joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065670
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100656a3
push esi
call fcn.10073a10
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1006569c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10065729
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10065712
mov eax, dword [esi + 8]
test eax, eax
je 0x100656c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1006570e
cmp eax, 2
je 0x10065712
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100656ba
cmp eax, 3
je 0x100656ed
cmp eax, 1
jne 0x100656ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100656ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100656ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10065750
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10065738
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10065750
add esp, 4
pop esi
ret

Function at 0x10065fc0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x10065fe1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x10065fe1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x10065fe1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess_1]
Function at 0x10066430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1006643b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1006653e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x101844c8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101844c8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101844c8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101844c8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101844c8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101844c8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101844c8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x101844c8]
xor eax, edx
inc ecx
dec edi
jne 0x10066456
pop edi
test esi, esi
je 0x10066560
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x101844c8]
xor eax, edx
inc ecx
dec esi
jne 0x10066542
pop esi
pop ebx
not eax
ret
Function at 0x1008265d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10082667
add dword [esp], 5
retf

Function at 0x10082825
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x1008282f
add dword [esp], 5
retf

Function at 0x100828ba
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x1008293a
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x1008293a
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x1008293a
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x1008293a
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x1008292b
test bl, bl
je 0x1008293e
dec eax
mov eax, edx
jmp 0x10082917
inc ebp
test al, al
je 0x1008293e
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x10082912
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x100828fe
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x10082938
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x100829ab
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x100829b5
add dword [esp], 5
retf
Function at 0x100879bd
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x100879df
mov eax, 0xfffffffd
jmp 0x10087abf
mov ebx, dword [0x109586f2]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10087a8d
mov ebx, dword [0x109586f2]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10087a2e
mov ebx, dword [0x109586f2]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10087a2e
mov eax, 1
jmp 0x10087a33
mov eax, 0
test eax, eax
je 0x10087a5f
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10087a48
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x109586f2]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10087ab5
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10087abf
mov esp, ebp
pop ebp
ret 4

Function at 0x10087c3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10087cef
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x1008825a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.1011cf40
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1008829f
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x101a8548
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.1008704e
add esp, 8
cmp eax, 0
jne 0x1008831a
call fcn.1008839e
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x109586fa]
test ebx, ebx
je 0x100882dd
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov dword [0x109586fa], eax
mov eax, dword [0x109586fa]
test eax, eax
je 0x10088301
push eax
mov ebx, eax
call fcn.10083a28
inc eax
push eax
call fcn.1011af46
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10088314
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10088355
push 0x202
push 0x402beab
push 6
call fcn.1011af52
add esp, 0xc
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10088368
mov eax, 0x101a8548
push eax
push 1
mov ebx, 0x170
call fcn.1011cf80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10088386
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10088397
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1008839e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.1011cf40
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100883e3
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10088418
push 0x36
push 0x402bec1
push 6
call fcn.1011af52
add esp, 0xc
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1008842b
mov eax, 0x101a8548
push eax
push 1
mov ebx, 0x170
call fcn.1011cf80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10088449
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1008845a
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1008845f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.1011cf40
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100884a4
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100884d9
push 0x36
push 0x402beac
push 6
call fcn.1011af52
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x100884f5
push eax
mov ebx, eax
call fcn.10083a28
inc eax
push eax
call fcn.1011af46
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100884fa
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1008850b
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x10088873
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10087c3c
test eax, eax
je 0x100888b6
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x100888b6
cmp word [eax], 0x5a4d
jne 0x100888b6
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x100888b6
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10087d0e
mov eax, dword [ebp + 8]
jmp 0x100888cf
mov esp, ebp
pop ebp
ret 4
Function at 0x1008b5f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.1011cf40
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1008b639
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1008b671
push 0x36
push 0x4010eb0
push 6
call fcn.1011af52
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x1008b68d
push eax
mov ebx, eax
call fcn.10083a28
inc eax
push eax
call fcn.1011af46
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1008b692
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1008b6a3
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1008d4e4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x1008d4ee
add dword [esp], 5
retf
Function at 0x10091b86
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x10091bbe
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x10091bac
mov al, 1
jmp 0x10091c1d
cmp dword [ebx + 0x54], ecx
jne 0x10091bb5
mov al, 2
jmp 0x10091c1d
cmp dword [ebx + 0x7c], ecx
jne 0x10091c1d
mov al, 3
jmp 0x10091c1d
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x10091bd3
mov al, 4
jmp 0x10091c1d
cmp ecx, 5
jne 0x10091bf3
cmp ebx, 0
jne 0x10091be1
mov al, 5
jmp 0x10091c1d
cmp ebx, 1
jne 0x10091bea
mov al, 6
jmp 0x10091c1d
cmp ebx, 2
jne 0x10091bf3
mov al, 7
jmp 0x10091c1d
cmp ecx, 6
jne 0x10091c1b
cmp ebx, 0
jne 0x10091c01
mov al, 8
jmp 0x10091c1d
cmp ebx, 1
jne 0x10091c08
mov al, 9
cmp ebx, 2
jne 0x10091c0f
mov al, 0xa
cmp ebx, 3
jne 0x10091c16
mov al, 0xb
cmp ebx, 4
jne 0x10091c1d
mov al, 0xc
pop ebx
leave
ret

Function at 0x10091c2e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10091c5a
add dword [esp], 5
retf

Function at 0x10091ced
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x10091cf7
add dword [esp], 5
retf

Function at 0x10092fb5
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10092fe1
add dword [esp], 5
retf

Function at 0x100930a7
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x100930b1
add dword [esp], 5
retf
Function at 0x1009694e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], esp
mov eax, dword [0x10958732]
push eax
push 0x24
call fcn.1011af46
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x10096a03
push 0
push 0x4010cd5
push 6
call fcn.1011af52
add esp, 0xc
mov ebx, dword [ebp - 8]
push ebx
mov edi, dword [ebp - 0xc]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.1011af4c
add esp, 4
mov ebx, dword [0x10958732]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp word [ebx], 6
je 0x10096abe
mov ebx, dword [0x10958732]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp word [ebx], 9
je 0x10096abe
mov ebx, dword [0x10958732]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp word [ebx], 0xa
je 0x10096abe
xor eax, eax
jmp 0x10096ac3
mov eax, 1
mov dword [0x10958736], eax
mov eax, dword [0x10958736]
jmp 0x10096ad2
mov esp, ebp
pop ebp
ret
Function at 0x10098469
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.1011cf40
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100984ae
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100984e3
push 0x36
push 0x4012a84
push 6
call fcn.1011af52
add esp, 0xc
push 0x101a856e
push dword [ebp - 4]
mov ecx, 2
call fcn.10083a93
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10098503
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10098514
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x1009b8a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x1009b8d8
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x1009b8c6
mov al, 1
jmp 0x1009b937
cmp dword [ebx + 0x54], ecx
jne 0x1009b8cf
mov al, 2
jmp 0x1009b937
cmp dword [ebx + 0x7c], ecx
jne 0x1009b937
mov al, 3
jmp 0x1009b937
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1009b8ed
mov al, 4
jmp 0x1009b937
cmp ecx, 5
jne 0x1009b90d
cmp ebx, 0
jne 0x1009b8fb
mov al, 5
jmp 0x1009b937
cmp ebx, 1
jne 0x1009b904
mov al, 6
jmp 0x1009b937
cmp ebx, 2
jne 0x1009b90d
mov al, 7
jmp 0x1009b937
cmp ecx, 6
jne 0x1009b935
cmp ebx, 0
jne 0x1009b91b
mov al, 8
jmp 0x1009b937
cmp ebx, 1
jne 0x1009b922
mov al, 9
cmp ebx, 2
jne 0x1009b929
mov al, 0xa
cmp ebx, 3
jne 0x1009b930
mov al, 0xb
cmp ebx, 4
jne 0x1009b937
mov al, 0xc
pop ebx
leave
ret
Function at 0x100a337d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.100a3457
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100a33b8
add dword [esp], 5
retf
Function at 0x100a37f6
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x100a3843
mov al, cl
cmp al, 0x61
jb 0x100a381e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x100a3843
mov al, cl
cmp al, 0x61
jb 0x100a3836
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x100a380f
cmp edx, dword [esp + 0x18]
je 0x100a3853
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x100a3808
xor eax, eax
jmp 0x100a3856
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x100a385e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x100a3945
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x100a394b
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x100a38aa
cmp al, 0x61
jb 0x100a38a2
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x100a3895
cmp edx, dword [esp + 0x14]
je 0x100a38ba
dec ecx
jne 0x100a388a
xor eax, eax
jmp 0x100a3945
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x100a3945
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x100a3945
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x100a38f6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x100a3905
jmp 0x100a38ed
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.100a37f6
test eax, eax
je 0x100a3945
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x100a3940
cmp al, 0x61
jb 0x100a3938
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x100a392b
call fcn.100a385e
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x100a3963
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x100a3963
sub edx, ecx
mov ecx, edx
jmp 0x100a38ba
xor eax, eax
jmp 0x100a3945
Function at 0x100a5bf4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x100a5c2c
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x100a5c1a
mov al, 1
jmp 0x100a5c8b
cmp dword [ebx + 0x54], ecx
jne 0x100a5c23
mov al, 2
jmp 0x100a5c8b
cmp dword [ebx + 0x7c], ecx
jne 0x100a5c8b
mov al, 3
jmp 0x100a5c8b
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x100a5c41
mov al, 4
jmp 0x100a5c8b
cmp ecx, 5
jne 0x100a5c61
cmp ebx, 0
jne 0x100a5c4f
mov al, 5
jmp 0x100a5c8b
cmp ebx, 1
jne 0x100a5c58
mov al, 6
jmp 0x100a5c8b
cmp ebx, 2
jne 0x100a5c61
mov al, 7
jmp 0x100a5c8b
cmp ecx, 6
jne 0x100a5c89
cmp ebx, 0
jne 0x100a5c6f
mov al, 8
jmp 0x100a5c8b
cmp ebx, 1
jne 0x100a5c76
mov al, 9
cmp ebx, 2
jne 0x100a5c7d
mov al, 0xa
cmp ebx, 3
jne 0x100a5c84
mov al, 0xb
cmp ebx, 4
jne 0x100a5c8b
mov al, 0xc
pop ebx
leave
ret

Function at 0x100a6c9a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x1095876a]
push ebx
call fcn.1011af4c
add esp, 4
mov eax, 0x101a8540
mov dword [0x1095876a], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1011af4c
add esp, 4
mov eax, 0x101a8540
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x100a6df5
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x100a6d07
push 0x34
push 0x402becc
push 6
call fcn.1011af52
add esp, 0xc
mov eax, dword [0x1095876a]
push eax
push eax
mov ebx, eax
call fcn.1008336e
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.1011af46
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1011af4c
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x1095876a]
call fcn.10083685
jmp 0x100a6d4e
mov esp, ebp
pop ebp
ret 8

Function at 0x100a6f11
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x100a7027
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x100a6f4c
push 0
push 0x402bece
push 6
call fcn.1011af52
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x100a6f54
mov esp, ebp
pop ebp
ret 4