joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e466b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x558cf4], 0
push esi
push edi
jne 0x4e45e1
call fcn.004e454d
test eax, eax
je 0x4e4626
mov eax, dword [0x558cf4]
cmp eax, 1
jne 0x4e4602
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4e4626
jmp 0x4e4668
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4e4668
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4e462a
xor eax, eax
jmp 0x4e4668
mov eax, dword [esi]
push dword [0x558cf4]
call edi
mov edi, eax
test edi, edi
je 0x4e464c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4e4668
lea edi, [esi + 0xff0]
push esi
push dword [0x558cf4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4e4652
mov eax, esi
pop edi
pop esi
ret
jmp 0x4e45cd

Function at 0x4e4900
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5522c0]
jne 0x4e490a
repz ret
jmp fcn.004ea71b
Function at 0x4f7c7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004ed916
and dword [ebp - 0x14], 0
cmp dword [0x559b0c], 0
mov dword [ebp - 0x18], eax
jne 0x4f7d31
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4f7dd9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5197f4
push ebx
call edi
test eax, eax
je 0x4f7dd9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x559b0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x559b10], eax
call edi
push eax
call esi
push 0x5197b4
push ebx
mov dword [0x559b14], eax
call edi
push eax
call esi
mov dword [0x559b1c], eax
test eax, eax
je 0x4f7d31
push 0x51979c
push ebx
call edi
push eax
call esi
mov dword [0x559b18], eax
mov eax, dword [0x559b18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4f7d8a
cmp dword [0x559b1c], ecx
je 0x4f7d8a
push eax
call esi
push dword [0x559b1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4f7d8a
test ebx, ebx
je 0x4f7d8a
call edi
test eax, eax
je 0x4f7d81
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4f7d81
test byte [ebp - 8], 1
jne 0x4f7d8a
or dword [ebp + 0x10], 0x200000
jmp 0x4f7dbd
mov eax, dword [0x559b10]
cmp eax, dword [ebp - 0x18]
je 0x4f7dbd
push eax
call esi
test eax, eax
je 0x4f7dbd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4f7dbd
mov eax, dword [0x559b14]
cmp eax, dword [ebp - 0x18]
je 0x4f7dbd
push eax
call esi
test eax, eax
je 0x4f7dbd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x559b0c]
call esi
test eax, eax
je 0x4f7dd9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4f7ddb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4900
leave
ret
Function at 0x405d1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232d4], 0
push esi
jne 0x405d53
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d2d
mov dword [ecx*4 + 0x4232d0], eax
inc ecx
cmp ecx, 0x100
jl 0x405d28
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d84
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232d0]
xor eax, esi
inc ecx
dec edx
jne 0x405d66
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x10003af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
add eax, 5
push eax
call fcn.1002dad0
add esp, 4
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1002f580
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
sub eax, 5
mov ecx, dword [ebp - 8]
mov dword [ecx + 1], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + 1], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003bd4]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret

Function at 0x10003bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 1], ecx
mov dword [ebp - 0x2c], 5
jmp 0x10003c58
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x10]
jae 0x10003c6b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2c]
mov byte [eax], 0x90
jmp 0x10003c4f
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003cb4]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret
Function at 0x10003da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
add ecx, 0x14
cmp dword [ebp - 0x20], ecx
je 0x10003e20
cmp dword [ebp - 0x20], 0
je 0x10003e20
mov eax, dword [ebp - 0x20]
sub eax, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x28]
push edx
call fcn.10003e40
add esp, 8
test eax, eax
je 0x10003e16
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
jmp 0x10003e22
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
jmp 0x10003dda
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret
Function at 0x10004120
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1009f774]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x48], 0
push 0x31
push 0
lea eax, [ebp - 0x47]
push eax
call fcn.10030670
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10004169
xor eax, eax
jmp 0x1000428c
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10004193
xor eax, eax
jmp 0x1000428c
mov esi, esp
push 0x10084c88
mov edi, esp
push 0x10084c78
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.1002ba00
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 0x60], eax
mov esi, esp
push 4
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
call fcn.1002e9d0
add esp, 4
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 0x54], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.1002e9d0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1002ba00
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 0xc]
push eax
push str._s_tried_to_be_loaded__n
lea ecx, [ebp - 0x168]
push ecx
call fcn.1002ccb0
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1002ba00
mov esi, esp
push 0xc000
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.1002ba00
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100042bc]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c4c0
add esp, 0x2fc
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret
Function at 0x10004450
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp esi, esp
call fcn.1002ba00
mov byte [ebp - 0x1d], 0x90
mov dword [ebp - 0x2c], 0
jmp 0x100044b7
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jae 0x100044e3
mov esi, esp
push 0
push 1
lea eax, [ebp - 0x1d]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1002ba00
jmp 0x100044ae
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp esi, esp
call fcn.1002ba00
push edx
mov ecx, ebp
push eax
lea edx, [0x1000452c]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret
Function at 0x10005d50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.._config1.txt
push 0
push str.Talisman
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne al
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret

Function at 0x10007120
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 1], ecx
mov dword [ebp - 0x2c], 5
jmp 0x10007188
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x10]
jae 0x1000719b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2c]
mov byte [eax], 0x90
jmp 0x1000717f
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002ba00
push edx
mov ecx, ebp
push eax
lea edx, [0x100071e0]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret

Function at 0x100072e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10030450
add esp, 0x10
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 8]
sub eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov byte [eax], 0xe9
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 1], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10007120
add esp, 0xc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret
Function at 0x10008dc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
lea edi, [ebp - 0x108]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1009f774]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x10008e62
mov esi, esp
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 8]
push eax
push str.closed_TITLE_:__s__n
lea ecx, [ebp - 0x34]
push ecx
call fcn.1002ccb0
add esp, 0xc
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x100], esp
lea eax, [ebp - 0x34]
push eax
call fcn.10002170
mov dword [ebp - 0x108], eax
call fcn.10022a30
add esp, 0x20
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x10008e94]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c4c0
add esp, 0x108
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret

Function at 0x10008eb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
lea edi, [ebp - 0x108]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1009f774]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x10008f56
mov esi, esp
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp + 8]
push eax
push str.closed_CLASSEWINDOW_:__s__n
lea ecx, [ebp - 0x34]
push ecx
call fcn.1002ccb0
add esp, 0xc
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x100], esp
lea eax, [ebp - 0x34]
push eax
call fcn.10002170
mov dword [ebp - 0x108], eax
call fcn.10022a30
add esp, 0x20
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x10008f88]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c4c0
add esp, 0x108
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret
Function at 0x10009910
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1002ba00
mov dword [ebp - 0x14], eax
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.1002ba00
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1002ba00
push edx
mov ecx, ebp
push eax
lea edx, [0x100099a0]
call fcn.1002ba30
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret

Function at 0x10009bb0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fbb0
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
push ebx
push esi
push edi
lea edi, [ebp - 0x158]
mov ecx, 0x53
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1009f774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x1009f071]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x1009f071], al
mov esi, esp
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1002ba00
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x14c], esp
push str.loginaccountpacket5095
call fcn.10002170
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x34]
push eax
call fcn.10023650
add esp, 0x24
mov dword [ebp - 0x158], eax
mov dword [ebp - 4], 0
push str.LIXEN
lea ecx, [ebp - 0x5c]
call fcn.10002170
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x34]
call fcn.10002380
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x34]
call fcn.1000da80
add eax, 1
push eax
call fcn.10026d70
add esp, 4
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x34]
call fcn.1000da40
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.10031510
add esp, 8
mov esi, esp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1002ba00
mov eax, dword [ebp - 0x68]
cmp eax, dword [0x100848f4]
je 0x10009cd6
push 0x1d
mov eax, dword [ebp - 0x74]
push eax
push 0x513146
call fcn.10006fc0
add esp, 0xc
jmp 0x10009cec
mov esi, esp
push 0
push 0x10009d90
call dword [sym.imp.USER32.dll_EnumWindows]
cmp esi, esp
call fcn.1002ba00
movzx eax, byte [0x1009f071]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x1009f071], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.10002220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002220
push edx
mov ecx, ebp
push eax
lea edx, [0x10009d54]
call fcn.1002ba30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002c4c0
add esp, 0x158
cmp ebp, esp
call fcn.1002ba00
mov esp, ebp
pop ebp
ret