:
Read .ini file

Disassembly:
jmp 0x44332f
push 0x41cdf4
push 0x400
push 0x434df4
push 0x43fb5f
push ebx
push 0x42cdf4
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
je 0x44337a
push 0x434df4
push ebx
push 0x443326
push 0x43d1f9
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x43d1f9
push dword [0x41cdf0]
call sub.KERNEL32.DLL_lstrcatA
ret

Function at 0x44342c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegCreateKeyA
test eax, eax
jne 0x443479
mov dword [ebp - 0xc], 0x2000
lea eax, [ebp - 0xc]
push eax
push 0x41cdf4
lea eax, [ebp - 8]
push eax
push 0
push 0x43fc33
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x443471
call fcn.0044337b
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegCloseKey
leave
ret 8
Function at 0x10001010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x1015d2e8
jmp 0x10001040
push 0xffffffffffffffff
push 0x1011e2a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
push edi
lea ecx, [esi + 8]
mov dword [esp + 0x10], esi
call fcn.10001c90
push edi
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], 0x10126610
call fcn.1001a900
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x38]
mov byte [esp + 0x2c], 1
call fcn.1001c7f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x50]
call fcn.1001c4e0
mov eax, dword [0x101267d4]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x8c], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 4], edi
mov dword [esi], 0x1012660c
mov dword [esi + 0x14], esi
mov dword [esi + 0x1c], esi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10005da0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x10162004]
test eax, eax
jne 0x10005dd9
push 0x104
push 0x10162008
mov dword [0x10162004], 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x10005dd9
push str.SysWow64
push 0x10162008
call fcn.1006247f
add esp, 8
mov eax, 0x10162008
ret

Function at 0x100092a0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x1011ea48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push eax
call fcn.1002c910
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call fcn.1002e3e0
push 0x10143a60
lea ecx, [esp + 0x18]
call fcn.1002e290
cmp eax, 0xffffffff
je 0x1000931a
push 0x10143a4c
lea ecx, [esp + 0x18]
call fcn.1002e290
cmp eax, 0xffffffff
je 0x10009307
push 0x10143a44
push 0x10143a4c
jmp 0x10009311
push 0x1016da48
push 0x10143a60
lea ecx, [esp + 0x1c]
call fcn.1002eff0
mov eax, dword [esp + 0x14]
push esi
xor esi, esi
mov cx, word [eax]
cmp cx, 0x61
jb 0x1000937f
cmp cx, 0x7a
ja 0x1000937f
cmp word [eax + 2], 0x3a
jne 0x1000937f
cmp word [eax + 4], 0x5c
jne 0x1000937f
lea ecx, [esp + 4]
push 3
push ecx
lea ecx, [esp + 0x20]
call fcn.1002f7f0
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1000936d
cmp eax, 2
je 0x1000936d
cmp eax, 5
je 0x1000936d
cmp eax, 6
jne 0x10009372
mov esi, 1
lea ecx, [esp + 4]
call fcn.1002d0b0
mov eax, dword [esp + 0x18]
mov ecx, dword [0x1016f218]
test ecx, ecx
je 0x100093a4
push eax
push esi
push str.IsLocalFile_bRet__d__wstrFile__s_
push str.SDFileImp
push 0xffffffffffffffff
push 0x1016e984
call fcn.100602c0
add esp, 0x18
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.1002d0b0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1000f250
Capabilities:
Get graphical window text

Disassembly:
call fcn.10075250
test eax, eax
je 0x1000f26f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x1000f2f0
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1000f2f0
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.10062117
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000f2f0
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x1000f2f0
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.10021f30
add esp, 0x10
test eax, eax
je 0x1000f2f0
push esi
call fcn.10062422
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x10019ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011f528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0x1388
lea eax, [esi + 0x10]
lea ecx, [esi + 4]
push 0
push eax
mov dword [eax], ecx
push 0
push 2
lea ecx, [esp + 0x1c]
mov dword [esi + 0x14], 0x10001cf0
call fcn.1001c4e0
push 0
lea edx, [esp + 8]
push 0
push edx
mov ecx, 0x1016dfa8
mov dword [esp + 0x54], 0
call fcn.1001d9b0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x38], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x40], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x44], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x50], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x54], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x58], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x5c], edx
mov dword [esi + 0x60], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.1001c560
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x1001a9e0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
jne 0x1001aa2d
mov eax, dword [esi + 8]
cmp dword [eax - 8], edi
je 0x1001aa2d
call fcn.1007d290
mov ecx, dword [esi + 8]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x1001aa2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001aa20
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
mov eax, edi
pop edi
pop esi
ret

Function at 0x1001ab90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1011f633
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x101267d4]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea edi, [esi + 4]
mov dword [edi], eax
mov dword [esi], 0x1012670c
mov eax, dword [0x101267d4]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov byte [esp + 0x24], 4
test eax, eax
je 0x1001ac02
call fcn.100aea30
push eax
lea ecx, [esp + 0x18]
push str.__lu
push ecx
call fcn.10030030
add esp, 0xc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1001ac23
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [esp + 0x14]
push str.__lu
push edx
call fcn.10030030
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1001ac44
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [esp + 0x10]
push str.__lu
push eax
call fcn.10030030
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1001ac65
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0xc]
push 0x1014600c
push ecx
call fcn.10030030
add esp, 0xc
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push edx
call fcn.1002c910
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
push str._s_s_s_s_s
push edi
mov byte [esp + 0x40], 5
call fcn.10030030
add esp, 0x1c
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 4
call fcn.1002d0b0
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call fcn.1002d0b0
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.1002d0b0
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.1002d0b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.1002d0b0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14