joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f61c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test eax, eax
je 0x4f61cf
test edx, edx
jg 0x4f61d6
xor ecx, ecx
jmp 0x4f6290
mov ecx, edx
mov edi, 3
and edi, edx
shr edx, 2
test edx, edx
jle 0x4f6212
movzx ebx, word [eax]
add ecx, ebx
mov esi, eax
mov ebx, esi
add ebx, 2
movzx ebx, word [ebx]
shl ebx, 0xb
xor ebx, ecx
shl ecx, 0x10
xor ebx, ecx
mov ecx, ebx
add esi, 4
mov eax, esi
mov ebx, ecx
shr ebx, 0xb
add ecx, ebx
dec edx
test edx, edx
jg 0x4f61e6
cmp edi, 3
jne 0x4f6237
movzx edx, word [eax]
add ecx, edx
mov edx, ecx
shl edx, 0x10
xor ecx, edx
add eax, 2
movzx eax, byte [eax]
shl eax, 0x12
xor ecx, eax
mov eax, ecx
shr eax, 0xb
add ecx, eax
jmp 0x4f6266
cmp edi, 2
jne 0x4f6251
movzx eax, word [eax]
add ecx, eax
mov eax, ecx
shl eax, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add ecx, eax
jmp 0x4f6266
dec edi
jne 0x4f6266
movzx eax, byte [eax]
add ecx, eax
mov eax, ecx
shl eax, 0xa
xor ecx, eax
mov eax, ecx
shr eax, 1
add ecx, eax
mov eax, ecx
shl eax, 3
xor ecx, eax
mov eax, ecx
shr eax, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add ecx, eax
mov eax, ecx
shl eax, 0x19
xor ecx, eax
mov eax, ecx
shr eax, 6
add ecx, eax
mov eax, ecx
pop edi
pop esi
pop ebx
ret

Function at 0x51c4ac
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x51c4c2
add esp, 0xfffffff0
call fcn.004093cc
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x51c55f
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
xor edx, edx
mov eax, edi
call fcn.004c14ac
lea eax, [edi + 0x5c]
mov edx, esi
mov ecx, dword [0x519db8]
call fcn.0040c87c
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [edi + 0x34], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [edi + 0x54], eax
lea eax, [ebp - 4]
call fcn.004f8220
mov edx, dword [ebp - 4]
lea eax, [edi + 0x70]
call fcn.0040f78c
lea ecx, [ebp - 8]
mov edx, dword [edi + 0x54]
mov eax, 0x64
call fcn.005364c8
mov edx, dword [ebp - 8]
lea eax, [edi + 0x30]
call fcn.0040f78c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c566
lea eax, [ebp - 8]
call fcn.0040f774
lea eax, [ebp - 4]
call fcn.0040f774
pop eax
jmp eax
Function at 0x52b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52b6f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20], 3
je 0x52b61e
mov ecx, 0x52b70c
mov dl, 1
mov eax, dword [0x41b12c]
call fcn.0042a59c
call fcn.0040a29c
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004f8304
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
push ebp
push 0x52b6d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x52b674
mov dl, 1
mov eax, dword [0x487abc]
call fcn.004ad8f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov dl, 1
mov eax, dword [0x4edcc8]
call fcn.004f23a8
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, ebx
call fcn.004adca8
lea eax, [ebp - 0x10]
mov edx, ebx
mov ecx, 0x52b7fc
call fcn.0040f7b8
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.004f8208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b6dc
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
pop eax
jmp eax
Function at 0x532420
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x53558c]
call fcn.0040bcec
xor eax, eax
push ebp
push 0x5325ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x20], 0
je 0x532464
mov byte [ebx + 0x11], 1
mov byte [ebp - 0x15], 1
jmp 0x53257e
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x532471
cmp byte [eax + 0x3c], 0
je 0x53247a
mov byte [ebp - 0x15], 1
jmp 0x53257e
mov eax, dword [ebx + 0x1c]
mov byte [eax + 0xa0], 1
mov eax, ebx
call fcn.0053240c
mov edx, esi
mov eax, ebx
call fcn.00532690
mov byte [ebp - 0x15], al
jmp 0x5324a3
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0052fc14
mov esi, ebx
mov edi, dword [esi + 0x3c]
cmp dword [edi + 0x10], 0
jne 0x5324ca
lea ecx, [ebp - 0x24]
mov edx, dword [edi + 0x34]
mov eax, dword [esi + 0x38]
call fcn.005364c8
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 0x3c]
add eax, 0x10
call fcn.0040f78c
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test al, al
jne 0x532499
cmp byte [ebx + 0x18], 0
je 0x532502
cmp dword [ebx + 0x14], 0
je 0x532502
mov eax, dword [ebx + 0x14]
call fcn.0053495c
mov eax, ebx
call fcn.0052fa3c
cmp byte [ebp - 0x15], 0
jne 0x532544
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x532521
push 0xffffffffffffffff
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [ebx + 0x44], eax
jmp 0x532544
cmp dword [ebx + 0x30], 0
je 0x532544
mov eax, dword [ebx + 0x3c]
push dword [eax + 0x44]
push dword [eax + 0x40]
push 0
push 0
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x54]
lea eax, [ebx + 0x30]
call fcn.0040f774
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x532550
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebx + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408df0
lea eax, [ebx + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5325b3
lea eax, [ebp - 0x24]
call fcn.0040f774
lea eax, [ebp - 0x14]
mov edx, dword [0x53558c]
call fcn.0040c0d8
lea eax, [ebp - 4]
call fcn.0040f774
pop eax
jmp eax
Function at 0x539df4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040f7e8
xor eax, eax
push ebp
push 0x539e8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
call fcn.00539f74
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
mov esi, dword [ebx + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004acc4c
mov edi, eax
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 8]
call fcn.004acc4c
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
add eax, 4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00446480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539e91
lea eax, [ebp - 4]
call fcn.0040f774
pop eax
jmp eax
Function at 0x54e640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push edi
call fcn.00409474
mov byte [ebp - 0x1d], dl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x4c], 0
je 0x54e66e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x4c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x5c], 0
je 0x54e691
mov eax, dword [ebp - 0x1c]
add eax, 0x7c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408df0
mov eax, dword [ebp - 0x1c]
add eax, 0x54
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408df0
mov eax, dword [ebp - 0x1c]
add eax, 0x50
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408df0
mov eax, dword [ebp - 0x1c]
add eax, 0x68
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408df0
mov eax, dword [ebp - 0x1c]
add eax, 0x10
call fcn.0045af58
test eax, eax
je 0x54e752
lea edi, [ebp - 0x18]
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
xor eax, eax
push ebp
push 0x54e74b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.00472c00
mov eax, dword [ebp - 0x1c]
add eax, 0x30
call fcn.004665d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e752
lea eax, [ebp - 0x18]
mov edx, dword [0x44c8d0]
call fcn.0040c0d8
pop eax
jmp eax
movzx edx, byte [ebp - 0x1d]
and dl, 0xfc
mov eax, dword [ebp - 0x1c]
call fcn.00408de0
cmp byte [ebp - 0x1d], 0
jle 0x54e76f
mov eax, dword [ebp - 0x1c]
call fcn.0040941c
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5527f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
test dl, dl
je 0x552808
add esp, 0xfffffff0
call fcn.004093cc
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebp
push 0x5528a6
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x552838
mov ecx, 0x5528dc
mov dl, 1
mov eax, dword [0x41b12c]
call fcn.0042a59c
call fcn.0040a29c
mov dword [ebx + 0x18], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x3c], eax
lea eax, [ebp - 0x10]
call fcn.00503908
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x10]
mov dword [ebx + 0x28], eax
mov cl, 1
mov dl, 1
mov eax, dword [0x4ef23c]
call fcn.004f3804
mov dword [ebx + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5528ad
lea eax, [ebp - 0x10]
call fcn.0040f774
lea eax, [ebp - 0xc]
call fcn.0040f774
lea eax, [ebp - 8]
call fcn.0040f774
pop eax
jmp eax

Function at 0x558aec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x558b49
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0xc]
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0x30]
mov eax, dword [ebp - 8]
mov edx, ebx
test edx, edx
je 0x558b2c
sub edx, 0xffffffe8
call fcn.0040f78c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558b50
lea eax, [ebp - 4]
call fcn.0040f774
pop eax
jmp eax

Function at 0x562574
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 4]
add esp, 0x20
ret
Function at 0x562604
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5626f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.00422508
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040811c
mov dword [ebp - 0x4c], 0x44
mov word [ebp - 0x1c], 5
mov eax, ebx
call fcn.005622c0
or eax, 0x10
mov ebx, eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push ebx
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b6a8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x5626d5
xor eax, eax
push ebp
push 0x5626ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
call sub.kernel32.dll_Sleep
call fcn.00562540
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 8], 0x103
je 0x56268a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5626da
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
call fcn.0042cfac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5626f9
lea eax, [ebp - 4]
call fcn.0040abf0
pop eax
jmp eax
Function at 0x1000859b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x100085e0
call fcn.10012aec
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100085e0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x100085fc
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10014c95
mov ebx, eax
test edi, edi
je 0x100085fa
test esi, esi
je 0x100085fa
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000d296
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.10012aec
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1000d2cd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.1000d2ee
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100265e1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.10015027
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x1002661d
call fcn.10026800
mov dword [esi + 0xc], 1
jmp 0x10026622
call fcn.10026800
cmp dword [esi], 0
je 0x1002666b
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x10026645
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.100086df
jmp 0x10026656
push 0xff
mov ecx, esi
call fcn.100037ab
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1000aa60
jmp 0x1002668f
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x1002668f
push dword [esi]
push dword [ebp - 4]
call fcn.10015b5b
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10026755
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.10026800
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x1002679d
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.100086df
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000aa60
jmp 0x100267a8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10015b5b
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100284b8
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10041979
call fcn.10012b40
cmp dword [eax + 0x14], 0
jne 0x100284d3
mov ecx, esi
pop esi
jmp fcn.10027891
pop esi
ret

Function at 0x1003edcb
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.1009c45a
call fcn.10012b40
cmp dword [eax + 0x14], 0
jne 0x1003ede6
mov ecx, esi
pop esi
jmp fcn.1003e6b4
pop esi
ret
Function at 0x1013f99d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101a6090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10135378
mov dword [ebp - 0x14], eax
cmp dword [0x101b1c74], esi
jne 0x1013fa90
push 0x800
push esi
push 0x1018358c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1013fa1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1013fb70
push esi
push esi
push 0x1018358c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1013fb70
push 0x101835a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1013fb70
push eax
call ebx
push 0x101835b0
push edi
mov dword [0x101b1c74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x101835c0
push edi
mov dword [0x101b1c78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x101b1c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101b1c84], eax
test eax, eax
je 0x1013fa8d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101b1c80], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1013fab5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1013faa8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1013faca
push 4
pop eax
jmp 0x1013fb72
cmp dword [ebp - 0x14], esi
je 0x1013faca
push dword [0x101b1c74]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1013faaf
mov eax, dword [0x101b1c80]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1013fb28
cmp dword [0x101b1c84], edi
je 0x1013fb28
push eax
call ebx
push dword [0x101b1c84]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1013fb28
test eax, eax
je 0x1013fb28
call ecx
test eax, eax
je 0x1013fb1d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1013fb1d
test byte [ebp - 8], 1
jne 0x1013fb28
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1013fb58
mov eax, dword [0x101b1c78]
cmp eax, edi
je 0x1013fb55
push eax
call ebx
test eax, eax
je 0x1013fb55
call eax
mov esi, eax
test esi, esi
je 0x1013fb55
mov eax, dword [0x101b1c7c]
cmp eax, edi
je 0x1013fb55
push eax
call ebx
test eax, eax
je 0x1013fb55
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x101b1c74]
call ebx
test eax, eax
je 0x1013fb70
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1013fb72
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b848
mov esp, ebp
pop ebp
ret
Function at 0x407f17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b9e8]
jne 0x407f21
repz ret
jmp fcn.00409585

Function at 0x40867d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040573a
and dword [ebp - 4], 0
cmp dword [0x45e250], 0
mov ebx, eax
jne 0x40872e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4087df
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4087df
push eax
call fcn.004056c8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45e250], eax
call esi
push eax
call fcn.004056c8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45e254], eax
call esi
push eax
call fcn.004056c8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45e258], eax
call esi
push eax
call fcn.004056c8
pop ecx
mov dword [0x45e260], eax
test eax, eax
je 0x40872e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004056c8
pop ecx
mov dword [0x45e25c], eax
mov eax, dword [0x45e25c]
cmp eax, ebx
je 0x408786
cmp dword [0x45e260], ebx
je 0x408786
push eax
call fcn.00405743
push dword [0x45e260]
mov esi, eax
call fcn.00405743
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408786
test edi, edi
je 0x408786
call esi
test eax, eax
je 0x40877d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40877d
test byte [ebp - 0xc], 1
jne 0x408786
or dword [ebp + 0x10], 0x200000
jmp 0x4087bf
mov eax, dword [0x45e254]
cmp eax, ebx
je 0x4087bf
push eax
call fcn.00405743
pop ecx
test eax, eax
je 0x4087bf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087bf
mov eax, dword [0x45e258]
cmp eax, ebx
je 0x4087bf
push eax
call fcn.00405743
pop ecx
test eax, eax
je 0x4087bf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e250]
call fcn.00405743
pop ecx
test eax, eax
je 0x4087df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4087e1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret