joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a88ec
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
xor eax, eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a8a45
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov word [ebp - 0xb0], 0x2f
mov byte [ebp - 0xac], 9
mov word [ebp - 0xa8], 0x76
mov byte [ebp - 0xa4], 9
mov word [ebp - 0xa0], 0x65
mov byte [ebp - 0x9c], 9
mov word [ebp - 0x98], 0x72
mov byte [ebp - 0x94], 9
mov word [ebp - 0x90], 0x79
mov byte [ebp - 0x8c], 9
mov word [ebp - 0x88], 0x73
mov byte [ebp - 0x84], 9
mov word [ebp - 0x80], 0x69
mov byte [ebp - 0x7c], 9
mov word [ebp - 0x78], 0x6c
mov byte [ebp - 0x74], 9
mov word [ebp - 0x70], 0x65
mov byte [ebp - 0x6c], 9
mov word [ebp - 0x68], 0x6e
mov byte [ebp - 0x64], 9
mov word [ebp - 0x60], 0x74
mov byte [ebp - 0x5c], 9
lea edx, [ebp - 0xb0]
mov ecx, 0xa
mov eax, 0x6a8a5c
call fcn.00425904
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040776c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x88
push 0
push 0
push 0
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 4]
mov edx, 0x6a8a98
call fcn.0040a8a8
mov eax, dword [ebp - 0xb4]
call fcn.0040a644
push eax
mov eax, dword [0x7d002c]
call fcn.0040a644
push eax
call sub.kernel32.dll_CreateProcessW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a8a4c
lea eax, [ebp - 0xb4]
call fcn.00409b00
lea eax, [ebp - 4]
call fcn.00409b00
pop eax
jmp eax

Function at 0x6b25d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x7d0534], 0
jne 0x6b25ef
call fcn.006b2594
mov eax, edi
dec eax
test eax, eax
jl 0x6b2617
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7d0134]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6b25f9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6b5614
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6b5645
dec al
je 0x6b5680
dec al
je 0x6b56c4
dec al
je 0x6b5736
jmp 0x6b57d1
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6b57d1
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6b5655
jmp 0x6b57d1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6b57d1
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6b5690
jmp 0x6b57d1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6b57d1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6b56f7
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6b570c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6b5724
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6b56d4
jmp 0x6b57d1
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6b57d1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6b579d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006b2620
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6b5752
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x70ba28
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x70ba79
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x70ba60
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x70ba50
jmp 0x70ba79
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x70ba61
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x752558
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x752797
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x7d063c], 0
je 0x75274c
lea edx, [ebp - 0x20c]
mov eax, ebx
call fcn.00423490
mov eax, dword [ebp - 0x20c]
mov ecx, 1
mov edx, eax
mov eax, 0x7527b0
call fcn.0040ab74
test eax, eax
jle 0x7525ef
movzx eax, byte [0x7527d0]
push eax
push esi
mov ecx, 0x7527e0
mov edx, 0x752810
mov eax, ebx
call fcn.0042c810
jmp 0x752777
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.00423490
mov eax, dword [ebp - 0x210]
mov ecx, 1
mov edx, eax
mov eax, 0x75283c
call fcn.0040ab74
test eax, eax
jle 0x752636
movzx eax, byte [0x7527d0]
push eax
push esi
mov ecx, 0x752874
mov edx, 0x75283c
mov eax, ebx
call fcn.0042c810
jmp 0x752777
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.00423490
mov eax, dword [ebp - 0x214]
mov ecx, 1
mov edx, eax
mov eax, 0x7528b0
call fcn.0040ab74
test eax, eax
jle 0x75267d
movzx eax, byte [0x7527d0]
push eax
push esi
mov ecx, 0x7527e0
mov edx, 0x752810
mov eax, ebx
call fcn.0042c810
jmp 0x752777
lea edx, [ebp - 0x218]
mov eax, ebx
call fcn.00423490
mov eax, dword [ebp - 0x218]
mov ecx, 1
mov edx, eax
mov eax, 0x7528dc
call fcn.0040ab74
test eax, eax
jle 0x7526c4
movzx eax, byte [0x7527d0]
push eax
push esi
mov ecx, 0x752914
mov edx, 0x7528dc
mov eax, ebx
call fcn.0042c810
jmp 0x752777
lea edx, [ebp - 0x21c]
mov eax, ebx
call fcn.00423490
mov eax, dword [ebp - 0x21c]
mov ecx, 1
mov edx, eax
mov eax, 0x752960
call fcn.0040ab74
test eax, eax
jle 0x752708
movzx eax, byte [0x7527d0]
push eax
push esi
mov ecx, 0x7529a4
mov edx, 0x752960
mov eax, ebx
call fcn.0042c810
jmp 0x752777
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.00423490
mov eax, dword [ebp - 0x220]
mov ecx, 1
mov edx, eax
mov eax, 0x7529fc
call fcn.0040ab74
test eax, eax
jle 0x75274c
movzx eax, byte [0x7527d0]
push eax
push esi
mov ecx, 0x752914
mov edx, 0x7529fc
mov eax, ebx
call fcn.0042c810
jmp 0x752777
push 0x104
lea eax, [ebp - 0x208]
push eax
mov eax, ebx
call fcn.0040a644
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, esi
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040a6f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75279e
lea eax, [ebp - 0x220]
mov edx, 6
call fcn.00409b60
pop eax
jmp eax
Function at 0x75d360
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409bf4
xor eax, eax
push ebp
push 0x75d432
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00424a54
test al, al
je 0x75d412
mov ebx, 0x75d440
xor eax, eax
push ebp
push 0x75d408
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a40c
mov eax, dword [ebp - 0x10]
call fcn.0040a384
push eax
call sub.sqlite3.dll_sqlite3_open
add esp, 8
test eax, eax
jne 0x75d3fe
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, 0x75ccac
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_free
pop ecx
mov eax, dword [ebp - 8]
push eax
call sub.sqlite3.dll_sqlite3_close
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75d412
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75d439
lea eax, [ebp - 0x10]
call fcn.00409b24
lea eax, [ebp - 4]
call fcn.00409b00
pop eax
jmp eax
Function at 0x75ea9c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x75ecb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7c7e28]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x75ec94
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
mov eax, dword [0x7c7e28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
mov ecx, 0x75ecd4
mov edx, dword [ebp - 4]
call fcn.0040a8a8
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00424a54
test al, al
je 0x75ec88
xor eax, eax
push ebp
push 0x75ec7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040a40c
mov eax, dword [ebp - 0x1c]
call fcn.0040a384
push eax
call sub.sqlite3.dll_sqlite3_open
add esp, 8
test eax, eax
jne 0x75ec74
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75ecf0
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75ed4c
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75eda0
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75edf0
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75ee38
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75ee84
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75eed0
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75ef34
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75ef88
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75efd4
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x75efe8
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_exec
add esp, 0x14
mov eax, dword [ebp - 0x10]
push eax
call sub.sqlite3.dll_sqlite3_free
pop ecx
mov eax, dword [ebp - 0xc]
push eax
call sub.sqlite3.dll_sqlite3_close
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75ec88
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x75eade
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75ecc0
lea eax, [ebp - 0x1c]
call fcn.00409b24
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b60
pop eax
jmp eax
Function at 0x76b0ac
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x76b23e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7c8600]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x76b214
inc ebx
mov dword [ebp - 0xc], 0
mov eax, dword [0x7c84f4]
mov eax, dword [eax]
call fcn.005a9f84
mov eax, dword [0x7c7c0c]
cmp byte [eax], 0
je 0x76b20a
lea ecx, [ebp - 8]
mov eax, dword [0x7c8600]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x76b11e
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jl 0x76b20a
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
movzx edx, word [edx + 4]
call fcn.0040a664
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
movzx edx, word [edx + 2]
call fcn.0040a664
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.0040a8a8
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00424448
cmp dword [ebp - 0x10], 0xb
jl 0x76b20a
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.0040aa60
mov eax, dword [0x7c80dc]
cmp byte [eax], 0
je 0x76b19d
mov eax, dword [0x7c81b0]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
jg 0x76b20a
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00424a54
test al, al
je 0x76b20a
mov cl, 1
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00424c94
mov eax, dword [ebp - 8]
call fcn.00424ea8
test al, al
je 0x76b1d7
mov eax, dword [0x7c7dd8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x76b20a
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.0040a644
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, dword [0x7c80ec]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
jne 0x76b20a
mov eax, dword [0x7c80ec]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc dword [ebp - 0xc]
dec ebx
jne 0x76b0e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76b245
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00409b60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b60
pop eax
jmp eax
Function at 0x771df0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x771ed8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x771eb0
push pe_nt_image_headers32
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.user32.dll_GetClassNameW
test eax, eax
je 0x771eb0
lea eax, [ebp - 4]
lea edx, [ebp - 0x20a]
mov ecx, 0x101
call fcn.0040a6f8
push pe_nt_image_headers32
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.user32.dll_GetWindowTextW
test eax, eax
je 0x771eb0
lea eax, [ebp - 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x101
call fcn.0040a6f8
mov eax, dword [ebp - 4]
mov edx, 0x771ef4
call fcn.0040a9e0
jne 0x771eb0
lea ecx, [ebp - 0x210]
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.004d87dc
mov eax, dword [ebp - 0x210]
mov edx, 0x771f28
call fcn.0040a9e0
jne 0x771eb0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x771edf
lea eax, [ebp - 0x210]
call fcn.00409b00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b60
pop eax
jmp eax

Function at 0x772158
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x772240
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x772218
push pe_nt_image_headers32
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.user32.dll_GetClassNameW
test eax, eax
je 0x772218
lea eax, [ebp - 4]
lea edx, [ebp - 0x20a]
mov ecx, 0x101
call fcn.0040a6f8
push pe_nt_image_headers32
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.user32.dll_GetWindowTextW
test eax, eax
je 0x772218
lea eax, [ebp - 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x101
call fcn.0040a6f8
mov eax, dword [ebp - 4]
mov edx, 0x77225c
call fcn.0040a9e0
jne 0x772218
lea ecx, [ebp - 0x210]
mov edx, 0xf
mov eax, dword [ebp - 8]
call fcn.004d87dc
mov eax, dword [ebp - 0x210]
mov edx, 0x772290
call fcn.0040a9e0
jne 0x772218
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x772247
lea eax, [ebp - 0x210]
call fcn.00409b00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b60
pop eax
jmp eax
Function at 0x784ba8
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x784da7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_CreatePipe
xor eax, eax
push ebp
push 0x784d7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.0040776c
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
mov word [ebp - 0x30], 0
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, edi
call fcn.0040a644
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, esi
call fcn.0040a644
push eax
mov eax, ebx
call fcn.0040a644
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
test bl, bl
jne 0x784c96
mov eax, dword [ebp + 8]
call fcn.00409b00
call fcn.004092ec
jmp 0x784d84
xor eax, eax
push ebp
push 0x784d52
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409b00
push 0
lea eax, [ebp - 0x10]
push eax
push 0xff
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x10], 0
jbe 0x784d02
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x170], 0
lea eax, [ebp - 0x174]
lea edx, [ebp - 0x170]
mov ecx, pe_nt_image_headers32
call fcn.0040a6e0
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.0040a850
mov eax, dword [0x7c84f4]
mov eax, dword [eax]
call fcn.005a9f84
test bl, bl
je 0x784d18
cmp dword [ebp - 0x10], 0
jne 0x784cac
push 0xffffffffffffffff
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x784d59
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x784dae
lea eax, [ebp - 0x174]
call fcn.00409b00
lea eax, [ebp - 4]
call fcn.00409b00
pop eax
jmp eax
Function at 0x784db8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x78500c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x785028
mov edx, 0x785064
mov eax, 0x80000002
call fcn.005b843c
mov esi, eax
push 0x208
lea eax, [ebp - 0x224]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.0040a6f8
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 0x10]
call fcn.0042c3c4
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x10]
call fcn.00409f38
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x22c]
mov ecx, 0x785100
mov edx, dword [ebp - 0x10]
call fcn.0040a8a8
mov eax, dword [ebp - 0x22c]
mov ecx, dword [0x7c86d4]
mov ecx, dword [ecx]
mov edx, 0x785128
call fcn.00784ba8
lea eax, [ebp - 8]
call fcn.00409b00
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x785228
call fcn.0040ab74
mov ebx, eax
test ebx, ebx
jle 0x784ee9
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409f38
lea ecx, [ebx + 0x11]
lea eax, [ebp - 8]
mov edx, 1
call fcn.0040aa60
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x785258
call fcn.0040ab74
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040aa18
lea eax, [ebp - 0xc]
call fcn.00409b00
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x785268
call fcn.0040ab74
mov ebx, eax
test ebx, ebx
jle 0x784f4c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00409f38
lea ecx, [ebx + 0x11]
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.0040aa60
mov ecx, 1
mov edx, dword [ebp - 0xc]
mov eax, 0x785258
call fcn.0040ab74
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040aa18
xor eax, eax
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00424448
mov ecx, 0x3e8
mov eax, dword [ebp - 0x14]
cdq
idiv ecx
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00424448
mov ecx, 0x3e8
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov dword [ebp - 0x18], eax
cmp esi, dword [ebp - 0x14]
jge 0x784f91
mov bl, 1
jmp 0x784f93
xor ebx, ebx
push 0x785298
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 0x14]
call fcn.0042419c
push dword [ebp - 0x234]
push 0x7852d0
lea edx, [ebp - 0x238]
mov eax, esi
call fcn.0042419c
push dword [ebp - 0x238]
lea eax, [ebp - 0x230]
mov edx, 4
call fcn.0040a930
mov eax, dword [ebp - 0x230]
call fcn.006a7f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x785013
lea eax, [ebp - 0x238]
mov edx, 5
call fcn.00409b60
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409b60
pop eax
jmp eax