joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b280
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0xf8
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
jmp 0x1005b2be
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 6]
cmp dword [ebp - 4], edx
jge 0x1005b314
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax + 0x24]
and edx, 0x20000000
je 0x1005b312
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax + 0x24]
and edx, 0x2000000
jne 0x1005b312
push 0x100f9e08
imul eax, dword [ebp - 4], 0x28
add eax, dword [ebp - 8]
push eax
call fcn.100adfd8
add esp, 8
test eax, eax
jne 0x1005b312
mov dword [ebp - 0x18], 1
jmp 0x1005b314
jmp 0x1005b2b5
cmp dword [ebp - 0x18], 0
jne 0x1005b321
xor eax, eax
jmp 0x1005b3f8
cmp dword [ebp + 0xc], 0
je 0x1005b362
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x1005b35b
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0xc]
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp - 8]
add eax, dword [edx + ecx + 0x10]
sub eax, dword [ebp + 0x10]
cmp dword [ebp + 0xc], eax
jbe 0x1005b362
xor eax, eax
jmp 0x1005b3f8
cmp dword [ebp + 0xc], 0
jne 0x1005b37b
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x1c], edx
jmp 0x1005b381
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
jmp 0x1005b399
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 8]
add edx, dword [ecx + eax + 0x10]
sub edx, dword [ebp + 0x10]
cmp dword [ebp - 0xc], edx
jae 0x1005b3f6
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx]
cmp eax, 0xcc
jne 0x1005b3d2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x1005b3f4
cmp dword [ebp - 0x10], 5
jl 0x1005b3ed
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x28]
cmp dword [ebp - 0xc], eax
je 0x1005b3ed
mov eax, dword [ebp - 0xc]
jmp 0x1005b3f8
mov dword [ebp - 0x10], 0
jmp 0x1005b390
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1005b400
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x101466b8]
test eax, eax
je 0x1005b51c
mov byte [ebp - 0xc], 0xb8
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0xff
mov byte [ebp - 6], 0xe0
push 7
mov ecx, dword [0x1014688c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1005b280
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1005b51c
mov dword [ebp - 0x18], 0
push 1
push 0x1f
call fcn.100adf4a
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xb], 0x1005b1b0
push 7
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call fcn.100a5270
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 8
push edx
push 0x40
push 7
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1005b510
push 0
push 7
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1005b510
mov eax, dword [ebp - 0x14]
mov dword [0x1014688c], eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1005b532
mov eax, dword [ebp - 0x10]
push eax
call fcn.100a9867
add esp, 4
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret 8
Function at 0x1005b550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10137bc8
push 0x100a7d70
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdf0
mov eax, dword [0x1013dd8c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x21c], 0
push 0x1ff
push 0
lea eax, [ebp - 0x21b]
push eax
call fcn.100a57f0
add esp, 0xc
call fcn.10010410
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1fe
lea ecx, [ebp - 0x21c]
push ecx
call fcn.1005b640
mov dword [ebp - 4], 0xfffffffe
jmp 0x1005b5f0
push 1
push 0x100f9e20
lea edx, [ebp - 0x21c]
push edx
call fcn.100ae5c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x220], 0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005dc40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0x82
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1005dc88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.cannot_create_temporary_file__s__error0x_08x
call fcn.1005b550
add esp, 0xc
or eax, 0xffffffff
jmp 0x1005dcd9
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005dcb6
push str.cannot_write_data_into_temporary_file
call fcn.1005b550
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 1
jne 0x1005dccf
mov dword [ebp - 0xc], 0
jmp 0x1005dcd6
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1005dce0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.100a57f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
sub ecx, 1
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x318], 3
ja case.default.0x1005dd7b
mov edx, dword [ebp - 0x318]
jmp dword [edx*4 + 0x1005df04]
push 0x104
push str._SystemRoot_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x1005de04
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1005de04
push 0x104
push str._AppData_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
push 0x100fab37
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea edx, [ebp - 0x108]
push edx
call fcn.100a9980
add esp, 4
test eax, eax
jne 0x1005de3b
push 0x100fab5e
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x314]
or eax, 1
mov dword [ebp - 0x314], eax
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea ecx, [ebp - 0x108]
push ecx
call fcn.100a9980
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x1005de90
lea eax, [ebp - 0x108]
push eax
call fcn.100a9980
add esp, 4
sub eax, 1
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x104
jae 0x1005de7d
jmp 0x1005de82
call fcn.10066246
mov ecx, dword [ebp - 0x31c]
mov byte [ebp + ecx - 0x108], 0
mov ecx, dword [ebp + 0x10]
call fcn.10012400
push eax
lea edx, [ebp - 0x108]
push edx
push 0x100fabd0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.1004db60
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005dd82
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.100a57f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
sub ecx, 1
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x318], 3
ja case.default.0x1005dd7b
mov edx, dword [ebp - 0x318]
jmp dword [edx*4 + 0x1005df04]
push 0x104
push str._SystemRoot_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x1005de04
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1005de04
push 0x104
push str._AppData_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
push 0x100fab37
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea edx, [ebp - 0x108]
push edx
call fcn.100a9980
add esp, 4
test eax, eax
jne 0x1005de3b
push 0x100fab5e
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x314]
or eax, 1
mov dword [ebp - 0x314], eax
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea ecx, [ebp - 0x108]
push ecx
call fcn.100a9980
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x1005de90
lea eax, [ebp - 0x108]
push eax
call fcn.100a9980
add esp, 4
sub eax, 1
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x104
jae 0x1005de7d
jmp 0x1005de82
call fcn.10066246
mov ecx, dword [ebp - 0x31c]
mov byte [ebp + ecx - 0x108], 0
mov ecx, dword [ebp + 0x10]
call fcn.10012400
push eax
lea edx, [ebp - 0x108]
push edx
push 0x100fabd0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.1004db60
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005dd9d
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.100a57f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
sub ecx, 1
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x318], 3
ja case.default.0x1005dd7b
mov edx, dword [ebp - 0x318]
jmp dword [edx*4 + 0x1005df04]
push 0x104
push str._SystemRoot_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x1005de04
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1005de04
push 0x104
push str._AppData_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
push 0x100fab37
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea edx, [ebp - 0x108]
push edx
call fcn.100a9980
add esp, 4
test eax, eax
jne 0x1005de3b
push 0x100fab5e
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x314]
or eax, 1
mov dword [ebp - 0x314], eax
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea ecx, [ebp - 0x108]
push ecx
call fcn.100a9980
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x1005de90
lea eax, [ebp - 0x108]
push eax
call fcn.100a9980
add esp, 4
sub eax, 1
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x104
jae 0x1005de7d
jmp 0x1005de82
call fcn.10066246
mov ecx, dword [ebp - 0x31c]
mov byte [ebp + ecx - 0x108], 0
mov ecx, dword [ebp + 0x10]
call fcn.10012400
push eax
lea edx, [ebp - 0x108]
push edx
push 0x100fabd0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.1004db60
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005ddb1
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.100a57f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
sub ecx, 1
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x318], 3
ja case.default.0x1005dd7b
mov edx, dword [ebp - 0x318]
jmp dword [edx*4 + 0x1005df04]
push 0x104
push str._SystemRoot_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x1005de04
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1005de04
push 0x104
push str._AppData_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
push 0x100fab37
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea edx, [ebp - 0x108]
push edx
call fcn.100a9980
add esp, 4
test eax, eax
jne 0x1005de3b
push 0x100fab5e
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x314]
or eax, 1
mov dword [ebp - 0x314], eax
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea ecx, [ebp - 0x108]
push ecx
call fcn.100a9980
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x1005de90
lea eax, [ebp - 0x108]
push eax
call fcn.100a9980
add esp, 4
sub eax, 1
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x104
jae 0x1005de7d
jmp 0x1005de82
call fcn.10066246
mov ecx, dword [ebp - 0x31c]
mov byte [ebp + ecx - 0x108], 0
mov ecx, dword [ebp + 0x10]
call fcn.10012400
push eax
lea edx, [ebp - 0x108]
push edx
push 0x100fabd0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.1004db60
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005ddc5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.100a57f0
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.100a57f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
sub ecx, 1
mov dword [ebp - 0x318], ecx
cmp dword [ebp - 0x318], 3
ja case.default.0x1005dd7b
mov edx, dword [ebp - 0x318]
jmp dword [edx*4 + 0x1005df04]
push 0x104
push str._SystemRoot_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x1005de04
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1005de04
push 0x104
push str._AppData_
lea eax, [ebp - 0x108]
push eax
call fcn.100ae0c0
add esp, 0xc
jmp 0x1005de04
push 0x100fab37
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea edx, [ebp - 0x108]
push edx
call fcn.100a9980
add esp, 4
test eax, eax
jne 0x1005de3b
push 0x100fab5e
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x314]
or eax, 1
mov dword [ebp - 0x314], eax
mov eax, dword [ebp + 8]
jmp 0x1005def3
lea ecx, [ebp - 0x108]
push ecx
call fcn.100a9980
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x1005de90
lea eax, [ebp - 0x108]
push eax
call fcn.100a9980
add esp, 4
sub eax, 1
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x104
jae 0x1005de7d
jmp 0x1005de82
call fcn.10066246
mov ecx, dword [ebp - 0x31c]
mov byte [ebp + ecx - 0x108], 0
mov ecx, dword [ebp + 0x10]
call fcn.10012400
push eax
lea edx, [ebp - 0x108]
push edx
push 0x100fabd0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.1004db60
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x314]
or ecx, 1
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005e290
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 8], eax
push 0x100fac64
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005e2d0
push str.find_desktop_sign_window_failure___n
call fcn.1005b550
add esp, 4
xor eax, eax
jmp 0x1005e301
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x1005e2ed
cmp dword [ebp - 4], 0xffffffff
jne 0x1005e2fe
push str.get_desktop_process_failure
call fcn.1005b550
add esp, 4
xor eax, eax
jmp 0x1005e301
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1005e310
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.100a57f0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10012400
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10022ed0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret
Function at 0x1005e380
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp dword [ebp - 0x44], 0
ja 0x1005e3cd
push 0x100fab83
mov ecx, dword [ebp + 8]
call fcn.10012560
mov ecx, dword [ebp - 0x34]
or ecx, 1
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
jmp 0x1005e54c
push 1
mov edx, dword [ebp - 0x44]
push edx
call fcn.100adf4a
add esp, 8
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x1005e402
push 0x100fabb2
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x34]
or eax, 1
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
jmp 0x1005e54c
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1005e527
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1005e527
mov ecx, dword [ebp + 0xc]
call fcn.10012400
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x1b0
push ecx
call fcn.100adfd8
add esp, 8
test eax, eax
jne 0x1005e51a
mov byte [ebp - 0x18], 0
xor edx, edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov eax, dword [ebp - 0x3c]
add eax, 0x194
mov dword [ebp - 0x38], eax
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + edx]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + edx]
push ecx
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + eax]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + eax]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + eax]
push edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x38]
movzx eax, byte [edx + ecx]
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x14
lea ecx, [ebp - 0x18]
push ecx
call fcn.1004db60
add esp, 0x24
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x30]
call fcn.10012560
mov eax, dword [ebp - 0x40]
push eax
call fcn.100a9867
add esp, 4
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100124b0
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x30]
call fcn.10012470
mov eax, dword [ebp + 8]
jmp 0x1005e54c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov dword [ebp - 0x3c], ecx
jmp 0x1005e41d
mov edx, dword [ebp - 0x40]
push edx
call fcn.100a9867
add esp, 4
push 0x100fabb3
mov ecx, dword [ebp + 8]
call fcn.10012560
mov eax, dword [ebp - 0x34]
or eax, 1
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret