joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47294a
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x46ce24]
imul eax, eax, 0x28
mov ecx, dword [eax + ecx + 0x24]
test ecx, 0x20000000
je 0x472985
test ecx, 0x40000000
je 0x47297e
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x472996
mov eax, 0x10
jmp 0x472996
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x4729a3
add eax, 0x200
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403e59
pop dword [ebp - 0x28]
mov eax, 0x403e59
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x880115e
add dword [ebp - 0x38], 0x45d233ed
mov dword [ebp - 0x34], 0x6d3d5786
sub dword [ebp - 0x34], 0x3b0a0b41
mov dword [ebp - 0x30], 0xe52e6b5b
add dword [ebp - 0x30], 0x671dd8d3
mov dword [ebp - 0x2c], 0x4e0c04a1
sub dword [ebp - 0x2c], 0x4e0c04a1
lea eax, [ebp - 0x38]
push eax
mov eax, 0x432f299f
add eax, 0xbd1146c5
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xdabcd279
add dword [ebp - 0x38], 0x99b596dd
mov dword [ebp - 0x34], 0x1a3c6d4a
sub dword [ebp - 0x34], 0xd8d00bd5
mov dword [ebp - 0x30], 0xbfdddee3
sub dword [ebp - 0x30], 0x5c6e7277
mov dword [ebp - 0x2c], 0xc6b695eb
sub dword [ebp - 0x2c], 0xc6b695eb
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x32019
push 0
call eax
mov ecx, 0xb0fefda8
sub ecx, 0xb0fec89f
mov edx, eax
mov ebx, 0xc2ff7c41
add ebx, 0x3d4183bf
add ebx, dword [ebp - 0x28]
mov esi, 0xf2e710c6
sub dword [ebp - 0x24], edi
mov edi, dword [ebx]
xor dword [ebp - 0x24], 0x4be1cd20
add edi, esi
sub dword [ebp - 0x10], edx
mov dword [edx], edi
sub dword [ebp - 0xc], 0x3e3c00e4
add edx, 4
add ebx, 0x9b856595
add ebx, 0x647a9a6f
loop 0x403f6b
add eax, 0xc6f7
xor ebx, ebx
add ebx, eax
add eax, 0x1c66d3c7
add eax, 0xe3992c3e
mov ecx, 0xe57d2290
sub ecx, 0xe53d2290
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401020
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], 0x22
jne 0x4010b0
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x401053
cmp ax, 0x22
je 0x401059
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401041
cmp word [esi], 0x22
jne 0x40105c
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x401076
cmp ax, 0x20
ja 0x401076
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401064
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
movzx eax, word [ebp - 0x14]
jne 0x401096
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp word [esi], 0x20
jbe 0x40105c
add esi, 2
jmp 0x4010b0
Function at 0x4028a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4028b1
pop dword [ebp - 0x14]
mov eax, 0x4028b1
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x42a6c56b
add dword [ebp - 0x24], 0xbab7fe0
mov dword [ebp - 0x20], 0x63e50fcc
sub dword [ebp - 0x20], 0x31b1c387
mov dword [ebp - 0x1c], 0x2184c9b0
add dword [ebp - 0x1c], 0x2ac77a7e
mov dword [ebp - 0x18], 0x7b006959
add dword [ebp - 0x18], 0x84ff96a7
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x2f86b348
sub dword [ebp - 0x24], 0xbb1449f2
mov dword [ebp - 0x20], 0x375f15dd
add dword [ebp - 0x20], 0xa0d4b98
mov dword [ebp - 0x1c], 0x8b0e437e
sub dword [ebp - 0x1c], 0x279ed712
mov dword [ebp - 0x18], 0x237b0d2e
sub dword [ebp - 0x18], 0x237b0d2e
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xb7285947
add eax, 0x491816d9
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3997c
push 0
call eax
mov ecx, 0x4f82
xor edx, edx
add edx, eax
mov ebx, 0x739165d2
sub ebx, 0x73509dd2
add ebx, dword [ebp - 0x14]
mov esi, 0xfd015a47
sub esi, 0x9dc8ecff
xor dword [ebp - 0xc], 0xeb7e90d8
mov edi, dword [ebx]
xor dword [ebp - 4], 0x1684ceb2
sub edi, esi
add dword [ebp - 8], 0xedfe94dd
mov dword [edx], edi
sub dword [ebp - 4], esi
add edx, 4
add ebx, 0x4beacaa4
add ebx, 0xb4153560
loop 0x4029c5
add eax, 0xed24c8d2
add eax, 0x12dc6809
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004028a2
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004028a2
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x10007b10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1006c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x10056c98]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x10056c9c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x10056c80]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x10056c90]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10007be0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x10007ba9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x10007bf6
inc ax
mov word [ebp - 0xa], ax
jmp 0x10007bbf
cmp eax, 0xe7
jne 0x10007bf6
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x10007bf6
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10007b90
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
Function at 0x10007c10
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x10007c54
push 0x62
push str.C:Users_tobiaDownloadsHermioneHermionecorediscord_rpcSourceFilesconnection_win.cpp
push 0x10056d64
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret 8
test esi, esi
jne 0x10007c81
push 0x67
push str.C:Users_tobiaDownloadsHermioneHermionecorediscord_rpcSourceFilesconnection_win.cpp
push str.self
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
push edi
cmp eax, 0xffffffff
je 0x10007d1c
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10007d09
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 8], edi
jb 0x10007d1c
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x10007d00
cmp edi, dword [ebp - 0xc]
je 0x10007ceb
push 0x74
push str.C:Users_tobiaDownloadsHermioneHermionecorediscord_rpcSourceFilesconnection_win.cpp
push str.bytesToRead__bytesRead
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.10007aa0
jmp 0x10007d1c
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
mov byte [esi], 0
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004ea63
mov esp, ebp
pop ebp
ret 8

Function at 0x10007d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10007dc1
test ecx, ecx
jne 0x10007d87
push 0x4f
push str.C:Users_tobiaDownloadsHermioneHermionecorediscord_rpcSourceFilesconnection_win.cpp
push str.self
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
je 0x10007d74
test eax, eax
jne 0x10007da1
push 0x56
push str.C:Users_tobiaDownloadsHermioneHermionecorediscord_rpcSourceFilesconnection_win.cpp
push 0x10056d64
jmp 0x10007d6b
push 0
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10007d74
cmp dword [ebp - 8], esi
jne 0x10007d74
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1004ea63
mov esp, ebp
pop ebp
ret 8
Function at 0x100081c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x1006c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa94]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10008234
push str.Error_opening_Steam_key_n
jmp 0x100082f4
lea eax, [ebp - 0xa90]
mov dword [ebp - 0xa90], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa94]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100082ef
mov ecx, dword [ebp - 0xa90]
cmp ecx, 1
jb 0x100082ef
shr ecx, 1
mov eax, esi
je 0x100082a8
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x100082a3
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x10008290
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.100080d0
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10007de0
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10008330
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
Function at 0x1000a2a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
push 0x100641bc
push 0x64
call fcn.1004ea94
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000a44b
push 0x64
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
lea eax, [ebx + 4]
mov byte [ebx], 1
mov dword [eax + 4], 0
xorps xmm0, xmm0
mov dword [eax + 8], 0
movups xmmword [eax + 0xc], xmm0
push 2
movq qword [eax + 0x1c], xmm0
mov dword [eax + 0x24], 0
push eax
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
call sub.MSVCP140.dll__Mtx_init_in_situ
lea eax, [ebx + 0x34]
push eax
call sub.MSVCP140.dll__Cnd_init_in_situ
add esp, 0x18
mov dword [0x10092bec], ebx
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
movq qword [ebx + 0x5c], xmm0
je 0x1000a34c
test esi, esi
je 0x1000a341
cmp byte [esi], 0
je 0x1000a341
push esi
push edi
call fcn.100081c0
jmp 0x1000a349
push 0
push edi
call fcn.10008140
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x1006d4f0
mov dword [0x10092be8], eax
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
jne 0x1000a45c
cmp dword [0x1006d51c], 0x7fffffff
je 0x1000a463
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000a393
movups xmm0, xmmword [eax]
movups xmmword [0x1008e598], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x1000a39d
xorps xmm0, xmm0
movups xmmword [0x1008e598], xmm0
movq qword [0x1008e5a8], xmm0
xorps xmm0, xmm0
push 0x1006d4f0
movups xmmword [0x1008e5b0], xmm0
movq qword [0x1008e5c0], xmm0
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
cmp dword [0x1008e594], 0
jne 0x1000a455
push edi
call fcn.1000bf20
mov dword [0x1008e594], eax
mov dword [eax + 8], 0x10008360
mov eax, dword [0x1008e594]
mov dword [eax + 0xc], 0x10008380
mov al, 1
mov esi, dword [0x10092bec]
xchg byte [esi], al
push 4
call fcn.1004e62b
add esp, 8
test eax, eax
je 0x1000a40b
mov dword [eax], esi
jmp 0x1000a40d
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10008420
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1000a474
cmp dword [esi + 0x60], 0
je 0x1000a43b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 4]
pop edi
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x10092bec], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [0x1006d51c], 0x7ffffffe
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x10020950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050990
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1006c8c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x100a2d60]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x100a2d5c]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov edi, eax
test edi, edi
je 0x10020aa5
mov edx, dword [0x100a3780]
test edx, edx
jne 0x100209d6
push 0xe80c2f78
push 0x10059f45
call fcn.10011090
push 0xc10bf213
push 0x10058ae5
mov esi, eax
call fcn.10011090
push esi
push eax
call fcn.1004bc90
mov edx, eax
add esp, 0x18
mov dword [0x100a3780], edx
mov ecx, dword [0x100a2d5c]
push dword [edx + edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov edi, eax
test edi, edi
je 0x10020aa5
mov eax, dword [0x100a3784]
test eax, eax
jne 0x10020a28
push 0xe80c2f78
push 0x10059f65
call fcn.10011090
push 0xc10bf213
push 0x10059d01
mov esi, eax
call fcn.10011090
push esi
push eax
call fcn.1004bc90
add esp, 0x18
mov dword [0x100a3784], eax
mov edx, dword [eax + edi]
test edx, edx
je 0x10020aa5
mov ecx, dword [0x100a2d5c]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
cmp eax, dword [ebp + 8]
jne 0x10020aa5
mov ecx, dword [0x100a2d68]
push dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ebx, eax
mov eax, dword [0x100a3758]
test eax, eax
jne 0x10020a8c
push 0xe80c2f78
push 0x10059cf1
call fcn.10011090
push 0xc10bf213
push 0x10059d01
mov esi, eax
call fcn.10011090
push esi
push eax
call fcn.1004bc90
add esp, 0x18
mov dword [0x100a3758], eax
mov dword [eax + edi], ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10027e70
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005198d
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x1006c8c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push 2
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x250], eax
push ecx
push eax
mov dword [ebp - 0x248], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x10027f00
mov byte [ebp - 0x249], al
jmp 0x10028021
xorps xmm0, xmm0
mov dword [ebp - 0x258], 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x254], 0
movups xmmword [ebp - 0x268], xmm0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10027f27
sub eax, edx
lea ecx, [ebp - 0x268]
sar eax, 1
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.100262b0
mov edi, dword [ebp - 0x254]
lea eax, [ebp - 0x268]
mov esi, dword [ebp - 0x268]
cmp edi, 7
cmova eax, esi
cmp dword [ebp - 0x258], 0xb
jne 0x10027f85
push 0xb
push str.Spotify.exe
push eax
call fcn.100266e0
add esp, 0xc
mov byte [ebp - 0x249], 1
test eax, eax
je 0x10027f8c
mov byte [ebp - 0x249], 0
cmp edi, 7
jbe 0x10027fc0
lea ecx, [edi*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x10027fb6
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002804a
push ecx
push esi
call fcn.1004e65b
add esp, 8
cmp byte [ebp - 0x249], 0
je 0x10027fef
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
je 0x10027fdf
mov eax, dword [ebp - 0x240]
mov dword [ecx], eax
add dword [ebp - 0x18], 4
jmp 0x10027fef
lea eax, [ebp - 0x240]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10026360
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10027f00
lea eax, [ebp - 0x1c]
push eax
push 0x10026ba0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
setne byte [ebp - 0x249]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x1002805a
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10028050
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10028050
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1004e65b
add esp, 8
mov al, byte [ebp - 0x249]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
Function at 0x10031670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003172c
cmp byte [esi + 0x3d], 0
je 0x1003172c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003171a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100316e1
sub eax, 1
je 0x100316e5
sub eax, 2
jne 0x1003171a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031703
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003171a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ea63
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1004ea63
mov esp, ebp
pop ebp
ret