joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001590
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1000f1c0]
mov dword [ebp - 8], eax
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 8]
push eax
push 0x1000d180
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001702
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 0x358]
and ecx, 0x10
je 0x10001667
mov al, 0x16
mov al, 0x72
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x2e
je 0x10001665
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x32c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1000d188
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.10001590
add esp, 0xc
test eax, eax
je 0x10001665
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001716
jmp 0x100016e1
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x32c]
push edx
call fcn.10001040
add esp, 8
test eax, eax
je 0x100016e1
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x32c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1000d190
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x218]
push ecx
push 0x1000f468
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001716
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100015e7
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
xor eax, eax
mov ecx, dword [ebp - 8]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10001730
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1000f1c0]
mov dword [ebp - 8], eax
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 8]
push eax
push 0x1000d198
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001832
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 0x358]
and ecx, 0x10
je 0x10001811
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x32c]
push eax
call fcn.10001040
add esp, 8
test eax, eax
je 0x10001811
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x1000d1a0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.10001590
add esp, 0xc
test eax, eax
je 0x1000180d
mov eax, 1
jmp 0x10001846
xor eax, eax
jmp 0x10001846
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10001787
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
xor eax, eax
mov ecx, dword [ebp - 8]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10001860
Capabilities:
Create process on windows
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1000f1c0]
mov dword [ebp - 8], eax
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 8]
push eax
push 0x1000d1a8
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001a0e
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 0x358]
and ecx, 0x10
je 0x1000193a
mov al, 0x16
mov al, 0x72
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x2e
je 0x10001935
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x32c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1000d1b0
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.10001860
add esp, 0xc
test eax, eax
je 0x10001935
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001a22
jmp 0x100019f1
mov al, 0x16
mov al, 0x72
push str..lnk
lea ecx, [ebp - 0x32c]
push ecx
call fcn.10001040
add esp, 8
test eax, eax
je 0x100019f1
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x32c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1000d1c0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.10001470
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100019f1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x218]
push eax
push 0x10010270
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, 0x16
mov al, 0x72
push 1
push 0x1000d1c6
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0x1000d1c7
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x100019ed
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001a22
xor eax, eax
jmp 0x10001a22
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100018b7
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
xor eax, eax
mov ecx, dword [ebp - 8]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10001a30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1000f1c0]
mov dword [ebp - 8], eax
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 8]
push eax
push 0x1000d1c8
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001ba4
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 0x358]
and ecx, 0x10
je 0x10001b83
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x32c]
push eax
call fcn.10001040
add esp, 8
test eax, eax
je 0x10001b1b
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x1000d1d0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.10001860
add esp, 0xc
test eax, eax
je 0x10001b14
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001bb8
xor eax, eax
jmp 0x10001bb8
mov al, 0x16
mov al, 0x72
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x2e
je 0x10001b83
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x32c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1000d1d8
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.10001a30
add esp, 0xc
test eax, eax
je 0x10001b83
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x10001bb8
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x358]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10001a87
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
xor eax, eax
mov ecx, dword [ebp - 8]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10001bd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1000f1c0]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp + 8]
push ecx
push str._s
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001dbc
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x358]
and edx, 0x10
je 0x10001d9f
mov al, 0x16
mov al, 0x72
push str.Start_Menu
lea eax, [ebp - 0x32c]
push eax
call fcn.10001040
add esp, 8
test eax, eax
je 0x10001cc5
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x1000d1f4
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.10001a30
add esp, 0xc
test eax, eax
je 0x10001cbe
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001dd0
xor eax, eax
jmp 0x10001dd0
mov al, 0x16
mov al, 0x72
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x2e
je 0x10001d9f
cmp dword [ebp + 0xc], 2
jle 0x10001d3f
push str.AppData
lea eax, [ebp - 0x32c]
push eax
call fcn.1000c37d
add esp, 8
test eax, eax
je 0x10001d3f
push str.Roaming
lea ecx, [ebp - 0x32c]
push ecx
call fcn.1000c37d
add esp, 8
test eax, eax
je 0x10001d3f
push str.Microsoft
lea edx, [ebp - 0x32c]
push edx
call fcn.1000c37d
add esp, 8
test eax, eax
je 0x10001d3f
push str.Windows
lea eax, [ebp - 0x32c]
push eax
call fcn.1000c37d
add esp, 8
test eax, eax
jne 0x10001d9f
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.10001bd0
add esp, 0x10
test eax, eax
je 0x10001d9f
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10001dd0
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10001c30
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 0x16
mov al, 0x72
xor eax, eax
mov ecx, dword [ebp - 8]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10001de0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 8], eax
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx + 0x14]
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx + 8]
mov al, 0x16
mov al, 0x72
push 0x1000d228
mov eax, dword [ebp + 0xc]
push eax
call fcn.100089b0
add esp, 8
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100024c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1000f1c0]
mov dword [ebp - 4], eax
mov al, 0x16
mov al, 0x72
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
mov al, 0x16
mov al, 0x72
cmp dword [ebp - 0x134], 0xffffffff
jne 0x100024fc
mov al, 0x16
mov al, 0x72
xor eax, eax
jmp 0x10002599
mov dword [ebp - 0x130], 0x128
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000253a
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0x16
mov al, 0x72
xor eax, eax
jmp 0x10002599
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp + 8]
jne 0x10002567
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp + 0xc]
jmp 0x10002599
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000253a
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0x16
mov al, 0x72
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10002c00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
call fcn.100026a0
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.wixyt2ii
push 0x1000f104
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001e70
add esp, 8
push eax
call fcn.10001bd0
add esp, 0x10
test eax, eax
jne 0x10002c73
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x10002e34
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10002e32
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x10002d92
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10002d09
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x10002d3d
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f460], 0
mov al, 0x16
mov al, 0x72
jmp 0x10002d82
cmp dword [ebp - 0x21c], 0
jne 0x10002d63
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov al, 0x16
mov al, 0x72
mov dword [0x1000f460], 0
jmp 0x10002d82
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x100026c0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
push 0x10010270
call fcn.10001360
add esp, 4
test eax, eax
jne 0x10002dc3
mov al, 0x16
mov al, 0x72
mov byte [0x10010470], 1
movzx eax, byte [0x10010470]
test eax, eax
je 0x10002e0b
cmp dword [ebp - 0x228], 0
jne 0x10002df2
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
mov al, 0x16
mov al, 0x72
jmp 0x10002e0b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10002e0b
mov al, 0x16
mov al, 0x72
mov eax, 1
jmp 0x10002e34
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10002e21
xor eax, eax
jmp 0x10002e34
mov al, 0x16
mov al, 0x72
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002cb9
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x100042f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
call fcn.100026a0
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.MrwxWxyf2ii
push str.rsvxsr
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001e70
add esp, 8
push eax
call fcn.10001bd0
add esp, 0x10
test eax, eax
jne 0x10004363
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x10004510
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x1000450e
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x10004476
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x100043f9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x10004429
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f460], 0
jmp 0x1000446a
cmp dword [ebp - 0x21c], 0
jne 0x1000444b
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov dword [0x1000f460], 0
jmp 0x1000446a
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x10003e20
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
push 0x10010270
call fcn.10001360
add esp, 4
test eax, eax
jne 0x100044a7
mov al, 0x16
mov al, 0x72
mov byte [0x10010479], 1
movzx eax, byte [0x10010479]
test eax, eax
je 0x100044e7
cmp dword [ebp - 0x228], 0
jne 0x100044d2
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x4e20
mov dword [ebp - 0x228], eax
jmp 0x100044e7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x100044e7
mov eax, 1
jmp 0x10004510
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x100044fd
xor eax, eax
jmp 0x10004510
mov al, 0x16
mov al, 0x72
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100043a9
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10004ae0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
call fcn.100026a0
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.geppqwm2ii
push str.iwix
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001e70
add esp, 8
push eax
call fcn.10001bd0
add esp, 0x10
test eax, eax
jne 0x10004b53
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x10004cec
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10004cea
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x10004c6e
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10004bed
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x10004c1d
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f460], 0
jmp 0x10004c5e
cmp dword [ebp - 0x21c], 0
jne 0x10004c3f
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov dword [0x1000f460], 0
jmp 0x10004c5e
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x10004520
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
movzx eax, byte [0x10010488]
test eax, eax
je 0x10004cc3
cmp dword [ebp - 0x228], 0
jne 0x10004cae
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x10004cc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10004cc3
mov eax, 1
jmp 0x10004cec
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10004cd9
xor eax, eax
jmp 0x10004cec
mov al, 0x16
mov al, 0x72
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10004b99
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret