joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x4031d0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.004016b0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x401666
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40165c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40165c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040183d
add esp, 8
call fcn.00401150
lea eax, [ebp - 5]
push eax
push 0
push 1
push 0x13
call dword [0x4063f8]
lea eax, [ebp - 0xc]
push eax
push 6
push 0
push 0
push 0
push 0xc0000420
call dword [0x4063f4]
mov ecx, dword [ebp - 4]
add esp, 0x28
xor ecx, ebp
call fcn.004017fc
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5a07b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x143000]
push edi
jmp 0x5a07ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5a07d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a07c0
mov eax, 1
add ebx, ebx
jne 0x5a07e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5a07f4
jne 0x5a0813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a0813
dec eax
add ebx, ebx
jne 0x5a0800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5a07d8
add ebx, ebx
jne 0x5a080f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5a0865
xor ecx, ecx
sub eax, 3
jb 0x5a082b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5a089a
sar eax, 1
mov ebp, eax
jmp 0x5a0836
add ebx, ebx
jne 0x5a0836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a0804
inc ecx
add ebx, ebx
jne 0x5a0844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5a0804
add ebx, ebx
jne 0x5a0851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5a0846
jne 0x5a0862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5a0846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5a0884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5a0876
jmp 0x5a07c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5a0884
add edi, ecx
jmp 0x5a07c6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5a08a2
cmp byte [edi], 0x11
jne 0x5a08a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5a08a7
lea edi, [esi + 0x199000]
mov eax, dword [edi]
or eax, eax
je 0x5a091f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25b2b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25b42c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5a08d4
mov ecx, edi
jns 0x5a0903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x25b430]
or eax, eax
je 0x5a0919
mov dword [ebx], eax
add ebx, 4
jmp 0x5a08f1
call dword [esi + 0x25b440]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5a0950
cmp al, 0xef
ja 0x5a0943
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5a0925
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5a0932
mov ebp, dword [esi + 0x25b434]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5a0984
sub esp, 0xffffff80
jmp 0x420577
Function at 0x4a76a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..rdata
lea edi, [esi - 0xa1000]
push edi
jmp 0x4a76ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a76c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a76b0
mov eax, 1
add ebx, ebx
jne 0x4a76d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a76c8
jne 0x4a76e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a76c8
xor ecx, ecx
sub eax, 3
jb 0x4a76f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a776a
mov ebp, eax
add ebx, ebx
jne 0x4a7703
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4a7710
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4a7734
inc ecx
add ebx, ebx
jne 0x4a7720
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a7715
jne 0x4a7731
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a7715
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a7754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a7745
jmp 0x4a76b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a7754
add edi, ecx
jmp 0x4a76b6
pop esi
mov edi, esi
mov ecx, 0x281
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a7772
cmp byte [edi], 6
jne 0x4a7772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a7777
lea edi, [esi + 0xa5000]
mov eax, dword [edi]
or eax, eax
je 0x4a77ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbd9ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbda64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a77a4
mov ecx, edi
jns 0x4a77d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbda6c]
or eax, eax
je 0x4a77e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4a77c1
call dword [esi + 0xbda68]
mov ebp, dword [esi + 0xbda70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a7823
sub esp, 0xffffff80
jmp 0x40368c
Function at 0x10002417
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1005faeb
call fcn.1005f648
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x18e0
cmp dword [ebp - 0x24], 0x859
push edi
mov dword [ebp - 0x10], esp
jge 0x100024a6
call fcn.10047415
push eax
push 0x10068a40
push str.in.txt
call fcn.100479fc
call fcn.10047415
add eax, 0x20
push eax
push 0x10068a4c
push str.out.txt
call fcn.100479fc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push str._d__d__d
call fcn.100472db
mov edx, dword [ebp - 0x28]
add esp, 0x28
add edx, dword [ebp - 0x2c]
xor ecx, ecx
jmp 0x10002494
mov eax, edx
cdq
idiv dword [ebp - 0x18]
add edx, eax
add ecx, eax
cmp edx, dword [ebp - 0x18]
jge 0x1000248a
push ecx
push 0x10068a64
call fcn.10047752
pop ecx
pop ecx
cmp byte [ebp + 0xc], 0
je 0x100024c3
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x28af
cmp dword [ebp - 0x24], 0x2c0b
jle 0x1000252c
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x30], eax
mov esi, eax
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x1007ba38
or eax, esi
cdq
push edx
push eax
call fcn.10005547
inc edi
cmp edi, 0x200f
jl 0x100024ea
inc ebx
cmp ebx, 0x5a5e
jl 0x100024e8
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x3f36
jl 0x100024dd
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4502
jl 0x100024d8
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000254a
push 0x8b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x257f
jge 0x100024b2
mov edx, str.yoepdpbrq_rdc_fnwb_vslk_srmvzgqpy
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x100024b2

Function at 0x10002e06
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fb25
call fcn.1005f648
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x2503
mov esi, edx
cmp dword [ebp - 0x14], 0x28ea
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
jle 0x10002e5d
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x1007ba38
xor eax, ebx
cdq
push edx
push eax
call fcn.10005547
inc esi
cmp esi, 0x143e
jl 0x10002e37
inc ebx
cmp ebx, 0x7833
jl 0x10002e35
mov esi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2389
jge 0x10002e9b
mov edx, str.azqpcx_xiwe_ikjhbd
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x10002e9b
cmp byte [ebp + 0x18], 0
je 0x10002eaa
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add dword [edi], eax
jmp 0x10002eca
mov dword [esi], 0
cmp dword [esi], 3
jge 0x10002eca
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xe60f951
inc dword [esi]
cmp dword [esi], 3
jl 0x10002eb8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002edd
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x1005fb2f
call fcn.1005f648
sub esp, 0x1c
push ebx
push esi
mov byte [ebp - 0x14], cl
mov eax, edx
mov dword [ebp - 0x28], 0x6929
cmp dword [ebp - 0x28], 0x6b32
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x10002f61
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x24], 0
mov eax, edi
cdq
idiv ebx
mov edi, dword [ebp - 0x24]
mov ebx, edx
mov eax, ebx
mov ecx, 0x1007ba38
and eax, edi
cdq
push edx
push eax
call fcn.10005547
inc edi
cmp edi, 0x1d89
jl 0x10002f26
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x5a99
jl 0x10002f18
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x49ce
jl 0x10002f13
mov eax, dword [ebp - 0x20]
cmp byte [ebp - 0x14], 0
je 0x10002fa1
cmp byte [eax], 0
je 0x10002f71
call fcn.10003303
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x679a
jge 0x10002f90
mov edx, str.xejler_vefuub_hgxvzam_edogtstcu_ffgpfdp_dqltuitvt_jvpg
mov ecx, 0x1007ba38
call fcn.100078f4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10002f71
mov dword [ebp - 0x24], 0x16e9
cmp dword [ebp - 0x24], 0x1757
jle 0x10003004
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x2a47
xor edi, edi
mov dword [ebp - 0x1c], 0x300
mov eax, edi
mov ecx, 0x1007ba38
cdq
push edx
push eax
call fcn.10005547
add edi, ebx
dec dword [ebp - 0x1c]
jne 0x10002fd0
mov edi, dword [ebp - 0x20]
add ebx, edi
dec dword [ebp - 0x18]
jne 0x10002fc7
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x4bc5
jl 0x10002fbe
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
push 0x5ecb
push ecx
push 0x140e
push 0x33e1
push 0x7cdc
push 0x18e6
mov edx, 0x32e0
mov ecx, 0x6e86
call fcn.100034d7
and dword [ebp - 4], 0
add esp, 0x1c
cmp dword [ebp - 0x24], 0x14a1
jge 0x10002f71
mov edx, str.nzbpun_zcbtogu_zplzfiiz_djwqj_yzzkur_bsp_whkdlsv_couj_xje_sjlk_depiyyt_otzemzmv
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x10002f71
Function at 0x10009dea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10009e77
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10009e2a
push 0x8b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10009e75
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10009e58
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10009e75
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000184c
mov dword [eax], 0xb54c5f6b
jmp 0x10009e4d
jmp 0x10009e9d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0
push 0x24cc
push dword [ebp - 0x24]
push 0x3c30
call fcn.10009cb6
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1000d8d2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000d930
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
push 0x2c19
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.1000d9a5
add esp, 0x24
jmp 0x1000d9a1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000d956
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000d9a1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000d984
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1000d9a1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.1000184c
mov dword [eax], 0xf0ea75c9
jmp 0x1000d979
mov esp, ebp
pop ebp
ret
Function at 0x10015b86
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100601ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10015bed
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x24]
push 0x2ee7
push dword [ebp - 0x28]
push 0x57a3
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
call fcn.10015d05
add esp, 0x1c
jmp 0x10015cf4
mov dword [ebp - 0x1c], 0x7da
mov dword [ebp - 0x38], str.mweibq_kum_ufufpxdd_onrnpvuxu_btnimyyr
cmp dword [ebp - 0x1c], 0x8da
jle 0x10015c7c
and dword [ebp - 0x14], 0
jmp 0x10015c11
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7188
jge 0x10015c6b
and dword [ebp - 0x18], 0
jmp 0x10015c27
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a00
jge 0x10015c69
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10002394
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10005527
push eax
call fcn.10047752
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1000551d
jmp 0x10015c20
jmp 0x10015c0a
push 0
push 0x23aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5dd
jge 0x10015c98
push dword [ebp - 0x38]
call fcn.10047752
pop ecx
jmp 0x10015cb4
or dword [ebp - 4], 0xffffffff
jmp 0x10015cbe
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10015cdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x10015cf4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001aa06
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1001aafc
mov dword [esp + 0x14], 0x5c76
cmp dword [esp + 0x14], 0x5f13
jle 0x1001aac2
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], edi
xor ebx, ebx
and dword [esp + 0x1c], 0
lea eax, [edi + esi]
mov esi, dword [esp + 0x1c]
mov ecx, ebx
mov edi, eax
mov dword [esp + 0x18], eax
sar edi, cl
mov eax, edi
lea ecx, [esp + 0x20]
and eax, esi
cdq
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001aa70
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10005baf
inc esi
cmp esi, 0x6536
jl 0x1001aa56
mov esi, dword [esp + 0x10]
inc ebx
mov edi, dword [esp + 0xc]
cmp ebx, 0x5d10
jl 0x1001aa40
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x7c46
jl 0x1001aa3e
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x59d2
jl 0x1001aa38
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [esp + 0x14], 0x5bb7
jge 0x1001aad7
push str.buypltzr_wltpn_lmvmyfp_xwbhw_nxaic_ofg
call fcn.10047752
pop ecx
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1001ab14
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xd5a519d8
inc dword [edx]
cmp dword [edx], 1
jl 0x1001aae8
jmp 0x1001ab14
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [edx]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c737
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
je 0x1001c84c
cmp byte [ebp + 0x20], 0
je 0x1001c785
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001c88a
push 1
push ecx
push 0x5172
mov ecx, 0x26a9
call fcn.1001cdb5
add esp, 0xc
jmp 0x1001c88a
mov dword [esp + 0x18], 0x37d2
cmp dword [esp + 0x18], 0x3b61
push 1
pop ebx
jle 0x1001c804
xor edi, edi
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0x1210
mov eax, esi
lea ecx, [esp + 0x28]
xor eax, edi
cdq
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c7c8
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push 0
push ebx
lea ecx, [esp + 0x30]
call fcn.10005baf
dec esi
dec dword [esp + 0x10]
jne 0x1001c7ae
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x2755
jl 0x1001c7a2
inc edi
cmp edi, 0x29a5
jl 0x1001c79c
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x18], 0x346c
jge 0x1001c819
push str.fvtehxta_dfmiqjku_ztehxjbln_ljlbpa_dpwdqk
call fcn.10047752
pop ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], ebx
mov eax, dword [esi]
inc eax
je 0x1001c828
cmp dword [ecx], 0
jne 0x1001c82a
xor ebx, ebx
mov edx, dword [esi]
xor ecx, ecx
mov eax, dword [edi]
sub edx, ebx
cmp eax, edx
mov eax, dword [esi]
setl cl
xor edx, edx
cmp ecx, 0xfffffffd
setne dl
xor ecx, ecx
cmp eax, edx
sete cl
mov dword [esi], ecx
jmp 0x1001c88a
cmp byte [ebp + 0x10], 0
je 0x1001c86e
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001c88a
push 0x7372
mov edx, 0x4231
xor cl, cl
call fcn.1001de94
pop ecx
jmp 0x1001c88a
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1001c88a
push 0x8b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001cdb5
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x10060465
call fcn.1005f648
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x1c67
mov esi, ecx
cmp dword [ebp - 0x1c], 0x1ddb
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
jle 0x1001ce07
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x1007ba38
or eax, ebx
cdq
push edx
push eax
call fcn.10005547
inc esi
cmp esi, 0x5629
jl 0x1001cde1
inc ebx
cmp ebx, 0x76a6
jl 0x1001cddf
mov esi, dword [ebp - 0x14]
cmp byte [ebp + 0x10], 0
je 0x1001ce26
push 0x8b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1001cebe
mov dword [ebp - 0x18], 0x548c
cmp dword [ebp - 0x18], 0x579d
jle 0x1001ce60
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x1007ba38
or eax, ebx
cdq
push edx
push eax
call fcn.10005547
inc esi
cmp esi, 0x4314
jl 0x1001ce3a
inc ebx
cmp ebx, 0x7632
jl 0x1001ce38
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x533c
jge 0x1001ce9e
mov edx, str.atk_fpkn_lgqam_cfwzvoufk_bwkuc_wim_lbkqxmyft_dzcxsv
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x1001ce9e
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1001cebe
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xb8c3
inc dword [esi]
cmp dword [esi], 2
jl 0x1001ceac
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1c], 0x1be1
jge 0x1001cedd
mov edx, str.wgohvf_ntsxswq_qmvz_mpwocyphc_akc_src_sfnsmxzwg_quoosthz_fijwh_spcfcszh_ueesfmm
mov ecx, 0x1007ba38
call fcn.100078f4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret