joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c930c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c944a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4c941f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
xor ebx, ebx
mov byte [ebp - 1], 0
jmp 0x4c9405
mov eax, dword [ebp - 0x128]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x4c9384
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4c93f8
mov bl, 1
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404484
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 8]
call fcn.004084d4
mov eax, dword [ebp - 8]
mov edx, 0x4c9464
call fcn.00404620
je 0x4c93ea
mov eax, dword [ebp - 8]
mov edx, 0x4c947c
call fcn.00404620
je 0x4c93ea
mov eax, dword [ebp - 8]
mov edx, 0x4c9490
call fcn.00404620
je 0x4c93ea
mov eax, dword [ebp - 8]
mov edx, 0x4c94a4
call fcn.00404620
jne 0x4c93f8
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9429
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x4c936e
test bl, bl
jne 0x4c9415
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9429
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9451
lea eax, [ebp - 0x134]
call fcn.00404214
lea eax, [ebp - 8]
call fcn.00404214
ret
Function at 0x4c94b4
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046c4
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4c9658
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c9628
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
mov ebx, eax
lea eax, [ebp - 0x130]
push eax
mov ecx, 0x4c9670
mov edx, 0x4c9680
mov eax, 0x4c968c
call fcn.00431690
jmp 0x4c9616
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404484
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00409060
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004c82d4
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.004c82d4
mov edx, dword [ebp - 0x140]
pop eax
call fcn.00404620
je 0x4c95f8
lea eax, [ebp - 0x148]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404484
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004c82d4
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.004c82d4
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.00404620
jne 0x4c960d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
mov ebx, eax
test ebx, ebx
jne 0x4c9559
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9632
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c965f
lea eax, [ebp - 0x14c]
mov edx, 8
call fcn.00404238
lea eax, [ebp - 4]
call fcn.00404214
ret
Function at 0x4c96b4
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004046c4
mov eax, dword [ebp - 8]
call fcn.004046c4
xor eax, eax
push ebp
push 0x4c990c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c98e7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, 0x4c9924
mov eax, 0x4c9954
call fcn.0040d7d8
jmp 0x4c98ad
cmp edi, dword [ebp - 0x128]
jne 0x4c989a
call fcn.0040ac4c
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b67e8
mov ebx, eax
cmp ebx, 0x1f4
jge 0x4c98b5
cmp byte [0x4e73c4], 1
jne 0x4c9781
cmp ebx, 0x1f4
jge 0x4c9793
mov eax, 0x1f4
sub eax, ebx
push eax
call sub.kernel32.dll_Sleep
jmp 0x4c9793
cmp ebx, 0xa
jge 0x4c9793
mov eax, 0xa
sub eax, ebx
push eax
call sub.kernel32.dll_Sleep
cmp ebx, 0xdc
jge 0x4c97a8
mov eax, 0xdc
sub eax, ebx
push eax
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 8]
mov edx, 0x4c9984
call fcn.00404620
jne 0x4c97c1
mov eax, dword [ebp - 8]
call fcn.004c94b4
jmp 0x4c97d9
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 8]
mov edx, 0x4c999c
call fcn.00404620
je 0x4c9801
mov eax, dword [ebp - 8]
mov edx, 0x4c99b4
call fcn.00404620
jne 0x4c982c
push 1
push 0
mov eax, dword [0x4e4a8c]
mov eax, dword [eax]
call fcn.004046d4
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4c99c8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4c98b5
mov eax, dword [ebp - 8]
mov edx, 0x4c99d8
call fcn.00404620
je 0x4c984a
mov eax, dword [ebp - 8]
mov edx, 0x4c99f4
call fcn.00404620
jne 0x4c9872
push 1
push 0
mov eax, dword [0x4e4aac]
mov eax, dword [eax]
call fcn.004046d4
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4c99c8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4c98b5
push 1
push 0
mov eax, dword [0x4e4a68]
mov eax, dword [eax]
call fcn.004046d4
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4c99c8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4c98b5
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4c9730
push esi
call sub.kernel32.dll_CloseHandle
push 0x4015
push 0xa8e91600
push 0
call fcn.00429f48
cmp eax, 0x945ff4
jne 0x4c98dd
mov eax, 0x4c9a08
call fcn.0042e178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c98f1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9913
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404238
ret
Function at 0x4cf798
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x4e4898], 0
mov eax, dword [0x4e5040]
cmp dword [eax], 2
jne 0x4cf971
mov eax, dword [0x4e4b6c]
cmp dword [eax], 5
jl 0x4cf971
call fcn.004cc934
test al, al
jne 0x4cf7c9
call fcn.004cc940
call fcn.004cc92c
mov dword [0x4e48a0], eax
push 0x4cf974
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4864], eax
cmp dword [0x4e4864], 0
jne 0x4cf824
mov edx, 0x8000
mov eax, 0x4cf988
call fcn.0040e734
mov dword [0x4e489c], eax
mov eax, dword [0x4e489c]
mov dword [0x4e48a0], eax
push 0x4cf974
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4864], eax
cmp dword [0x4e4864], 0
je 0x4cf96c
push 0x4cf994
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4868], eax
cmp dword [0x4e4868], 0
je 0x4cf96c
push 0x4cf9a0
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e486c], eax
cmp dword [0x4e486c], 0
je 0x4cf96c
mov byte [0x4e4898], 1
push 0x4cf9b0
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4870], eax
push 0x4cf9bc
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4874], eax
push 0x4cf9c8
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4878], eax
push 0x4cf9d8
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e487c], eax
push 0x4cf9e8
mov eax, dword [0x4e48a0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4880], eax
mov edx, 0x8000
mov eax, 0x4cfa00
call fcn.0040e734
mov dword [0x4e48a4], eax
cmp dword [0x4e48a4], 0
je 0x4cf971
push 0x4cfa10
mov eax, dword [0x4e48a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4884], eax
push 0x4cfa2c
mov eax, dword [0x4e48a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4888], eax
push 0x4cfa4c
mov eax, dword [0x4e48a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e488c], eax
push 0x4cfa68
mov eax, dword [0x4e48a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4890], eax
push 0x4cfa80
mov eax, dword [0x4e48a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4894], eax
ret
call fcn.004cf718
ret
Function at 0x4d20a4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d21cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004d1f90
mov eax, dword [esi]
call fcn.004052f8
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4cb4d8]
call fcn.004054b4
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004029b8
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004029b8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004052f8
mov dword [ebp - 0xc], eax
mov eax, dword [0x4e4f48]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.004cb76c
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00402df4
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004052f8
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.004cb69c
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004cb698
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004cb764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d21d3
lea eax, [ebp - 8]
mov edx, dword [0x4cb4d8]
call fcn.004054c0
ret
Function at 0x4d4b30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4cc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10c]
mov edx, 9
mov eax, 0x4d4cdc
call fcn.0043172c
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x110]
mov edx, 2
mov eax, 0x4d4d0c
call fcn.0043172c
mov edx, dword [ebp - 0x110]
pop eax
call fcn.00404620
jne 0x4d4bd7
lea edx, [ebp - 0x114]
mov eax, 0x4d4d1c
call fcn.00408498
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea ecx, [ebp - 0x118]
mov edx, 8
mov eax, 0x4d4d2c
call fcn.0043172c
mov eax, dword [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
mov edx, 2
mov eax, 0x4d4d0c
call fcn.0043172c
mov edx, dword [ebp - 0x11c]
pop eax
call fcn.00404620
jne 0x4d4c37
lea edx, [ebp - 0x120]
mov eax, 0x4d4d5c
call fcn.00408498
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404484
mov eax, dword [ebp - 0x124]
mov edx, ebx
call fcn.0040d760
lea ecx, [ebp - 0x128]
mov edx, 4
mov eax, 0x4d4d6c
call fcn.0043172c
mov eax, dword [ebp - 0x128]
push eax
lea ecx, [ebp - 0x12c]
mov edx, 2
mov eax, 0x4d4d9c
call fcn.0043172c
mov edx, dword [ebp - 0x12c]
pop eax
call fcn.00404620
jne 0x4d4ca9
lea edx, [ebp - 0x130]
mov eax, 0x4d4dac
call fcn.00408498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4cce
lea eax, [ebp - 0x130]
mov edx, 0xa
call fcn.00404238
ret
Function at 0x1001afa
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x101e08c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x6c], 0
cmp dword [eax + 4], 0x100
je 0x100932c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
xor ecx, ebp
call fcn.01001679
leave
ret 4
mov eax, dword [eax + 8]
cmp eax, 9
je 0x100933d
cmp eax, 0xd
jne 0x1001b20
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jl 0x1009481
push 0x12
call esi
test ax, ax
jl 0x1009481
push ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
push 0x32
lea eax, [ebp - 0x68]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x1009480
push edi
push 0x10
call esi
xor ecx, ecx
test ax, ax
setge cl
push 0x10094a0
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x74], ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10093bd
push 0
push 0
push 0x101f
push ebx
call edi
mov ecx, eax
mov eax, ebx
jmp 0x10093d5
push 0x1009488
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x100941d
push ebx
call esi
mov ecx, ebx
xor edx, edx
cmp eax, edx
je 0x100941d
cmp ecx, edx
je 0x100941d
mov edi, dword [ebp + 8]
cmp dword [edi + 8], 0xd
jne 0x10093f9
cmp ecx, ebx
jne 0x100947f
push ecx
push eax
call fcn.0100da36
jmp 0x1009478
cmp dword [ebp - 0x74], edx
je 0x1009406
cmp eax, ebx
jne 0x1009406
mov eax, ecx
jmp 0x100946d
cmp ecx, ebx
jne 0x100947f
cmp dword [ebp - 0x74], edx
je 0x100946d
push edx
push eax
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
jmp 0x100946d
cmp dword [ebp - 0x74], 0
jne 0x100947f
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 9
jne 0x100947f
push 1
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov esi, eax
test esi, esi
je 0x100947f
push 0x32
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x100947f
push 0x10094a0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x100947f
push eax
push eax
push 0x101f
push esi
call edi
test eax, eax
je 0x100947f
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x6c], 1
pop edi
pop ebx
pop esi
jmp 0x1001b20
Function at 0x1001b36
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x10096dc
push esi
xor esi, esi
cmp dword [0x101e0d8], edi
jle 0x1001b67
mov ecx, dword [esi*4 + 0x101e548]
mov eax, dword [ecx]
call dword [eax + 0x18]
inc esi
cmp esi, dword [0x101e0d8]
jl 0x1001b52
cmp dword [0x101e0cc], edi
je 0x10096ff
movzx eax, byte [0x101e080]
mov ecx, dword [0x101f6bc]
imul eax, ecx
push ebx
push 0x64
xor edx, edx
pop esi
div esi
mov ebx, eax
cmp ebx, ecx
jae 0x10096e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x100
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001bcb
movzx eax, byte [0x101e080]
push eax
push 0x101ed50
push 0x80
push edi
call fcn.0100196b
add esp, 0x10
push edi
push ebx
push 0x402
push dword [0x101e0b0]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop ebx
test eax, eax
je 0x10096ef
call fcn.010023fc
pop esi
pop edi
pop ebp
ret 8
cmp eax, dword [ebp + 8]
jne 0x1001b47
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x1001b47
jmp 0x1001bed
call dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x1001ea6
lea ebx, [ecx - 1]
jmp 0x1001b95
push edi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001be7
push edi
push edi
push 0x404
push dword [0x101e0b0]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [0x101e0cc], eax
jmp 0x1001be7

Function at 0x100255f
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, ecx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x1006614
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0x14]
push eax
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebx
jl 0x1007abc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
mov dword [ebp - 8], ebx
jmp 0x1007ac8
cmp eax, 0xc0000004
je 0x1007ac8
jmp 0x100b683
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x1007add
push eax
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x10], ebx
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 4
lea eax, [ecx + eax + 0x1000]
push eax
push ebx
mov dword [esi + 0x14], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x10], eax
cmp eax, ebx
jne 0x1002576
jmp 0x100b68f
mov dword [ebp - 4], 0x80004005
jmp 0x1002599
mov dword [ebp - 4], 0x8007000e
jmp 0x1002599
Function at 0x1003746
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x34], 1
cmp dword [esi + 0x38], edi
je 0x100680e
cmp dword [esi + 0x3c], edi
jne 0x1006819
push edi
push edi
push edi
push edi
call ebx
mov dword [esi + 0x3c], eax
jmp 0x1006819
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push 0x10032ee
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x40], eax
cmp eax, edi
je 0x10037ba
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x40
push 0xffffffffffffffff
push dword [esi + 0x3c]
push edi
call fcn.010037cc
mov eax, dword [esi + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x34], edi
pop edi
pop esi
pop ebx
leave
ret 8
push edi
push edi
push edi
push edi
call ebx
jmp 0x100ca51
mov edx, dword [esi + 0x38]
cmp edx, edi
jne 0x100ca59
jmp 0x10037ba
mov dword [esi + 0x38], eax
jmp 0x100376d
mov ecx, dword [esi + 0x3c]
cmp ecx, edi
je 0x10037ba
mov ebx, dword [ebp + 8]
lea eax, [esi + 0x1c]
mov dword [eax], ebx
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edi
cmp dword [esi + 0x40], edi
jne 0x100379e
jmp 0x1003784

Function at 0x1003cb5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x101e08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0xa
push 0x40
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.msvcrt.dll__i64tow_s
add esp, 0x14
push dword [ebp + 0x14]
lea eax, [ebp - 0x84]
push ebx
push 0
push eax
push 0
mov edi, 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov esi, 0x101e4cc
cmp ax, word [0x101e4cc]
je 0x10057cd
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
jne 0x100b714
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001679
leave
ret 0x10
push 4
push esi
push 0xe
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1003d18
xor ecx, ecx
mov word [eax], cx
jmp 0x1003d2d
Function at 0x100692d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10069b1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10069b1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10069aa
and dword [ebp + 0xc], 0xf
jbe 0x100697b
mov ecx, dword [ebp + 0xc]
dec ecx
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x1006971
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x10069a1
push esi
movzx esi, word [eax]
neg esi
sbb esi, esi
lea edx, [eax + 2]
and esi, edx
mov dword [ecx], esi
mov ecx, dword [ebp + 0x18]
pop esi
mov ax, word [eax]
mov word [ecx], ax
xor eax, eax
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x1006995
jmp 0x100699b
mov eax, 0x80004005
jmp 0x100699d
call fcn.0101b38a
jmp 0x100699d

Function at 0x1007efd
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x178
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push 0
push 0x2c
lea eax, [ebp - 0x30]
push eax
push 0
mov byte [ebp - 1], 1
call esi
jmp 0x10092d2
test eax, eax
jl 0x1007f4f
xor edx, edx
mov eax, 0x100000
div dword [ebp - 0x28]
mov ecx, dword [ebp - 0x144]
sub ecx, dword [ebp - 0x148]
xor edx, edx
mov esi, eax
mov eax, ecx
div esi
cmp eax, 8
jbe 0x1007f4f
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop esi
leave
ret
test eax, eax
jl 0x1007f4f
push 0
push 0x148
lea eax, [ebp - 0x178]
push eax
push 2
call esi
jmp 0x1007f24