joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d604
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x40d68a
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00411640
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
jne 0x40d668
cmp dword [ebp - 0x90], 0
je 0x40d68a
push str.SetDefaultDllDirectories
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d68a
push 0xc00
call eax
push str.restrict_DLL_directories
call fcn.0040be55
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040edc8
leave
ret

Function at 0x40d697
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1774
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, 0x4400a0
lea eax, [ebp - 0x1774]
push eax
call fcn.0040508a
push 0
call fcn.00410186
push edx
push eax
lea eax, [ebp - 0x1774]
push eax
push str._s_dir_d
push esi
call fcn.0040f861
push esi
push str.Temp_dir3:__S
call fcn.0040be55
add esp, 0x24
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40d72a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42bd0c
call fcn.0040be55
inc edi
cmp edi, 0xa
pop ecx
pop ecx
jl 0x40d6b7
push 0x42bd08
push 0x3f1
mov byte [0x4400a0], 0
call fcn.00403f90
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040edc8
leave
ret

Function at 0x40d738
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d7a6
push esi
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40d7a5
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x40d890
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
push esi
push edi
mov ebx, 0xbb80
push ebx
call fcn.0040e75d
mov esi, eax
mov dword [esp], 0x2ee0
call fcn.0040e75d
mov edi, eax
mov dword [esp], 0x1770
push edi
push 0x2714
call fcn.004037d0
push edi
push str.native_lib_dir_is__S
call fcn.0040be55
push edi
call fcn.00406979
push 0x40d873
push edi
push esi
call fcn.004054ae
push esi
call fcn.0040e8b0
add esp, 0x28
test eax, eax
je 0x40d905
push esi
call fcn.0040e8b0
cmp byte [eax + esi - 1], 0x3b
pop ecx
je 0x40d905
push 0x428cc4
push esi
call fcn.0040ece0
pop ecx
pop ecx
push esi
call fcn.0040e8b0
pop ecx
sub ebx, eax
push ebx
push esi
call fcn.0040e8b0
pop ecx
add eax, esi
push eax
mov ebx, str.PATH
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x40d940
push esi
push str.Setting_PATH__native_libs___S
call fcn.0040be55
pop ecx
pop ecx
jmp 0x40d955
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Setting_PATH__native_libs___S_failed_with_error__d
call fcn.0040be55
add esp, 0xc
push esi
call fcn.0040e8b0
add eax, 6
push eax
call fcn.0040e75d
push esi
mov ebx, eax
push str.PATH_s
push ebx
call fcn.0040f861
push ebx
call fcn.00413161
push ebx
call fcn.0040eb88
push esi
call fcn.0040eb88
push edi
call fcn.0040eb88
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x40e3dd
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x462c]
mov eax, 0x46ac
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x4628], eax
mov eax, dword [ebp + 0x4634]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x4638]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.0040ecd0
push str..pack
call fcn.0040e8b0
lea esi, [ebp - 0x28]
sub esi, eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040e8b0
xor ebx, ebx
push edi
mov byte [eax + esi], bl
call fcn.004046f0
add esp, 0x14
test al, al
jne 0x40e451
push str.pack_path_doesnt_exists
call fcn.0040be55
jmp 0x40e551
push dword [ebp - 0x2c]
lea eax, [ebp + 0x2eb8]
push str._s_binunpack200.exe
push eax
call fcn.0040f861
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp + 0x1748]
push str._r___s____s_
push eax
call fcn.0040f861
lea eax, [ebp + 0x2eb8]
push eax
mov esi, 0x428b70
push esi
call fcn.0040be55
lea eax, [ebp + 0x1748]
push eax
push esi
call fcn.0040be55
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00411640
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00411640
add esp, 0x44
xor ecx, ecx
mov word [ebp - 0x50], cx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push ebx
xor eax, eax
push 0x20
inc eax
push eax
push ebx
mov dword [ebp - 0x54], eax
push ebx
lea eax, [ebp + 0x1748]
push eax
lea eax, [ebp + 0x2eb8]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40e50a
push str.could_not_create_unpack_process
call fcn.0040be55
mov dword [esp], 0x42c398
push 0x3f1
call fcn.00403f90
pop ecx
pop ecx
push str.waiting_for_unpack200_to_finish
call fcn.0040be55
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.unpack_done
call fcn.0040be55
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40e552
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x40e552
call esi
push eax
push str.could_not_delete_packed_file__error__d_
call fcn.0040be55
pop ecx
pop ecx
mov ecx, dword [ebp + 0x4628]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040edc8
add ebp, 0x462c
leave
ret
Function at 0x40e56a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2fa8]
mov eax, 0x3028
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x2fa4], eax
mov eax, dword [ebp + 0x2fb0]
push ebx
push edi
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x1834]
push str._s_s.jar.pack
push eax
call fcn.0040f861
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1834]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e6a3
lea eax, [ebp - 0x50]
push eax
push eax
call fcn.0040e8b0
pop ecx
sub eax, 5
push eax
push edi
push esi
lea eax, [ebp + 0x1834]
push str._s_s_.s
push eax
call fcn.0040f861
lea eax, [ebp + 0x1834]
push eax
push str.checking__S
call fcn.0040be55
lea eax, [ebp + 0x1834]
push eax
call fcn.004046f0
add esp, 0x24
test al, al
jne 0x40e689
mov eax, dword [ebp - 0x80]
cmp byte [eax], 0
jne 0x40e63f
push str.Unpacking_JRE
call fcn.0040be55
mov dword [esp], str.Preparing_JRE_..._n
call fcn.00413c44
call fcn.0040fd7f
add eax, 0x20
push eax
call fcn.0040fc07
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
mov byte [eax], 1
lea eax, [ebp - 0x50]
push eax
push eax
call fcn.0040e8b0
pop ecx
sub eax, 5
push eax
push edi
lea eax, [ebp + 0x1834]
push str._s_.s
push eax
call fcn.0040f861
lea eax, [ebp + 0x1834]
push eax
push esi
lea eax, [ebp + 0xc4]
push str._s_s.pack
push eax
call fcn.0040f861
lea eax, [ebp + 0xc4]
push eax
push esi
call fcn.0040e3dd
add esp, 0x2c
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e5c5
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x2fa4]
xor ecx, ebp
pop ebx
call fcn.0040edc8
add ebp, 0x2fa8
leave
ret

Function at 0x40edc8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431920]
jne 0x40edd2
repz ret
jmp fcn.004142fd
Function at 0x41b1fa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041447d
and dword [ebp - 4], 0
cmp dword [0x4420a4], 0
mov ebx, eax
jne 0x41b2ab
push 0x42cfe8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x41b35c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42cfdc
push edi
call esi
test eax, eax
je 0x41b35c
push eax
call fcn.0041440b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4420a4], eax
call esi
push eax
call fcn.0041440b
mov dword [esp], 0x42cfb8
push edi
mov dword [0x4420a8], eax
call esi
push eax
call fcn.0041440b
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x4420ac], eax
call esi
push eax
call fcn.0041440b
pop ecx
mov dword [0x4420b4], eax
test eax, eax
je 0x41b2ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041440b
pop ecx
mov dword [0x4420b0], eax
mov eax, dword [0x4420b0]
cmp eax, ebx
je 0x41b303
cmp dword [0x4420b4], ebx
je 0x41b303
push eax
call fcn.00414486
push dword [0x4420b4]
mov esi, eax
call fcn.00414486
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41b303
test edi, edi
je 0x41b303
call esi
test eax, eax
je 0x41b2fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41b2fa
test byte [ebp - 0xc], 1
jne 0x41b303
or dword [ebp + 0x10], 0x200000
jmp 0x41b33c
mov eax, dword [0x4420a8]
cmp eax, ebx
je 0x41b33c
push eax
call fcn.00414486
pop ecx
test eax, eax
je 0x41b33c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41b33c
mov eax, dword [0x4420ac]
cmp eax, ebx
je 0x41b33c
push eax
call fcn.00414486
pop ecx
test eax, eax
je 0x41b33c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4420a4]
call fcn.00414486
pop ecx
test eax, eax
je 0x41b35c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41b35e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42125a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041447d
and dword [ebp - 4], 0
cmp dword [0x4422f8], 0
mov ebx, eax
jne 0x42130b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4213bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42e1e8
push edi
call esi
test eax, eax
je 0x4213bc
push eax
call fcn.0041440b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4422f8], eax
call esi
push eax
call fcn.0041440b
mov dword [esp], 0x42cfb8
push edi
mov dword [0x4422fc], eax
call esi
push eax
call fcn.0041440b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x442300], eax
call esi
push eax
call fcn.0041440b
pop ecx
mov dword [0x442308], eax
test eax, eax
je 0x42130b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041440b
pop ecx
mov dword [0x442304], eax
mov eax, dword [0x442304]
cmp eax, ebx
je 0x421363
cmp dword [0x442308], ebx
je 0x421363
push eax
call fcn.00414486
push dword [0x442308]
mov esi, eax
call fcn.00414486
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421363
test edi, edi
je 0x421363
call esi
test eax, eax
je 0x42135a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42135a
test byte [ebp - 0xc], 1
jne 0x421363
or dword [ebp + 0x10], 0x200000
jmp 0x42139c
mov eax, dword [0x4422fc]
cmp eax, ebx
je 0x42139c
push eax
call fcn.00414486
pop ecx
test eax, eax
je 0x42139c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42139c
mov eax, dword [0x442300]
cmp eax, ebx
je 0x42139c
push eax
call fcn.00414486
pop ecx
test eax, eax
je 0x42139c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4422f8]
call fcn.00414486
pop ecx
test eax, eax
je 0x4213bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4213be
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
jmp 0x41c4ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c4c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c4b0
mov eax, 1
add ebx, ebx
jne 0x41c4d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c4c8
jne 0x41c4e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c4c8
xor ecx, ecx
sub eax, 3
jb 0x41c4f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c56a
mov ebp, eax
add ebx, ebx
jne 0x41c503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c534
inc ecx
add ebx, ebx
jne 0x41c520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c515
jne 0x41c531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c515
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c554
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c545
jmp 0x41c4b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c554
add edi, ecx
jmp 0x41c4b6
pop esi
mov edi, esi
mov ecx, 0xaef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c572
cmp byte [edi], 4
jne 0x41c572
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41c577
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c5ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1cc04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1cca4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c5a4
mov ecx, edi
jns 0x41c5d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1cca8]
or eax, eax
je 0x41c5e9
mov dword [ebx], eax
add ebx, 4
jmp 0x41c5c1
call dword [esi + 0x1ccb8]
mov ebp, dword [esi + 0x1ccac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41c623
sub esp, 0xffffff80
jmp 0x411de6
Function at 0x1000f43c
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x1000f5d2
mov dword [ebp - 4], 0x400
fild dword [ebp - 4]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fmul qword [0x10058080]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.100038f5
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 8]
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000f4d5
push 0xba
push 0x405a626
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000f50b
push 0xf3
push 0x405a626
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000f5a6
fild dword [ebp - 0x14]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fsub qword [0x10058080]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.100038f5
push eax
lea eax, [ebp - 0x18]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x1000f5a3
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.1000f5e2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + 8], eax
jne 0x1000f59b
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000f591
push 0x1f4
push 0x405a626
push 6
call fcn.1003e90e
add esp, 0xc
mov eax, 1
jmp 0x1000f5dc
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x1000f53e
add esp, 0xc
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000f5d2
push 0x24f
push 0x405a626
push 6
call fcn.1003e90e
add esp, 0xc
mov eax, 0
jmp 0x1000f5dc
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e415
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x1001e44d
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x1001e43b
mov al, 1
jmp 0x1001e4ac
cmp dword [ebx + 0x54], ecx
jne 0x1001e444
mov al, 2
jmp 0x1001e4ac
cmp dword [ebx + 0x7c], ecx
jne 0x1001e4ac
mov al, 3
jmp 0x1001e4ac
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1001e462
mov al, 4
jmp 0x1001e4ac
cmp ecx, 5
jne 0x1001e482
cmp ebx, 0
jne 0x1001e470
mov al, 5
jmp 0x1001e4ac
cmp ebx, 1
jne 0x1001e479
mov al, 6
jmp 0x1001e4ac
cmp ebx, 2
jne 0x1001e482
mov al, 7
jmp 0x1001e4ac
cmp ecx, 6
jne 0x1001e4aa
cmp ebx, 0
jne 0x1001e490
mov al, 8
jmp 0x1001e4ac
cmp ebx, 1
jne 0x1001e497
mov al, 9
cmp ebx, 2
jne 0x1001e49e
mov al, 0xa
cmp ebx, 3
jne 0x1001e4a5
mov al, 0xb
cmp ebx, 4
jne 0x1001e4ac
mov al, 0xc
pop ebx
leave
ret
Function at 0x10021296
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x100212e8
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100212e0
push 0x4f
push 0x405a17e
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x10021321
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1002131e
push 0x7d
push 0x405a17e
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10021335
mov eax, 0
jmp 0x1002139d
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10021366
push 0x10b
push 0x405a17e
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10021395
push 0x12f
push 0x405a17e
push 6
call fcn.1003e90e
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x1002139d
mov esp, ebp
pop ebp
ret 8

Function at 0x10021685
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jl 0x100216ad
cmp dword [ebp + 0x14], 3
jg 0x100216ad
xor eax, eax
jmp 0x100216b2
mov eax, 1
test eax, eax
je 0x100216c6
mov dword [ebp - 4], 1
jmp 0x10021737
fild dword [ebp + 0x14]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1005725a]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.100038f5
cmp eax, 1
jl 0x100216ea
cmp eax, 5
jl 0x10021701
push 0xb7
push 0x405ad37
push 9
call fcn.1003e90e
add esp, 0xc
dec eax
call 0x10021707
pop ebx
add ebx, dword [eax*4 + 0x10058e57]
jmp ebx
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov eax, str.Open
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1001a2d2
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10021767
push ebx
call fcn.1003e902
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
mov eax, 0x1005803c
test eax, eax
je 0x10021779
add eax, 8
push eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x10021786
add eax, 8
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x10021793
add eax, 8
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002179e
add eax, 8
push eax
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x100217ca
push 0x12d
push 0x405ad37
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100217dd
push ebx
call fcn.1003e902
add esp, 4
cmp dword [ebp - 0x18], 2
mov eax, 0
setne al
jmp 0x100217ee
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10021eb7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 8]
call fcn.10021f11
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x1002255a
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 8], esp
je 0x10021efc
push 0x17
push 0x405a15f
push 6
call fcn.1003e90e
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.1000dd36
jmp 0x10021f0b
mov esp, ebp
pop ebp
ret 8

Function at 0x10022404
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10022447
push 0x19
push 0x405acf0
push 6
call fcn.1003e90e
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002245e
mov eax, 0x1005803c
jmp 0x1002250d
inc dword [ebp - 4]
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x100587a5]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.100038f5
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.1003ffb0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100224ac
push ebx
call fcn.1003e902
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10016047
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100224ee
push 0x136
push 0x405acf0
push 6
call fcn.1003e90e
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x10022508
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1003e8fc
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1002250d
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1002251e
push ebx
call fcn.1003e902
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1002959b
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, 0x100594ff
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
call fcn.1002960a
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100295d3
push ebx
call fcn.1003e902
add esp, 4
mov dword [ebp - 4], esp
push 0
push 2
xor eax, eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
nop
nop
cmp dword [ebp - 4], esp
je 0x10029606
push 0x19
push 0x405a4f4
push 6
call fcn.1003e90e
add esp, 0xc
mov esp, ebp
pop ebp
ret