joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bee98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6bef37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409e84
mov eax, 0x104
call fcn.00427a90
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x6beef3
mov eax, esi
mov edx, ebx
call fcn.0040aaa8
mov eax, ebx
call fcn.00427ad0
lea eax, [ebp - 4]
call fcn.0040da68
push eax
call sub.shell32.dll_SHGetMalloc
test eax, 0x80000000
sete al
test al, al
je 0x6bef21
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bef3e
lea eax, [ebp - 4]
call fcn.0040da68
ret

Function at 0x6bf65c
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409f20
mov eax, dword [ebp - 8]
call fcn.00409f20
xor eax, eax
push ebp
push 0x6bf72d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00409e3c
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.0040acb4
push eax
mov eax, dword [ebp - 4]
call fcn.0040acb4
mov edi, eax
push edi
call sub.advapi32.dll_LookupAccountNameW
mov eax, dword [ebp - 0x10]
call fcn.00427a90
mov esi, eax
mov eax, dword [ebp - 0x14]
call fcn.00406464
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.0040acb4
push eax
push edi
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x6bf704
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.006bf55c
mov eax, esi
call fcn.00427ad0
mov eax, ebx
call fcn.004064b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bf734
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e9c
ret
Function at 0x6bfa4c
Capabilities:
Persist via ginadll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6bfb47
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.006bf73c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6bfb25
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004eee0c
mov edx, 0x6bfb64
mov eax, dword [ebp - 8]
call fcn.004ef098
test al, al
je 0x6bfaec
mov edx, 0x6bfbdc
mov eax, dword [ebp - 8]
call fcn.004efeac
test al, al
je 0x6bfae4
lea ecx, [ebp - 0x10]
mov edx, 0x6bfbdc
mov eax, dword [ebp - 8]
call fcn.004ef920
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00424fe8
mov edx, dword [ebp - 0xc]
mov ecx, 1
mov eax, 0x6bfbf8
call fcn.0040b2a0
test eax, eax
setg byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.004eeddc
cmp byte [ebp - 1], 0
jne 0x6bfb0f
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.004eee0c
mov edx, 0x6bfc14
mov eax, dword [ebp - 8]
call fcn.004f0238
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bfb2c
mov eax, dword [ebp - 8]
call fcn.00408084
ret

Function at 0x6bfd28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6bfdd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xff
mov eax, ebx
call fcn.00406498
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6bfdaf
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
push 1
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040ad1c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x6bfdec
call fcn.0040af20
mov eax, dword [ebp - 0xc]
call fcn.00425fa0
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bfdb6
mov eax, dword [ebp - 8]
call fcn.004064b4
ret

Function at 0x6bfdfc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6bfea7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x77a86c
lea eax, [ebp - 4]
lea edx, [esi + 0x61]
call fcn.0040acdc
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, 0x6bfec0
call fcn.0040af20
lea eax, [ebx + 4]
mov edx, 0x7f
call fcn.0040ae48
lea eax, [ebx + 4]
call fcn.0040a3fc
xor ecx, ecx
mov edx, 0x7f
call fcn.004074c0
push 0x7f
lea eax, [ebx + 4]
call fcn.0040a3fc
push eax
mov eax, dword [ebx]
call fcn.0040acb4
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov eax, dword [ebx + 4]
call fcn.0040acb4
call fcn.0040a360
mov edi, eax
mov dword [ebx + 8], edi
lea eax, [ebx + 4]
mov edx, edi
call fcn.0040ae48
inc esi
add ebx, 0xc
cmp esi, 0x1a
jne 0x6bfe19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bfeae
lea eax, [ebp - 4]
call fcn.00409e3c
ret
Function at 0x6c228c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c23a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b16c0
mov esi, eax
lea edx, [ebp - 0x1c]
mov eax, dword [edi + 0x18]
add eax, 4
call fcn.006c1bd4
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0xc]
call fcn.0040a2c0
lea ecx, [ebp - 0x20]
mov eax, dword [edi + 0x18]
add eax, 0xc
mov dl, 1
call fcn.006c1cac
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x14]
mov ecx, 0
call fcn.0040aa28
lea eax, [edi + 4]
lea edx, [ebp - 8]
push edx
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.00429bb4
fstp qword [esi + 0x18]
wait
lea eax, [esi + 0x28]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x14]
mov ecx, 0
call fcn.0040a5c4
lea eax, [esi + 0x2c]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x20]
mov ecx, 0
call fcn.0040a5c4
lea ecx, [ebp - 0x24]
mov eax, dword [edi + 0x18]
add eax, 0x2c
xor edx, edx
call fcn.006c1cac
mov edx, dword [ebp - 0x24]
lea eax, [esi + 0x30]
mov ecx, 0
call fcn.0040aa28
mov ebx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
dec eax
test eax, eax
jl 0x6c2384
inc eax
mov edi, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x6c2381
mov edx, dword [esi + 0x24]
xchg edx, eax
call fcn.006c2564
add ebx, 0x3c
dec edi
jne 0x6c236e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c23ae
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00409e9c
lea eax, [ebp - 0x1c]
call fcn.00409e60
ret
Function at 0x6c2564
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c26cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b16c0
mov ebx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [ebx + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.006c1b6c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
call fcn.0040a2c0
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 4
mov eax, esi
call fcn.006c1b6c
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0xc]
call fcn.0040a2c0
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 1
mov eax, esi
call fcn.006c1b6c
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x14]
call fcn.0040a2c0
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0xc]
add eax, 4
mov dl, 1
call fcn.006c1cac
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x28]
mov ecx, 0
call fcn.0040aa28
mov eax, dword [esi + 0xc]
add eax, 0x20
lea edx, [ebp - 8]
push edx
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.00429bb4
fstp qword [ebx + 0x18]
wait
mov eax, dword [esi + 0xc]
add eax, 0x28
lea edx, [ebp - 8]
push edx
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.00429bb4
fstp qword [ebx + 0x20]
wait
lea eax, [ebx + 0x30]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0xc]
mov ecx, 0
call fcn.0040a5c4
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xc]
add eax, 0x44
xor edx, edx
call fcn.006c1cac
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x34]
mov ecx, 0
call fcn.0040aa28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c26d4
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00409e9c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00409ecc
ret

Function at 0x6c39a8
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c3a4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409e3c
mov eax, ebx
mov edx, 0x104
call fcn.0040ae48
mov eax, dword [ebx]
mov edx, 0x208
call fcn.004ec798
push 0
push 0x26
mov eax, dword [ebx]
call fcn.0040acb4
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x6c3a1a
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00425440
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042db44
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, 0x6c3a68
call fcn.0040af20
cmp dword [ebx], 0
jne 0x6c3a33
mov ecx, 0x17c
mov edx, 0x6c3a98
mov eax, 0x6c3b38
call fcn.00409c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c3a55
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e9c
ret
Function at 0x6c6ae4
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x6c6b60
cmp dword [esp + 0x10], 0x1000
jne 0x6c6b60
cmp dword [esp + 4], 0
je 0x6c6b60
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA
test eax, eax
je 0x6c6b60
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x6c6b60
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x6c6b60
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6ca254
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ca3b5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [edi + 0x10], 0
je 0x6ca397
cmp word [edi + 0x1e], 2
jb 0x6ca397
movzx edx, word [edi + 0x1e]
sub edx, 2
sar edx, 1
jns 0x6ca2a8
adc edx, 0
mov eax, esi
call fcn.0040ae48
lea eax, [ebp - 8]
push eax
movzx eax, word [edi + 0x1e]
sub eax, 2
push eax
mov eax, dword [esi]
push eax
mov eax, dword [edi + 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x6ca2dd
mov eax, dword [ebp - 8]
add eax, 2
movzx edx, word [edi + 0x1e]
cmp eax, edx
je 0x6ca2e1
xor ebx, ebx
jmp 0x6ca2e3
mov bl, 1
test bl, bl
je 0x6ca397
mov eax, dword [esi]
call fcn.0040acb4
mov edx, eax
mov eax, esi
call fcn.0040ad1c
mov edx, dword [esi]
mov eax, 0x6ca3d4
call fcn.005bb6d4
test al, al
je 0x6ca31e
mov eax, esi
mov ecx, 4
mov edx, 1
call fcn.0040b0d8
jmp 0x6ca397
mov edx, dword [esi]
mov eax, 0x6ca3ec
call fcn.005bb744
test al, al
je 0x6ca384
push 0x104
lea eax, [ebp - 0x212]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x218]
push eax
mov eax, dword [esi]
mov ecx, 0x7fffffff
mov edx, 0x15
call fcn.0040b090
mov eax, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040ad70
mov edx, dword [ebp - 0x21c]
mov eax, esi
pop ecx
call fcn.0040af20
jmp 0x6ca397
mov eax, dword [esi]
call fcn.0040acb4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca3bc
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00409e9c
ret
Function at 0x6ca418
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409f30
xor eax, eax
push ebp
push 0x6ca598
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040a8ec
push eax
call fcn.005205f0
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, ebx
and dl, 0xff
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x170]
call fcn.0040a514
lea eax, [ebp - 0x174]
mov edx, 0xff00
and edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x170]
mov cl, 2
call fcn.0040a53c
lea edx, [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a638
mov eax, dword [ebp - 8]
mov edx, 0x6ca5b4
call fcn.0040a86c
jne 0x6ca4e3
mov bl, 1
jmp 0x6ca56d
mov eax, dword [ebp - 8]
mov edx, 0x6ca5c4
call fcn.0040a86c
jne 0x6ca4f6
mov bl, 2
jmp 0x6ca56d
mov eax, dword [ebp - 8]
mov edx, 0x6ca5d4
call fcn.0040a86c
jne 0x6ca515
mov eax, ebx
call fcn.00414664
test ax, ax
jne 0x6ca515
mov bl, 3
jmp 0x6ca56d
mov eax, dword [ebp - 8]
mov edx, 0x6ca5d4
call fcn.0040a86c
jne 0x6ca534
mov eax, ebx
call fcn.00414664
test ax, ax
jbe 0x6ca534
mov bl, 4
jmp 0x6ca56d
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 4]
call fcn.0040ad8c
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.004271b4
mov eax, dword [ebp - 0x178]
mov edx, 0x6ca5e4
call fcn.005bb01c
test al, al
je 0x6ca56b
mov bl, 1
jmp 0x6ca56d
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca59f
lea eax, [ebp - 0x17c]
mov edx, 2
call fcn.00409e9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ecc
ret
Function at 0x6ca600
Capabilities:
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409f30
xor eax, eax
push ebp
push 0x6ca732
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4010
cmp byte [ebp - 9], 0
je 0x6ca64b
or esi, 1
jmp 0x6ca64e
or esi, 0
test bl, bl
je 0x6ca6bc
lea eax, [ebp - 0x174]
mov edx, dword [ebp - 4]
call fcn.0040ad8c
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.004271f0
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040aa28
mov edx, 0x6ca750
mov eax, dword [ebp - 8]
call fcn.005bafbc
test al, al
jne 0x6ca6aa
mov edx, 0x6ca764
mov eax, dword [ebp - 8]
call fcn.005bafbc
test al, al
jne 0x6ca6aa
xor ebx, ebx
jmp 0x6ca6ac
mov bl, 1
test bl, bl
je 0x6ca6bc
or esi, 0x100
or esi, 0x8000
push esi
push 0x160
lea eax, [ebp - 0x169]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a8ec
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
push eax
push edi
call fcn.005205f0
mov esi, eax
test esi, esi
jne 0x6ca6ea
xor ebx, ebx
jmp 0x6ca707
test bl, bl
je 0x6ca6f6
mov ebx, dword [ebp - 0x169]
jmp 0x6ca707
push 0
mov eax, dword [ebp - 0x165]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIcon
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca739
lea eax, [ebp - 0x174]
mov edx, 2
call fcn.00409e9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ecc
ret
Function at 0x6d9748
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
mov esi, eax
push 0x6d97bc
push 0x6d97c0
push 0
push 0x6d97bc
push 0x6d97dc
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
test ebx, ebx
je 0x6d978d
mov eax, ebx
call fcn.006d77cc
mov edx, eax
test edx, edx
je 0x6d9783
sub edx, 0xffffff9c
mov eax, esi
call fcn.0040da80
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6d60e4]
call fcn.006d7a24
mov edx, eax
test edx, edx
je 0x6d97b2
sub edx, 0xffffff9c
mov eax, esi
call fcn.0040da80
pop esi
pop ebx
ret

Function at 0x6da750
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6da869
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.005bfce8
test al, al
je 0x6da84b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x81], 0
jne 0x6da81d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
xor eax, eax
push ebp
push 0x6da816
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x78], 0
je 0x6da7f2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x6da7f2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x94]
test eax, eax
je 0x6da800
mov eax, dword [ebp - 4]
push eax
push 0x6da644
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x94]
push eax
call sub.user32.dll_EnumThreadWindows
jmp 0x6da800
mov eax, dword [ebp - 4]
push eax
push 0x6da644
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6da84b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
ret
lea eax, [ebp - 0x10]
mov edx, dword [0x7712c8]
mov ecx, 0
call fcn.0040a5c4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0040ad8c
mov ecx, dword [ebp - 0xc]
mov edx, 0x30000
mov eax, dword [ebp - 4]
call fcn.005bf628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6da870
lea eax, [ebp - 0x10]
call fcn.00409e60
lea eax, [ebp - 0xc]
call fcn.00409e3c
ret
Function at 0x6e1864
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6e186c
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6e19db
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x54], 0
jne 0x6e19a4
mov eax, ebx
call fcn.005bfce8
test al, al
je 0x6e19a4
mov eax, dword [ebx + 0x38]
mov edx, dword [eax]
call dword [edx + 0x94]
mov esi, eax
call sub.kernel32.dll_GetCurrentProcessId
cmp esi, eax
je 0x6e18cc
lea eax, [ebp - 0x30]
call fcn.005c2330
cmp byte [ebp - 0x20], 0
je 0x6e18dc
cmp dword [ebx + 0x3c], 0x80000000
jb 0x6e18dc
mov eax, dword [ebx + 0x3c]
call fcn.005c3034
mov dword [ebx + 0x54], eax
jmp 0x6e1990
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x38]
call fcn.0040da80
lea ecx, [ebp - 8]
mov edx, 0x10
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xbc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x6e196f
push 2
lea ecx, [ebp - 0xa]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6e1990
cmp word [ebp - 0xa], 0x5a4d
jne 0x6e1990
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x3c]
add edx, 0x3c
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6e1990
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebx + 0x54], eax
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x54]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6e1968
cmp dword [ebp - 0x10], 0x4550
je 0x6e1990
xor eax, eax
mov dword [ebx + 0x54], eax
jmp 0x6e1990
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.005bf628
cmp dword [ebx + 0x54], 0
jne 0x6e19a4
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.005bf628
mov ebx, dword [ebx + 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e19e2
lea eax, [ebp - 0x34]
call fcn.00409e3c
lea eax, [ebp - 0x30]
mov edx, dword [0x5c1d9c]
call fcn.0040b68c
lea eax, [ebp - 8]
call fcn.0040da68
lea eax, [ebp - 4]
call fcn.0040da68
ret