joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000154a
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2a4
mov eax, dword [0x10025014]
xor eax, esp
mov dword [esp + 0x2a0], eax
mov eax, dword [0x1002a9d0]
mov ecx, 0x20c
sub eax, dword [0x1002a9c8]
cdq
idiv ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp eax, 0x83000
jae 0x1000158a
push ecx
call fcn.10006241
mov ebx, 0x104
lea eax, [esp + 0x1a0]
push ebx
xor edi, edi
push edi
push eax
call fcn.1000a7f0
add esp, 0xc
lea eax, [esp + 0x1a0]
push ebx
push dword [esi]
push ebx
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1000e5b7
add esp, 0x14
lea eax, [esp + 0x1a0]
push edi
push 0x10001784
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExA]
mov dword [0x10028510], eax
test eax, eax
je 0x1000170c
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1000170c
push 0xfa0
mov esi, 0x100296e0
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
inc esi
push esi
push 2
pop ecx
call fcn.10001721
pop ecx
push edi
push 4
pop ecx
call fcn.10001721
pop ecx
call fcn.10001345
mov eax, dword [0x1002a9dc]
sub eax, dword [0x1002a9d4]
cdq
idiv ebx
mov dword [0x1002971c], esi
cmp eax, 0x10400
jae 0x1000164f
push ecx
mov ecx, 0x1002a9d4
call fcn.100061fc
mov eax, dword [0x1002a9e8]
sub eax, dword [0x1002a9e0]
cdq
idiv ebx
cmp eax, 0x10400
jae 0x1000166f
push ecx
mov ecx, 0x1002a9e0
call fcn.100061fc
mov eax, dword [0x1002a9fc]
sub eax, dword [0x1002a9f4]
cdq
idiv ebx
cmp eax, 0x10400
jae 0x1000168f
push ecx
mov ecx, 0x1002a9f4
call fcn.100061fc
push edi
push edi
push edi
push 0x100024c7
push edi
push edi
call fcn.1000c6ba
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002851c], esi
call fcn.10001442
test eax, eax
jne 0x100016da
push 0x4e20
push dword [0x10028520]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100016da
mov eax, dword [0x10029824]
cmp eax, 3
je 0x100016da
cmp eax, esi
jne 0x100016a8
push esi
push 3
pop ecx
mov dword [0x1002971c], edi
call fcn.10001721
pop ecx
push edi
mov ecx, esi
call fcn.10001721
pop ecx
mov esi, 0x100296e0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x2ac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10008f85
mov esp, ebp
pop ebp
ret
Function at 0x1000182e
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 8
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000185c
xor eax, eax
jmp 0x10001908
push 0x220
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x228], 0x224
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x100018ff
push edi
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.1000c96a
pop ecx
pop ecx
lea edx, [ebp - 0x208]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100018ab
sub edx, ecx
lea ecx, [ebp - 0x208]
call fcn.1000773e
mov eax, dword [str.ihspA.4__q]
xor edi, edi
jmp 0x100018e3
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.1000e032
pop ecx
pop ecx
test eax, eax
je 0x100018e9
mov eax, dword [edi*4 + 0x10025854]
inc edi
test eax, eax
jne 0x100018c8
jmp 0x100018ec
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1000188f
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x10001916
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
xor esi, esi
lea eax, [ebp - 0x33c]
push esi
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x340], 0x128
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x340]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp edi, 0xffffffff
jne 0x1000196f
xor eax, eax
jmp 0x100019d8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x31c]
push 0x104
push eax
call fcn.1000c96a
pop ecx
pop ecx
lea edx, [ebp - 0x31c]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001991
sub edx, ecx
lea ecx, [ebp - 0x31c]
call fcn.1000773e
push dword [0x10021a90]
lea eax, [ebp - 0x31c]
push eax
call ebx
test eax, eax
jne 0x100019e7
mov ecx, dword [ebp - 0x338]
call fcn.1000182e
cmp eax, 1
jne 0x10001aab
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
push dword [0x10021a94]
lea eax, [ebp - 0x31c]
push eax
call ebx
test eax, eax
je 0x100019cc
push dword [0x10021a98]
lea eax, [ebp - 0x31c]
push eax
call ebx
test eax, eax
je 0x100019cc
push dword [0x10021a9c]
lea eax, [ebp - 0x31c]
push eax
call ebx
test eax, eax
jne 0x10001aab
push 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1000a7f0
push 0x104
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.1000a7f0
mov ecx, dword [ebp - 0x338]
lea edx, [ebp - 0x218]
add esp, 0x18
call fcn.10006be8
cmp eax, 1
jne 0x10001aab
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x218]
call fcn.10006def
cmp eax, 1
jne 0x10001aab
lea edx, [ebp - 0x110]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001a80
sub edx, ecx
lea ecx, [ebp - 0x110]
call fcn.1000773e
push dword [0x10021ab8]
lea eax, [ebp - 0x110]
push eax
call ebx
test eax, eax
jne 0x100019cc
lea eax, [ebp - 0x340]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10001975
jmp 0x100019cf
Function at 0x10001ac6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
xor esi, esi
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x130], 0x128
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp edi, 0xffffffff
jne 0x10001b1f
xor eax, eax
jmp 0x10001b99
lea eax, [ebp - 0x10c]
push 0x104
push eax
call fcn.1000c96a
pop ecx
pop ecx
lea edx, [ebp - 0x10c]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001b3b
sub edx, ecx
lea ecx, [ebp - 0x10c]
call fcn.1000773e
mov eax, dword [str.pnmg_]
mov ebx, esi
jmp 0x10001b72
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10001b8a
mov eax, dword [ebx*4 + 0x10021b44]
inc ebx
test eax, eax
jne 0x10001b58
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10001b1f
jmp 0x10001b90
mov esi, dword [ebp - 0x128]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret

Function at 0x100025b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 1
push 2
pop eax
push eax
mov ebx, edx
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x10002632
push 0xa
push 0
push esi
call fcn.1000cd0b
push 0xa
push 0
push ebx
mov esi, eax
call fcn.1000cce1
add esp, 0x18
mov dword [ebp - 0x10], esi
sub eax, 0x10e1
xorps xmm0, xmm0
movzx ecx, ax
movlpd qword [ebp - 0xc], xmm0
push 2
pop eax
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, edi
call fcn.1000130a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x10003cdb
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x108]
push ebx
push eax
mov esi, edx
mov edi, ecx
call fcn.1000a7f0
push esi
push 0x10029550
push str._s_s
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10001176
add esp, 0x20
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
je 0x10003d49
xor eax, eax
jmp 0x10003d71
push dword [0x10021b7c]
mov edx, esi
lea ecx, [ebp - 0x108]
call fcn.10001112
lea ecx, [ebp - 0x108]
call fcn.10007ed4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret

Function at 0x10003d80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 8
mov dword [ebp - 0x22c], edx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003db4
xor eax, eax
jmp 0x10003e97
push 0x220
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x228], 0x224
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10003e8e
push edi
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.1000c96a
pop ecx
pop ecx
lea edx, [ebp - 0x208]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10003e06
sub edx, ecx
lea ecx, [ebp - 0x208]
call fcn.1000773e
mov eax, dword [str.pnm_fkzsi]
mov edi, ebx
jmp 0x10003e3e
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.1000e032
pop ecx
pop ecx
test eax, eax
je 0x10003e56
mov eax, dword [edi*4 + 0x10021bc4]
inc edi
test eax, eax
jne 0x10003e23
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10003dea
jmp 0x10003e8d
lea edx, [ebp - 0x208]
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10003e5f
sub edx, edi
lea ecx, [ebp - 0x208]
call fcn.1000773e
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x208]
push eax
mov edx, 0x104
call fcn.100010e3
xor ebx, ebx
inc ebx
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x10003ea5
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 8
mov dword [ebp - 0x22c], edx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10003ed9
xor eax, eax
jmp 0x10003fd6
push 0x220
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x228], 0x224
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10003fcd
push edi
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.1000c96a
pop ecx
pop ecx
lea edx, [ebp - 0x208]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10003f2b
sub edx, ecx
lea ecx, [ebp - 0x208]
call fcn.1000773e
mov eax, dword [str.ihspA.4__q]
mov edi, esi
jmp 0x10003f63
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.1000e032
pop ecx
pop ecx
test eax, eax
je 0x10003fb2
mov eax, dword [edi*4 + 0x10025854]
inc edi
test eax, eax
jne 0x10003f48
mov edi, esi
cmp byte [0x10029940], al
je 0x10003f9a
mov eax, 0x10029940
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.1000e032
pop ecx
pop ecx
test eax, eax
je 0x10003fb2
inc edi
mov eax, edi
shl eax, 7
lea eax, [eax + 0x10029940]
cmp byte [eax], 0
jne 0x10003f76
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10003f0f
jmp 0x10003fcc
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x208]
push eax
mov edx, 0x104
call fcn.100010e3
xor esi, esi
inc esi
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x10003fe7
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push str.iphlpapi.dll
mov dword [ebp - 0x438], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x444], ebx
test ebx, ebx
je 0x100041fb
push str.GetExtendedTcpTable
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100041fb
push edi
push 5
push 2
push 1
lea eax, [ebp - 0x438]
push eax
push edi
call esi
push dword [ebp - 0x438]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 5
push 2
mov edi, eax
lea eax, [ebp - 0x438]
push 1
push eax
push edi
call esi
xor eax, eax
mov dword [ebp - 0x43c], eax
cmp dword [edi], eax
jbe 0x100041cf
lea esi, [edi + 0x18]
cmp dword [esi - 0x14], 5
jne 0x100041b7
push 0x220
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x228], 0x224
push dword [esi]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x440], eax
cmp eax, 0xffffffff
je 0x100041b1
lea ecx, [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x100041a5
mov ebx, dword [ebp - 0x440]
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.1000c96a
lea eax, [ebp - 0x208]
push str..exe
push eax
call fcn.1000a370
add esp, 0x10
test eax, eax
je 0x1000418f
push 0x208
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.1000a7f0
mov eax, dword [esi]
lea edx, [ebp - 0x208]
add esp, 0xc
mov dword [ebp - 0x434], eax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10004135
sub edx, ecx
lea ecx, [ebp - 0x208]
call fcn.1000773e
push SysReAllocString
lea eax, [ebp - 0x208]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x430]
call fcn.100011d3
push SysReAllocString
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x32c]
call fcn.100011d3
lea eax, [ebp - 0x434]
push eax
call fcn.1000615e
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x100040e1
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x43c]
inc eax
add esi, 0x18
mov dword [ebp - 0x43c], eax
cmp eax, dword [edi]
jb 0x10004082
mov ebx, dword [ebp - 0x444]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x1002a9cc]
mov ecx, 0x20c
sub eax, dword [0x1002a9c8]
cdq
idiv ecx
jmp 0x100041fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x1000420c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
xor edi, edi
lea eax, [ebp - 0x234]
push edi
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x238], 0x128
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp esi, 0xffffffff
jne 0x10004268
xor eax, eax
jmp 0x100043d1
mov ebx, 0x104
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.1000c96a
pop ecx
pop ecx
lea edx, [ebp - 0x214]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10004285
sub edx, ecx
lea ecx, [ebp - 0x214]
call fcn.1000773e
push dword [0x10021a90]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000435a
push ebx
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.1000a7f0
mov ecx, dword [ebp - 0x230]
lea edx, [ebp - 0x110]
add esp, 0xc
call fcn.10003ea5
push 0x208
push edi
test eax, eax
je 0x1000431d
lea eax, [ebp - 0x444]
push eax
call fcn.1000a7f0
mov eax, dword [ebp - 0x230]
add esp, 0xc
mov dword [ebp - 0x448], eax
mov edx, ebx
lea eax, [ebp - 0x110]
push SysReAllocString
push eax
push ecx
lea ecx, [ebp - 0x444]
call fcn.100011d3
lea eax, [ebp - 0x448]
jmp 0x1000439b
lea eax, [ebp - 0x654]
push eax
call fcn.1000a7f0
mov eax, dword [ebp - 0x230]
add esp, 0xc
mov dword [ebp - 0x658], eax
mov edx, ebx
lea eax, [ebp - 0x214]
push SysReAllocString
push eax
push ecx
lea ecx, [ebp - 0x654]
call fcn.100011d3
lea eax, [ebp - 0x658]
jmp 0x1000439b
push 0x208
lea eax, [ebp - 0x864]
push edi
push eax
call fcn.1000a7f0
mov eax, dword [ebp - 0x230]
add esp, 0xc
mov dword [ebp - 0x868], eax
mov edx, ebx
lea eax, [ebp - 0x214]
push SysReAllocString
push eax
push ecx
lea ecx, [ebp - 0x864]
call fcn.100011d3
lea eax, [ebp - 0x868]
push eax
call fcn.1000615e
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1000426d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1002a9cc]
mov ecx, 0x20c
sub eax, dword [0x1002a9c8]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x10004ac0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x134], 0
lea eax, [ebp - 0x134]
push esi
push edi
push eax
push ecx
mov edi, edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x134], 0
je 0x10004b5d
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004b5d
push 0x124
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x10004b52
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x134]
je 0x10004b6d
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10004b36
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10008f85
leave
ret
lea eax, [ebp - 0x10c]
mov edx, 0x104
push eax
mov ecx, edi
call fcn.100010e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x10004b5f
Function at 0x10004b8c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x104
lea eax, [ebp - 0x190]
push ebx
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x4c0], esi
call fcn.1000a7f0
add esp, 0xc
lea eax, [ebp - 0x3a0]
push ebx
push edi
push eax
call fcn.1000a7f0
add esp, 0xc
lea eax, [ebp - 0x298]
push ebx
push edi
push eax
call fcn.1000a7f0
add esp, 0xc
lea ecx, [ebp - 0x190]
call fcn.10004a02
cmp dword [0x10028514], 1
mov ebx, eax
jne 0x10004ca8
xor edx, edx
call fcn.10007a85
cmp eax, 0xffffffff
jne 0x10004c29
lea eax, [ebp - 0x190]
push eax
push str.__s__Null
push 0x80
push esi
call fcn.10001176
add esp, 0x10
jmp 0x10004df1
push 0x114
lea eax, [ebp - 0x4b8]
push edi
push eax
call fcn.1000a7f0
add esp, 0xc
lea ecx, [ebp - 0x4b8]
xor edi, edi
inc edi
mov dword [ebp - 0x4b8], edi
call fcn.100077af
test eax, eax
jne 0x10004c79
cmp dword [0x10029658], edi
jne 0x10004c65
call fcn.10005be5
jmp 0x10004c6a
call fcn.10005ef0
push eax
lea eax, [ebp - 0x190]
push eax
push str.__s__Failed__d_
jmp 0x10004c8c
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x190]
push eax
push str.__s__s
mov edi, 0x80
lea eax, [ebp - 0x298]
push edi
push eax
call fcn.10001176
add esp, 0x14
mov ecx, esi
jmp 0x10004de3
push 0x104
lea eax, [ebp - 0x4a8]
push edi
push eax
call fcn.1000a7f0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea edx, [ebp - 0x4a8]
mov ecx, esi
call fcn.10004ac0
mov edi, 0x80
lea eax, [ebp - 0x3a0]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10004dba
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
lea eax, [ebp - 0x3a0]
push eax
xor eax, eax
push eax
push eax
push eax
call esi
push str.channel
push 0
push 0
push eax
call esi
mov dword [ebp - 0x4bc], eax
xor esi, esi
push 0
push str.Static
push esi
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x10004d8e
push edi
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.1000a7f0
add esp, 0xc
lea eax, [ebp - 0x88]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [ebp - 0x88], 0
mov eax, dword [ebp - 0x4bc]
je 0x10004d16
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x190]
push eax
push str.__s___s___s_
lea eax, [ebp - 0x298]
push edi
push eax
call fcn.10001176
add esp, 0x1c
jmp 0x10004df1
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x190]
push eax
push str.__s___s___s
lea eax, [ebp - 0x298]
push edi
push eax
call fcn.10001176
add esp, 0x18
jmp 0x10004ddd
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x190]
push eax
push str.__s___s__null
lea eax, [ebp - 0x298]
push edi
push eax
call fcn.10001176
add esp, 0x14
mov ecx, dword [ebp - 0x4c0]
lea eax, [ebp - 0x298]
mov edx, edi
push eax
call fcn.100010e3
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
Function at 0x10004e02
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x289c
call fcn.10009d60
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2898]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x10004e74
movzx eax, byte [ebp - 0x2889]
push eax
movzx eax, byte [ebp - 0x288a]
push eax
movzx eax, byte [ebp - 0x288b]
push eax
movzx eax, byte [ebp - 0x288c]
push eax
movzx eax, byte [ebp - 0x288d]
push eax
movzx eax, byte [ebp - 0x288e]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push 0x20
push 0x1002852c
call fcn.10001176
add esp, 0x24
jmp 0x10004ef5
mov esi, 0x2880
lea eax, [ebp - 0x2888]
push esi
push 0
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x289c], esi
lea eax, [ebp - 0x289c]
push eax
lea eax, [ebp - 0x2888]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea esi, [ebp - 0x2888]
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X:_02X:_02X:_02X:_02X:_02X
push 0x20
push 0x1002852c
call fcn.10001176
mov esi, dword [esi]
add esp, 0x24
test esi, esi
jne 0x10004eab
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.10008f85
leave
ret