joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488760
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
movzx eax, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
call edx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
cmp eax, 0xcc
jge 0x4887a1
movzx ecx, byte [ebp - 1]
cmp ecx, 0x97
je 0x4887a1
movzx edx, byte [ebp - 1]
cmp edx, 0x68
jne 0x488769
movzx eax, byte [ebp - 1]
cmp eax, 0x97
jne 0x4887b0
xor al, al
jmp 0x4887b2
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x492250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x492265
lea eax, [ecx + 0xc]
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x492276
mov eax, 3
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x492285
lea eax, [edx + 2]
pop esi
pop ebp
ret 8
push edi
push 0
lea edi, [ebp + 8]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
cmp eax, 1
jne 0x4922b8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4922ae
mov dword [esi + 0xc], 1
pop esi
pop ebp
ret 8
add dword [esi + 8], eax
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0xe
pop esi
pop ebp
ret 8

Function at 0x4922d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x4922e5
lea eax, [ecx + 0xc]
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4922f6
mov eax, 3
pop esi
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x492305
lea eax, [edx + 2]
pop esi
pop ebp
ret 8
push edi
push 0
lea edi, [ebp + 8]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
cmp eax, 1
jne 0x492338
mov eax, dword [ebp + 8]
test eax, eax
jne 0x49232e
mov dword [esi + 0xc], 1
pop esi
pop ebp
ret 8
add dword [esi + 8], eax
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, 0xe
pop esi
pop ebp
ret 8
Function at 0xab0f50
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0xb67890]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00aadbb0
add esp, 4
movzx edx, al
test edx, edx
je 0xab0fe1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00b11a30
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0xab0fdf
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0xab0fdf
jmp 0xab0fe1
jmp 0xab0f63
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00b10e32
mov esp, ebp
pop ebp
ret
Function at 0xac3b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0xac3b8c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0xac3bd3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00b107ae
add esp, 8
test eax, eax
jne 0xac3bd1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0xac3bd5
jmp 0xac3b83
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xae5d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0xae5d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0xae5d67
mov edx, dword [0xb7de38]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0xae5d5b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xae5d40
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0xae5d69
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0xae8bf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb3f767
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0xb67890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00ae7b30
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00ae7b30
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00ae7b30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00ae84f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00ae84f0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00ae84f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0xae8ec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb3f857
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0xb67890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00ae7a60
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00ae7a60
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00ae7a60
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00ae8510
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00ae8510
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00ae8510
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0xaead00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb4006a
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0xb67890]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x14], 0x8000
mov dword [ebp - 0x10], 0xb6a24c
mov byte [ebp - 0x45], 0
lea eax, [ebp - 0x45]
push eax
push 0x8000
lea ecx, [ebp - 0x44]
call fcn.00ac4920
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xa8]
call fcn.00ae9840
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb4]
call fcn.00ae8230
push eax
push 0x8000
push 0
lea ecx, [ebp - 0x44]
call fcn.00ac4980
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00ae8230
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00ae8230
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.00aa56c0
push 0
lea ecx, [ebp - 0x44]
call fcn.00ac4980
push eax
lea ecx, [ebp - 0x34]
call fcn.00aaa330
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.00af1d80
add esp, 8
movzx eax, al
test eax, eax
je 0xaeae33
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00ae8530
mov edx, dword [ebp - 0xac]
or edx, 1
mov dword [ebp - 0xac], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00aaa3c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00ac4960
mov eax, dword [ebp + 8]
jmp 0xaeae83
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
call fcn.00aee3b0
mov ecx, dword [ebp - 0xac]
or ecx, 1
mov dword [ebp - 0xac], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00aaa3c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00ac4960
mov eax, dword [ebp + 8]
jmp 0xaeae83
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00b10e32
mov esp, ebp
pop ebp
ret
Function at 0xaeb520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb40221
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0xb67890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00ae8230
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0xaeb5d6
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.00ac4920
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.00ac4980
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00ae8230
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00ac4980
push eax
mov ecx, dword [ebp + 8]
call fcn.00aaa330
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00ac4960
mov eax, dword [ebp + 8]
jmp 0xaeb5f5
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00aaa380
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0xaeb9f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb40311
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0xb67890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0xaeba98
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00ac4920
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00ac4980
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00ac4980
push eax
mov ecx, dword [ebp + 8]
call fcn.00aaa330
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00ac4960
mov eax, dword [ebp + 8]
jmp 0xaebab3
mov ecx, dword [ebp + 8]
call fcn.00abd860
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0xaec470
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb40581
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0xb67890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00ac4920
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.00ac4980
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00ac4980
push eax
mov ecx, dword [ebp + 8]
call fcn.00aaa330
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00ac4960
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0xb00160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb435e8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0xb67890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0xb7e650]
test eax, eax
jne 0xb00195
call fcn.00b00050
movzx ecx, byte [0xb7e649]
test ecx, ecx
jne 0xb0024f
movzx edx, byte [0xb7e648]
test edx, edx
jne 0xb0024f
cmp dword [0xb7e754], 0
je 0xb001f8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0xb7e754]
push ecx
call fcn.00aebf30
add esp, 8
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x186
mov eax, dword [0xb7e754]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0xb7e754]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0xb0024f
push 0xb7e650
lea ecx, [ebp - 0x74]
call fcn.00ae7a60
mov dword [ebp - 4], 0
push 0x10001
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00aebd40
add esp, 0x10
xor edx, edx
cmp eax, 2
sete dl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00aa56c0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0xb0024f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0xb0a280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0xb0a28f
mov eax, dword [eax + 4]
jmp 0xb0a292
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0xb0a31b
push esi
mov esi, dword [0xb7eaf0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0xb0a300
cmp eax, 3
je 0xb0a300
cmp eax, 0x7b
je 0xb0a300
cmp eax, 0x57
je 0xb0a300
cmp eax, 0xa1
je 0xb0a300
cmp eax, 0x35
je 0xb0a300
cmp eax, 0x20
jne 0xb0a2f5
mov eax, dword [0xb7eaf4]
mov dword [ecx], eax
mov edx, dword [0xb7eaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0xb7eaf4]
mov dword [ecx], eax
mov edx, dword [0xb7eaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0xb7eaf4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0xb7eaf8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0xb0a348
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0xb0a360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0xb0a36f
mov eax, dword [eax + 4]
jmp 0xb0a372
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xb0a3fb
push esi
mov esi, dword [0xb7eaf0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0xb0a3e0
cmp eax, 3
je 0xb0a3e0
cmp eax, 0x7b
je 0xb0a3e0
cmp eax, 0x57
je 0xb0a3e0
cmp eax, 0xa1
je 0xb0a3e0
cmp eax, 0x35
je 0xb0a3e0
cmp eax, 0x20
jne 0xb0a3d5
mov eax, dword [0xb7eaf4]
mov dword [ecx], eax
mov edx, dword [0xb7eaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0xb7eaf4]
mov dword [ecx], eax
mov edx, dword [0xb7eaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0xb7eaf4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0xb7eaf8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0xb0a428
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0xb10e32
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xb67890]
jne 0xb10e3c
repz ret
jmp fcn.00b1c58c
Function at 0xb1cbef
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0xb68200]
je 0xb1cc0a
inc edi
cmp edi, 0x17
jb 0xb1cbfb
cmp edi, 0x17
jae 0xb1cd8a
push ebp
push 3
call fcn.00b2a0ae
cmp eax, 1
pop ecx
je 0xb1cd56
push 3
call fcn.00b2a0ae
test eax, eax
pop ecx
jne 0xb1cc3e
cmp dword [0xb67950], 1
je 0xb1cd56
cmp ebx, 0xfc
je 0xb1cd89
push 0xb6c09c
mov ebx, 0x314
push ebx
mov ebp, 0xb7ef80
push ebp
call fcn.00b0ffda
add esp, 0xc
test eax, eax
je 0xb1cc74
push esi
push esi
push esi
push esi
push esi
call fcn.00b1170c
add esp, 0x14
push 0x104
mov esi, 0xb7ef99
push esi
push 0
mov byte [0xb7f09d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0xb1ccb8
push 0xb6c084
push 0x2fb
push esi
call fcn.00b0ffda
add esp, 0xc
test eax, eax
je 0xb1ccb8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00b1170c
add esp, 0x14
push esi
call fcn.00b10800
inc eax
cmp eax, 0x3c
pop ecx
jbe 0xb1ccfd
push esi
call fcn.00b10800
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0xb7f294
push 0xb6c080
sub ecx, eax
push ecx
push eax
call fcn.00b10e41
add esp, 0x14
test eax, eax
je 0xb1ccfd
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00b1170c
add esp, 0x14
jmp 0xb1ccff
xor esi, esi
push 0xb6a8f8
push ebx
push ebp
call fcn.00b0ff69
add esp, 0xc
test eax, eax
je 0xb1cd1f
push esi
push esi
push esi
push esi
push esi
call fcn.00b1170c
add esp, 0x14
push dword [edi*8 + 0xb68204]
push ebx
push ebp
call fcn.00b0ff69
add esp, 0xc
test eax, eax
je 0xb1cd41
push esi
push esi
push esi
push esi
push esi
call fcn.00b1170c
add esp, 0x14
push 0x12010
push 0xb6c058
push ebp
call fcn.00b29ef1
add esp, 0xc
jmp 0xb1cd89
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0xb1cd89
cmp ebp, 0xffffffff
je 0xb1cd89
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0xb68204]
push dword [esi]
call fcn.00b10800
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret